MessageIdVersionQualifiersLevelTaskOpcodeKeywordsRecordIdProviderNameProviderIdLogNameProcessIdThreadIdMachineNameUserIdTimeCreatedActivityIdRelatedActivityIdContainerLogMatchedQueryIdsBookmarkLevelDisplayNameOpcodeDisplayNameTaskDisplayNameKeywordsDisplayNamesProperties
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2612; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904857Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational26122172hv-cinder-masteS-1-5-189/30/2022 10:03:20 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3036; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904856Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30364368hv-cinder-masteS-1-5-209/30/2022 10:03:20 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {07C8EF06-CCD5-47EF-9EC6-2270906908D0}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1165064728; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904855Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002644hv-cinder-masteS-1-5-189/30/2022 10:03:05 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {09D2E429-CBB7-4A45-9E28-AE44485B030A}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=472620834; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904854Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 10:03:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {BC1B1221-64FF-45D9-A671-A531AE69BA49}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1665535036; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904853Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002644hv-cinder-masteS-1-5-189/30/2022 10:03:02 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B197AC15-3F66-4F8C-89A3-306062DA03FB}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1348510424; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904852Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 10:02:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8BE40F2E-434D-47AF-BC16-5B697C2FB521}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=668070339; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904851Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 10:02:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2FB02280-58AB-409F-8D1D-AC6F87FC0F9A}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{C18B5196-9C2B-41B2-85DB-CFA88B2CF910}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904850Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 10:02:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7BF5951E-B254-408E-9705-643420DCD417}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1399872937; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904849Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 10:02:20 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {30D964FE-9E1F-4E93-8B88-473F7293C070}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=838523844; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904848Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 10:02:16 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DF9A47DE-0D5F-4DB0-BCDB-A7BE20E938E2}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1353071241; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904847Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002644hv-cinder-masteS-1-5-189/30/2022 10:02:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {43C9C92C-B94C-485E-B206-0018BAB08E11}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1569852167; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904846Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 10:01:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {243E979A-1F6C-4BE7-85C3-B8375EAB1D5C}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1678571372; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904845Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 10:01:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {77CD6961-D6FE-4C70-B242-42A5332B4ED5}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1535790693; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904844Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 10:01:54 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {89DB8900-C8DA-47AD-B652-922BB955B1E1}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-88bf9c67-6833-49d9-ac6d-6f88e9321dbe"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904843Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004456hv-cinder-masteS-1-5-189/30/2022 10:01:48 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {53D23606-D091-4B13-AAE7-EDCF5283EF38}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-88bf9c67-6833-49d9-ac6d-6f88e9321dbe",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-maste"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904842Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004456hv-cinder-masteS-1-5-189/30/2022 10:01:47 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {483A6007-1554-469B-AB79-C0F6DD1AEE1E}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-00ee38ab-9768-457e-a331-f42ca89d839f"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904841Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004456hv-cinder-masteS-1-5-189/30/2022 10:01:45 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EEEA061B-B560-4822-A8EF-24BF90A2D6A5}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-00ee38ab-9768-457e-a331-f42ca89d839f",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-maste"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904840Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004456hv-cinder-masteS-1-5-189/30/2022 10:01:45 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3036; ProviderPath = %SystemRoot%\System32\storagewmi.dll585700004611686018427387904839Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30364368hv-cinder-masteS-1-5-209/30/2022 10:01:27 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3036; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll585700004611686018427387904838Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30364368hv-cinder-masteS-1-5-209/30/2022 10:01:25 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4340; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll585700004611686018427387904837Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43403908hv-cinder-masteS-1-5-199/30/2022 10:01:25 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {BFA1A261-E920-49E2-9E91-88B182DEBEEC}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-ad9d918a-ca58-4a22-9731-f82ed6598509"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904836Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6001040hv-cinder-masteS-1-5-189/30/2022 9:59:40 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {AEABF557-DAAD-4B4E-992E-75A1575E7856}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-ad9d918a-ca58-4a22-9731-f82ed6598509",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-maste"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904835Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6001040hv-cinder-masteS-1-5-189/30/2022 9:59:40 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {CB94398D-E361-4AA1-874E-6BF375960AAD}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1065852332; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904834Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:59:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3B0E82C1-793D-49BB-A7EF-168D5359CCEB}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-7bf1001d-9e49-498a-95db-ad274a5eff37"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904833Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:59:00 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9E0DE45A-0D77-41D0-8EA6-597AADD6CDDC}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-7bf1001d-9e49-498a-95db-ad274a5eff37",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-maste"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904832Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:59:00 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A83266F5-1FC1-4452-B930-205BEF6EFECC}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{07EF3536-D338-4BB2-8C6A-7E80B83B9E58}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904831Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6001040hv-cinder-masteS-1-5-189/30/2022 9:58:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D93DC37A-04B1-43FA-881B-4BB3DD7C6CF2}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=481412043; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904830Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003664hv-cinder-masteS-1-5-189/30/2022 9:58:54 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {34541A9C-B44D-4D00-97B3-3EB415D40914}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-fcd3f7f1-28e6-4027-ad0a-ce3bff169dc9"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904829Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:58:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D8AD5C84-36D1-49B2-9692-4D4B27363B8F}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-fcd3f7f1-28e6-4027-ad0a-ce3bff169dc9",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-maste"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904828Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:58:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3036; ProviderPath = %SystemRoot%\System32\storagewmi.dll585700004611686018427387904827Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30364368hv-cinder-masteS-1-5-209/30/2022 9:58:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3036; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll585700004611686018427387904826Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30364368hv-cinder-masteS-1-5-209/30/2022 9:58:47 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 900; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll585700004611686018427387904825Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9001868hv-cinder-masteS-1-5-199/30/2022 9:58:47 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {078652EA-8B90-4375-9AF2-CCDC1B400C50}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=838495917; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904824Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004456hv-cinder-masteS-1-5-189/30/2022 9:57:39 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6A939EB0-20A0-430D-AFC5-DB4EB4020ED4}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=699321711; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904823Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004456hv-cinder-masteS-1-5-189/30/2022 9:57:37 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 900; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll585700004611686018427387904822Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9001868hv-cinder-masteS-1-5-199/30/2022 9:57:37 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3036; ProviderPath = %SystemRoot%\System32\storagewmi.dll585700004611686018427387904821Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30364368hv-cinder-masteS-1-5-209/30/2022 9:57:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3036; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll585700004611686018427387904820Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30364368hv-cinder-masteS-1-5-209/30/2022 9:56:53 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {91547D1B-E8C6-4693-AA1F-5455A97C2217}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=115890398; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904819Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:56:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 900; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll585700004611686018427387904818Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9001868hv-cinder-masteS-1-5-199/30/2022 9:56:45 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3036; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll585700004611686018427387904817Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30364368hv-cinder-masteS-1-5-209/30/2022 9:56:00 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 900; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll585700004611686018427387904816Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9001868hv-cinder-masteS-1-5-199/30/2022 9:56:00 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2454A612-2283-4192-9B89-151A9B612AF1}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-952937cf-c588-47d4-9ede-7fd97eda1772"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904815Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:54:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5C5D25D3-51F5-40B7-863C-B47AEDD576B8}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-952937cf-c588-47d4-9ede-7fd97eda1772",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-maste"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904814Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:54:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6725B343-E2E6-4A2B-B5F7-007F40B6DD14}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1108262266; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904813Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:54:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EB04DD9B-D091-4A29-8D50-321D53626A76}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=125046570; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904812Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6001040hv-cinder-masteS-1-5-189/30/2022 9:54:48 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {41E74BDB-E4D5-40AA-A3C7-2230B6AB1D88}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-7bf1001d-9e49-498a-95db-ad274a5eff37"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904811Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:54:42 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {698E633C-8AD0-4B3E-A769-DBDE44BD2831}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-7bf1001d-9e49-498a-95db-ad274a5eff37",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-maste"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904810Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:54:42 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {66D98854-375A-43FD-B9A3-05CAF66E2B92}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1202333491; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904809Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6001040hv-cinder-masteS-1-5-189/30/2022 9:54:36 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2EDE38BA-EA15-4992-A62F-D5BA83969D68}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1415961536; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904808Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:54:35 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {91105CAB-5DF3-4724-B2BB-D8C3795EF428}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=470066291; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904807Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:54:34 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {86A50479-938D-4393-9C8F-09DEF1D7E766}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1429545663; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904806Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:54:33 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A37FF8C7-CE01-46E8-9B02-250F9250620C}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=851343702; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904805Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003924hv-cinder-masteS-1-5-189/30/2022 9:54:20 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {97B3EB0C-AF8A-4738-95AA-5F3A9822244E}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=754322794; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904804Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6001040hv-cinder-masteS-1-5-189/30/2022 9:54:16 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A6A55F4D-1B19-4E0C-9A70-8EA9D1887BC3}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1634082979; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904803Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6001040hv-cinder-masteS-1-5-189/30/2022 9:54:13 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {494E1EAC-A595-466B-8B0D-E0B657CE3615}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=89061113; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904802Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:54:10 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {CF04AA99-01B2-4DD9-AD6F-CF0C6F943C9E}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1216734008; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904801Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:54:10 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {ADD1B38A-ED4D-4D39-A4D5-A17B2BB1FA0B}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-20fff726-13e1-4e4a-ab94-b75786fe7b1b"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904800Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:54:09 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5EA73E83-815E-4843-88B9-4F4D1AD73B8A}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-20fff726-13e1-4e4a-ab94-b75786fe7b1b",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-maste"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904799Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:54:09 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {713E48B9-4C57-4ACC-8C2E-A62AE37C4337}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=883169482; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904798Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6001040hv-cinder-masteS-1-5-189/30/2022 9:54:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0A843A86-5215-49A7-8FA1-D62A2FCB3D1C}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1653906566; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904797Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:53:53 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {19979932-BC05-4CE9-9B22-21A71AEE267B}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=69358010; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904796Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002644hv-cinder-masteS-1-5-189/30/2022 9:53:44 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C0BE424F-2B19-4EC5-B316-FD588E3976C0}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=584718683; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904795Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:53:25 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2F2C28EC-1019-449D-9AE1-6E310D9A3A71}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1913843050; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904794Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:53:23 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {35AEBA66-167C-477E-9319-515D8ABBFD24}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=808147672; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904793Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:53:22 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9838A181-F9C2-4228-8AE4-8DB411783E9F}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-c7837308-8183-4208-b2f8-486a31376875"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904792Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:53:14 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C07BD454-0DAB-4DA6-9A94-22F53EA3F18D}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-c7837308-8183-4208-b2f8-486a31376875",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-maste"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904791Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002644hv-cinder-masteS-1-5-189/30/2022 9:53:14 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D962CA6B-13C4-4D23-BB63-02E9E46DF886}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=298383596; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904790Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:53:13 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3E5F6067-5DA4-4F52-854B-4D07BCACD54C}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1721559074; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904789Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002644hv-cinder-masteS-1-5-189/30/2022 9:53:12 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {520D4507-9F52-4747-9AFA-4AC3ED4A1BCA}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1371719244; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904788Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002644hv-cinder-masteS-1-5-189/30/2022 9:53:10 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {813CAD4E-2AE3-4B2E-B189-27B24E04FC95}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{D5258E95-65A0-433F-83FA-3A5EC77C7B40}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904787Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6001040hv-cinder-masteS-1-5-189/30/2022 9:53:09 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C089B872-B2CA-4A16-B4A7-BF7C6D6EA1EA}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1335836321; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904786Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:53:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {76218347-7762-4D16-A945-CD65C7C68336}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{110A0443-F100-4942-A279-692000BFC989}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904785Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:53:06 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {415810EF-2E7A-4CE1-BB55-DC338D0D7D44}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1673184508; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904784Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002644hv-cinder-masteS-1-5-189/30/2022 9:53:06 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DA505E38-4429-462F-B59E-10395434C772}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1042375369; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904783Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:53:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0248CE72-0B32-42C4-BF9A-2E625375FD4F}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1543299468; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904782Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:52:56 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F6017DDC-B6E8-4599-87A4-D5441FE944CB}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=157421647; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904781Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:52:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3036; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll585700004611686018427387904780Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30364368hv-cinder-masteS-1-5-209/30/2022 9:52:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A9391177-6FE3-4785-A8FD-46CD814508B6}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-fa49bd88-7301-4551-85b2-d6fe5a4b2a79"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904779Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6001040hv-cinder-masteS-1-5-189/30/2022 9:52:42 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9A3B320D-7748-4A8A-B76A-8D8719271FA2}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-fa49bd88-7301-4551-85b2-d6fe5a4b2a79",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-maste"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904778Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:52:42 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7024C223-E430-4774-8860-BA6EFAB04D7F}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{B278D93E-CAE2-4F99-8AAB-19DBEF6C23D6}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904777Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:52:40 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2A349750-7252-4B35-A409-5707720AF715}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{74198C6D-C434-4643-ADBF-04744AFD3EC2}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904776Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:52:39 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {92A83D5E-C61F-4727-8AD1-17F6FDADA1D7}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{930C099E-6AD0-4408-B751-462A35043967}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904775Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6001040hv-cinder-masteS-1-5-189/30/2022 9:52:37 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {941B35D8-378B-4E12-89E3-30F92DAAA19B}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-20fff726-13e1-4e4a-ab94-b75786fe7b1b"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904774Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:52:12 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8A2A71A1-FE7C-43FC-A018-2F0CFDA8619E}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-20fff726-13e1-4e4a-ab94-b75786fe7b1b",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-maste"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904773Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:52:12 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B0E9DFE6-144A-44CE-8D9A-2D6409D7A69C}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{8166E3A1-24BC-41A7-8013-BE91E3A5A459}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904772Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002228hv-cinder-masteS-1-5-189/30/2022 9:51:53 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A9CBC8DD-AE25-40E8-9FE0-CBE4F1CFCE9D}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-d8cf6740-b7df-49d6-8e88-9812b15e1fde"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904771Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002644hv-cinder-masteS-1-5-189/30/2022 9:51:43 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C5BF1322-D4D0-41DB-A8F2-3BB2F350726F}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-d8cf6740-b7df-49d6-8e88-9812b15e1fde",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-maste"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904770Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002644hv-cinder-masteS-1-5-189/30/2022 9:51:43 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2905C8CA-6AE1-45D9-BE93-9F948D345D4F}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::GetObject - ROOT\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_ConcreteJob.InstanceID="94DDE17D-70BE-4AEC-862C-5117934EB790"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904769Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002644hv-cinder-masteS-1-5-189/30/2022 9:51:41 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D97B048E-7A30-4B40-B6B2-5AFB4D8BD6C6}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-8e7db158-71fb-42e2-bb97-241e907786e0"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904768Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002644hv-cinder-masteS-1-5-189/30/2022 9:51:38 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7CC47D4F-BB0C-4CC2-8560-1D4B6900D781}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-8e7db158-71fb-42e2-bb97-241e907786e0",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-maste"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904767Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002644hv-cinder-masteS-1-5-189/30/2022 9:51:38 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EFA9D076-00E4-476C-A688-6C934051CB47}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::GetObject - ROOT\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_ConcreteJob.InstanceID="F15177FB-9CEF-4E9A-A078-2865B306825C"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904766Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:51:34 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {14308F10-A78A-4655-906D-E119706BB847}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::GetObject - ROOT\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_ConcreteJob.InstanceID="EE361AFB-5072-40DB-8C00-14064A12C504"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904765Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:51:34 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {31F64676-7D6F-4B77-A0E3-A66B6C913712}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::GetObject - ROOT\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_ConcreteJob.InstanceID="ED6E18C1-F34F-4735-9F28-F65A4FCAB980"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904764Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:51:34 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3D5138FA-1128-4345-B00A-1C385FD75F6D}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::GetObject - ROOT\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_ConcreteJob.InstanceID="D6BA7369-3324-4A27-A238-84F148A63673"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904763Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:51:34 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DC40067D-6498-4116-94B0-7E75A95B7FB4}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4492; Component = Unknown; Operation = Start IWbemServices::GetObject - ROOT\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_ConcreteJob.InstanceID="2D61F824-548C-462B-A329-ADF82C4A801F"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904762Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:51:33 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A2A4ADD5-6549-46F7-8828-FFF86131F058}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1139890630; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904761Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:51:31 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {F7DACAFB-3B3E-4C2C-A64C-4F85B472B957}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{F8FB0DD6-1D85-4CB3-B92A-E6B2A315AFFC}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904760Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002228hv-cinder-masteS-1-5-189/30/2022 9:51:30 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C39AC7D9-DDAB-46E6-A416-697E7C47651A}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2125028520; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904759Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6001040hv-cinder-masteS-1-5-189/30/2022 9:51:30 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9F18DFFA-E7D4-4612-A6C6-2BBE01063288}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{98E3A71E-3B49-4E03-BE3B-8EDA950C9761}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904758Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002228hv-cinder-masteS-1-5-189/30/2022 9:51:28 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {AFE7650D-CF81-4F00-A39D-DC28CC653DB9}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{87705A2F-F03C-42DF-8C25-8DD138E36FA6}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904757Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002228hv-cinder-masteS-1-5-189/30/2022 9:51:27 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1B9604BA-26FC-42EE-8FFF-F046AFA6DD85}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-f1609c14-b9aa-4f3c-956a-306e64f3ff52"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904756Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002228hv-cinder-masteS-1-5-189/30/2022 9:51:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4817C212-5A9A-4E3B-BA8A-06489C7CC227}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-f1609c14-b9aa-4f3c-956a-306e64f3ff52",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-maste"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904755Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002228hv-cinder-masteS-1-5-189/30/2022 9:51:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6AE042D1-6CDB-4A6B-AB90-A241DE167647}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1515873211; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904754Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:51:00 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D18BE23F-85D6-4A9C-8312-75CEDFC0A604}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-9392ad7b-d061-4ce1-b5ac-59db92be7d11"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904753Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002644hv-cinder-masteS-1-5-189/30/2022 9:50:59 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2C90D1A4-224D-4F93-B299-205CC18CB2E5}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-9392ad7b-d061-4ce1-b5ac-59db92be7d11",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-maste"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904752Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004456hv-cinder-masteS-1-5-189/30/2022 9:50:59 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3036; ProviderPath = %SystemRoot%\System32\storagewmi.dll585700004611686018427387904751Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30364368hv-cinder-masteS-1-5-209/30/2022 9:50:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6139503-C20C-4ACA-B1F8-FE2F2C4841E5}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=621734483; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904750Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002228hv-cinder-masteS-1-5-189/30/2022 9:50:22 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {025B2D78-9177-4DFB-A4EE-2FFF2315EC73}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=166576544; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904749Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003140hv-cinder-masteS-1-5-189/30/2022 9:50:21 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9E18AE49-2D62-4090-9B17-28B0C8C646D3}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=518826653; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904748Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003924hv-cinder-masteS-1-5-189/30/2022 9:50:20 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A6E226C4-2215-45D8-9EFB-9D38EE0E4580}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=557670861; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904747Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003140hv-cinder-masteS-1-5-189/30/2022 9:50:18 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6AE42D6E-1407-42F8-97FA-E6029B156F2E}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{E635F5C7-CEFE-4493-BEA1-D01D10FDEFB5}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904746Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003924hv-cinder-masteS-1-5-189/30/2022 9:50:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A36364AB-6D19-4F02-A173-8035DAD6DBD5}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1271262327; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904745Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003924hv-cinder-masteS-1-5-189/30/2022 9:50:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2BB85DD2-A5B7-4F68-8C8E-7BFB0C0D0A6D}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-c3971c02-ab43-47a0-bad0-be731ce4d4be"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904744Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002644hv-cinder-masteS-1-5-189/30/2022 9:50:10 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DFA6538A-B8CF-46E2-89BC-C5AAF240EA1B}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{758ED03A-773B-4AD8-BDF1-CC236DAF0B84}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904743Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003924hv-cinder-masteS-1-5-189/30/2022 9:50:10 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {26C47C37-FED6-4545-B948-44894EDF50C0}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-c3971c02-ab43-47a0-bad0-be731ce4d4be",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-maste"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904742Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002644hv-cinder-masteS-1-5-189/30/2022 9:50:10 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {73C405FF-7B07-4EDA-8482-B4A2BF96DA72}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=286723687; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904741Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002644hv-cinder-masteS-1-5-189/30/2022 9:50:09 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3036; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll585700004611686018427387904740Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30364368hv-cinder-masteS-1-5-209/30/2022 9:49:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4EBAFAF2-9EED-4895-8ADF-12BA877F0C31}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=359696845; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904739Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:49:41 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B6B399D9-448B-4418-B75E-73677901EA5C}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{CF3F58A1-609F-4489-8E9A-3DABD47C7BDE}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904738Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002228hv-cinder-masteS-1-5-189/30/2022 9:49:39 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A50CD020-AF20-4C77-98E7-70AFB7B5EB7C}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1863563293; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904737Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004456hv-cinder-masteS-1-5-189/30/2022 9:49:20 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E6BD6B30-B0D3-4CC8-8056-9D5657CEB43A}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=570207369; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904736Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003924hv-cinder-masteS-1-5-189/30/2022 9:49:20 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DE78BB8B-52C7-4ABD-8600-4FCC21818A38}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2044483459; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904735Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003664hv-cinder-masteS-1-5-189/30/2022 9:48:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9ADC18C7-F5C5-444C-965C-0B4350D8C434}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1659923791; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904734Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:48:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C7B4CB7E-9350-45B1-90EE-16D3B0759737}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1028875173; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904733Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:48:47 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {73486347-D606-47D2-B625-94CB08D4F409}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=495270758; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904732Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002228hv-cinder-masteS-1-5-189/30/2022 9:48:30 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7C608199-3C91-4539-9526-E2ADB09FCD89}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1200369161; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904731Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002644hv-cinder-masteS-1-5-189/30/2022 9:48:28 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {89C2FC74-52A8-408F-BCB8-1D0CC8673DC5}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{08C977CE-6BB5-4306-BB31-4875B38946CD}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904730Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:48:27 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6E1A9E6D-E711-4A50-82EE-301DE650D30A}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=131280513; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904729Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:48:26 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1B618650-C0DD-4498-A89E-EE5A882D6C25}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=235118505; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904728Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002644hv-cinder-masteS-1-5-189/30/2022 9:48:25 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {AD9EB930-3E0D-4B33-83C1-52A83C012AD9}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1982237083; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904727Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:48:22 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EB7103F1-232F-4454-B152-A47982F2AD00}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1666913871; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904726Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:48:18 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3036; ProviderPath = %SystemRoot%\System32\storagewmi.dll585700004611686018427387904725Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30364368hv-cinder-masteS-1-5-209/30/2022 9:48:16 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DDD459DD-2572-4D74-B2B1-166621ECB98B}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=106647908; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904724Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:48:15 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {BF82D43A-8E0C-41CE-A60D-2756DF28E91C}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{F4C645A9-9215-425B-9ED6-7C3C973758CD}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904723Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002044hv-cinder-masteS-1-5-189/30/2022 9:48:14 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A91A0908-2AA0-4DC8-A0BA-21A55A24B509}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{0CF39123-B86D-43CE-9700-DF5AAADE5FEC}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904722Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:48:14 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {800495C0-B30A-417C-A257-6276ADCB4A81}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{9A7C3829-738F-4CB5-AF4F-2C09C4D9AFF5}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904721Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:48:12 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {04782B00-92A0-40ED-A766-97125FDEB0E3}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=286589745; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904720Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002644hv-cinder-masteS-1-5-189/30/2022 9:48:12 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {87C6B153-C4EA-45D7-827F-A1F7BA18BD3A}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=555278487; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904719Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002044hv-cinder-masteS-1-5-189/30/2022 9:48:12 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7CA56D4B-0130-40A0-A9B4-BA756DB57E34}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{8BE1F5F8-20AA-44DB-959C-A980044AF0C8}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904718Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:48:06 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6DFBC5D-7B29-4B0B-88C7-F3E8D7548206}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=7659395; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904717Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003140hv-cinder-masteS-1-5-189/30/2022 9:47:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {CD07779F-CCE0-440D-BA1A-CF5F503660D2}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=650898832; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904716Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:47:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D845C489-9AD4-4737-9B38-569EF0F15EE0}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=2062894572; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904715Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003116hv-cinder-masteS-1-5-189/30/2022 9:47:56 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0B9E71E0-A9A5-498D-BF8E-98FD5C01B076}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=415515355; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904714Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003664hv-cinder-masteS-1-5-189/30/2022 9:47:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7F6BBFFC-839F-4992-853C-6C456148C089}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{B8EFF594-8694-43E5-BAD5-69240AB5A9ED}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904713Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003664hv-cinder-masteS-1-5-189/30/2022 9:47:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {98B768BC-E35C-417E-B1A3-CADF610EA961}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{51F05C0D-A060-45FD-A283-F9A9F5A3E84C}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904712Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003664hv-cinder-masteS-1-5-189/30/2022 9:47:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2F49EE0D-4315-4768-9A46-713BDB9602B6}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=135391383; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904711Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003664hv-cinder-masteS-1-5-189/30/2022 9:47:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {52A0F3D3-B583-418C-93AE-E2A15C7EA981}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1992702063; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904710Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003116hv-cinder-masteS-1-5-189/30/2022 9:47:48 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {35506739-012D-4156-A419-545EF8321AF8}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{35F21CCF-3CF2-4404-A476-7A95108233B1}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904709Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003664hv-cinder-masteS-1-5-189/30/2022 9:47:48 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D2974042-99E7-46AB-8DA4-0CFA77AAABF0}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=779629451; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904708Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003116hv-cinder-masteS-1-5-189/30/2022 9:47:48 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0AF038C2-89CA-4E86-A8AA-136358AC8C68}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1937934013; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904707Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003116hv-cinder-masteS-1-5-189/30/2022 9:47:47 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5E7E338D-CE67-4472-87D9-5C816CE423EC}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1069931888; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904706Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003116hv-cinder-masteS-1-5-189/30/2022 9:47:47 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {2CC4F1ED-BA5F-4118-B4D1-976F9AB1BC0F}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{C60399B2-B5CB-41D3-99A2-42CE93FF4801}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904705Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003664hv-cinder-masteS-1-5-189/30/2022 9:47:47 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {42729C5A-ED51-46E9-B0E6-6E921239784A}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{95C564C2-7DA8-4B7D-8C18-B78EC209890B}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904704Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003664hv-cinder-masteS-1-5-189/30/2022 9:47:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {81CFF7AC-E462-4496-BA83-8E2C062D3EE3}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{BFCC7DBB-716F-447A-AD57-F094657F5F43}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904703Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003664hv-cinder-masteS-1-5-189/30/2022 9:47:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FEDE00BE-125C-484A-AB12-6548050CF657}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=516767848; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904702Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:47:20 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A7BD3657-7613-4228-AF27-74605D346C8C}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1722827458; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904701Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:47:18 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4650488A-FC0D-4FDB-9C87-0522BEC86AB0}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=555351463; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904700Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002044hv-cinder-masteS-1-5-189/30/2022 9:47:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {76C7531A-88A2-4E20-9191-500EA7079C56}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=38926542; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904699Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002044hv-cinder-masteS-1-5-189/30/2022 9:47:14 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A32CEE27-6351-44B9-84FC-A57DD906218B}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Host.HostName="iqn.2010-10.org.openstack:volume-b3551656-cf4b-4d3b-a96e-f0599026be3e"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904698Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002044hv-cinder-masteS-1-5-189/30/2022 9:47:14 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A5CBB37C-E4BB-4B72-9AC1-BA44860039C0}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_IDMethod.HostName="iqn.2010-10.org.openstack:volume-b3551656-cf4b-4d3b-a96e-f0599026be3e",Method=4,Value="iqn.1991-05.com.microsoft:hv-cinder-maste"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904697Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002044hv-cinder-masteS-1-5-189/30/2022 9:47:14 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {833E00C1-2A50-4AA3-9997-9922C69496A2}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=237395284; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904696Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:47:14 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {B9DF1F03-57A9-4F41-80A2-04AC803CC655}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=684401538; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904695Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:47:13 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3036; ProviderPath = %SystemRoot%\System32\storagewmi.dll585700004611686018427387904694Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30364368hv-cinder-masteS-1-5-209/30/2022 9:47:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FB559989-7654-4E69-A0A6-F87C2C24CF9B}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1598287309; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904693Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:47:00 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3DC67B2C-75C3-4E20-9DB0-9C156E50E9EA}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=938018175; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904692Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004660hv-cinder-masteS-1-5-189/30/2022 9:46:59 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8653BE10-44FD-4EC3-96A8-F8A8AA5C620D}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{0A51832A-7FE3-4EE9-8CCB-1839A09CD92B}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904691Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003116hv-cinder-masteS-1-5-189/30/2022 9:46:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {8DA75FF7-7CD5-4F07-8979-BD3A5D12A5E5}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=914652607; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904690Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003116hv-cinder-masteS-1-5-189/30/2022 9:46:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {EE95116A-52C0-407E-AFFA-DDAD8F51EFBD}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=389524927; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904689Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003140hv-cinder-masteS-1-5-189/30/2022 9:46:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {55749232-1C9D-4D7C-A97A-6F0DED86CFDD}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1497389862; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904688Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003140hv-cinder-masteS-1-5-189/30/2022 9:46:53 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {AB3350FA-2ECA-451E-BBFA-D88DDF0B2F9F}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{47A9C035-2DD8-4BE7-A3E4-AB62694C8CA9}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904687Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002644hv-cinder-masteS-1-5-189/30/2022 9:46:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C6A4A175-F29D-468E-8F8D-97D97ED286CB}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{05556310-88A7-4F6B-A28F-290CF8BE37F7}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904686Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003140hv-cinder-masteS-1-5-189/30/2022 9:46:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {113E8C18-1A79-444D-9C47-156B32FCC56A}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1080782443; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904685Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:46:47 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5C19761A-FAE7-4E38-9C79-FF6785B3564F}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=325908867; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904684Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003140hv-cinder-masteS-1-5-189/30/2022 9:46:47 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {E5D1D623-2713-4712-B0CF-DCAD6E2AFE08}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=794940558; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904683Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003116hv-cinder-masteS-1-5-189/30/2022 9:46:43 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {16815436-B154-4EF2-A1FE-C683E33E2F0C}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1054923271; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904682Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:46:43 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7862E65A-0DFD-410A-B542-5423514A2C49}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=756290291; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904681Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:46:42 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DC92B4E1-EB6C-40A9-B2FA-77DA882D4E27}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=991346842; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904680Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:46:42 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D83545C5-5ABE-46E1-AEA8-05CE506BAC89}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{7F936819-0121-4947-98F0-9BB27C194E07}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904679Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002644hv-cinder-masteS-1-5-189/30/2022 9:46:41 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {77E556C6-4403-4A72-B3C2-69A7E5117A44}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{CCDAF017-D1E8-415C-A047-5E7282552FDF}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904678Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003116hv-cinder-masteS-1-5-189/30/2022 9:46:41 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {5276508B-EFBC-4275-BC58-AAD7B574186B}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{12DA1CA0-A2D6-4EF8-9BC4-160BDB7FEE5E}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904677Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002644hv-cinder-masteS-1-5-189/30/2022 9:46:40 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {C69AAFF7-E810-40AB-9D75-600D56E4D56D}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{34767A87-D0AD-40A1-B498-ED11AD9768E9}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904676Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003116hv-cinder-masteS-1-5-189/30/2022 9:46:40 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {815BA50E-DB87-4DD7-8852-9D91501C2167}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1233807175; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904675Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004072hv-cinder-masteS-1-5-189/30/2022 9:46:34 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9342F377-64EC-4024-A480-6A62A17DA93C}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{568D7C85-8497-429C-A2DA-2EC48A8ED099}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904674Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003116hv-cinder-masteS-1-5-189/30/2022 9:46:30 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1C2C5D02-8AB5-4CF6-B20E-336DE7A9A1FB}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{EED2A5AA-6C56-4E55-8C0D-2DD7AC9A3D55}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904673Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:46:21 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {3575D336-C81B-4A79-8955-3E45809B5B44}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1057452025; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904672Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002644hv-cinder-masteS-1-5-189/30/2022 9:46:14 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {0FD3F338-21AF-4BE4-BFA0-626910B4A1F8}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=239004820; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904671Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004456hv-cinder-masteS-1-5-189/30/2022 9:46:14 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96706064-F091-4692-8DDE-BDDD56201C2F}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1376510172; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904670Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002644hv-cinder-masteS-1-5-189/30/2022 9:46:09 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {877F6141-D98D-48C2-B815-E0F7F54991F6}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{D812A6D4-5F90-490B-9F9E-C85D4DBA8EFF}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904669Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004072hv-cinder-masteS-1-5-189/30/2022 9:46:09 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {1810703A-F9A5-4BB7-94A7-10CBB7A6C538}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1367666559; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904668Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004072hv-cinder-masteS-1-5-189/30/2022 9:46:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {DFCBB159-331A-4D75-8627-503CAE006A75}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=575976876; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904667Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:46:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {6FDCC23E-D785-44F0-8A1B-9D20515AA8DC}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1739985217; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904666Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003000hv-cinder-masteS-1-5-189/30/2022 9:46:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4B4314E4-F234-44BB-8FA3-320F33BF23FF}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Snapshot.Id="{0A186B24-4BBA-4F7A-960B-C5F61686CB6E}"; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904665Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6004072hv-cinder-masteS-1-5-189/30/2022 9:46:05 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {53F6354D-4DBE-4105-B896-1512DCF81399}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1328; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\wmi : \\.\ROOT\wmi:WT_Disk.WTD=1037919269; ResultCode = 0x80041024; PossibleCause = Unknown585802004611686018427387904664Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003116hv-cinder-masteS-1-5-189/30/2022 9:46:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVSS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3036; ProviderPath = %systemroot%\system32\wbem\vsswmi.dll585700004611686018427387904663Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30364368hv-cinder-masteS-1-5-209/30/2022 9:45:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3036; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904662Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30361700hv-cinder-masteS-1-5-209/30/2022 9:45:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 900; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll585700004611686018427387904661Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9001868hv-cinder-masteS-1-5-199/30/2022 9:45:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3036; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904660Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30361700hv-cinder-masteS-1-5-209/30/2022 9:45:41 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1072; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll585700004611686018427387904659Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational10723696hv-cinder-masteS-1-5-199/30/2022 9:44:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_SyntheticEthernetPortSettingData' ; UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 4984, ClientMachine = HV-CINDER-MASTE; PossibleCause = Temporary586000004611686018427387904658Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational600604hv-cinder-masteS-1-5-189/30/2022 9:43:59 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceCreationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_SyntheticEthernetPortSettingData' ; UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 4984, ClientMachine = HV-CINDER-MASTE; PossibleCause = Temporary586000004611686018427387904657Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational600604hv-cinder-masteS-1-5-189/30/2022 9:43:59 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT EnabledState, TargetInstance FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Msvm_ComputerSystem' AND TargetInstance.EnabledState != PreviousInstance.EnabledState AND (TargetInstance.EnabledState = '2' OR TargetInstance.EnabledState = '3' OR TargetInstance.EnabledState = '32768' OR TargetInstance.EnabledState = '32769'); UserName = NT AUTHORITY\SYSTEM; ClientProcessID = 4492, ClientMachine = HV-CINDER-MASTE; PossibleCause = Temporary586000004611686018427387904656Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational600604hv-cinder-masteS-1-5-189/30/2022 9:43:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4540; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904655Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational45404052hv-cinder-masteS-1-5-189/30/2022 9:43:54 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3036; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll585700004611686018427387904654Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30362972hv-cinder-masteS-1-5-209/30/2022 9:43:41 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3844; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904653Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38443452hv-cinder-masteS-1-5-189/30/2022 9:43:31 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3036; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904652Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30362972hv-cinder-masteS-1-5-209/30/2022 9:43:31 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3036; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904651Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30362972hv-cinder-masteS-1-5-209/30/2022 9:43:30 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4760; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904650Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational47604276hv-cinder-masteS-1-5-189/30/2022 9:22:10 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 828; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904649Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational8284496hv-cinder-masteS-1-5-209/30/2022 9:21:10 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 828; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll585700004611686018427387904648Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational8283884hv-cinder-masteS-1-5-209/30/2022 9:21:09 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 828; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904647Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational8284496hv-cinder-masteS-1-5-209/30/2022 9:21:09 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3756; ProviderPath = %systemroot%\system32\wbem\msiprov.dll585700004611686018427387904646Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37563784hv-cinder-masteS-1-5-189/30/2022 8:59:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3024; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904645Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30243048hv-cinder-masteS-1-5-209/30/2022 8:57:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {41895835-D4AA-0001-355C-8941AAD4D801}; ClientMachine = HV-CINDER-MASTE; User = HV-CINDER-MASTE\Admin; ClientProcessId = 3856; Component = Core; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x800706BE; PossibleCause = Could not send status to client585802004611686018427387904644Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003984hv-cinder-masteS-1-5-189/30/2022 8:57:09 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {41895835-D4AA-0001-355C-8941AAD4D801}; ClientMachine = HV-CINDER-MASTE; User = HV-CINDER-MASTE\Admin; ClientProcessId = 3856; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904643Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational600816hv-cinder-masteS-1-5-189/30/2022 8:57:09 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {41895835-D4AA-0001-355C-8941AAD4D801}; ClientMachine = HV-CINDER-MASTE; User = HV-CINDER-MASTE\Admin; ClientProcessId = 3856; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - root\virtualization\v2 : SELECT * FROM __InstanceModificationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904642Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational600816hv-cinder-masteS-1-5-189/30/2022 8:57:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; UserName = HV-CINDER-MASTE\Admin; ClientProcessID = 3856, ClientMachine = HV-CINDER-MASTE; PossibleCause = Temporary586000004611686018427387904641Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational600816hv-cinder-masteS-1-5-189/30/2022 8:57:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __InstanceModificationEvent WITHIN 2 WHERE TargetInstance ISA 'Msvm_ConcreteJob'; UserName = HV-CINDER-MASTE\Admin; ClientProcessID = 3856, ClientMachine = HV-CINDER-MASTE; PossibleCause = Temporary586000004611686018427387904640Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational600816hv-cinder-masteS-1-5-189/30/2022 8:57:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3860; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904639Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational3860744hv-cinder-masteS-1-5-199/30/2022 8:57:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3024; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904638Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30243328hv-cinder-masteS-1-5-209/30/2022 8:57:05 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSiSCSITargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3880; ProviderPath = C:\windows\system32\wbem\SmIscsiTargetProv.dll585700004611686018427387904637Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38803472hv-cinder-masteS-1-5-209/30/2022 8:57:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WinTargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2484; ProviderPath = C:\windows\system32\wbem\WTWMIProv.dll585700004611686018427387904636Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational24841164hv-cinder-masteS-1-5-199/30/2022 8:57:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3756; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904635Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37563784hv-cinder-masteS-1-5-189/30/2022 8:57:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSiSCSITargetProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3880; ProviderPath = C:\windows\system32\wbem\SmIscsiTargetProv.dll585700004611686018427387904634Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38801184hv-cinder-masteS-1-5-209/30/2022 8:57:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3024; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll585700004611686018427387904633Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30243048hv-cinder-masteS-1-5-209/30/2022 8:56:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
wfascim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3024; ProviderPath = %systemroot%\system32\wbem\wfascim.dll585700004611686018427387904632Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30243328hv-cinder-masteS-1-5-209/30/2022 8:56:47 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3024; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904631Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30243052hv-cinder-masteS-1-5-209/30/2022 8:56:15 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3164; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100C; PossibleCause = Unknown585802004611686018427387904630Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002972hv-cinder-masteS-1-5-189/30/2022 8:55:47 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3164; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100C; PossibleCause = Unknown585802004611686018427387904629Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002972hv-cinder-masteS-1-5-189/30/2022 8:55:47 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
wmiprov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3756; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904628Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37563788hv-cinder-masteS-1-5-189/30/2022 8:55:47 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3116; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904627Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003012hv-cinder-masteS-1-5-189/30/2022 8:55:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3116; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904626Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002080hv-cinder-masteS-1-5-189/30/2022 8:55:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3116; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904625Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002080hv-cinder-masteS-1-5-189/30/2022 8:55:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3024; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll585700004611686018427387904624Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30243052hv-cinder-masteS-1-5-209/30/2022 8:55:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3116; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904623Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002080hv-cinder-masteS-1-5-189/30/2022 8:55:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3116; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904622Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002080hv-cinder-masteS-1-5-189/30/2022 8:55:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3116; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904621Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003012hv-cinder-masteS-1-5-189/30/2022 8:55:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3116; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904620Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002080hv-cinder-masteS-1-5-189/30/2022 8:55:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3116; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904619Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002080hv-cinder-masteS-1-5-189/30/2022 8:55:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3116; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904618Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003012hv-cinder-masteS-1-5-189/30/2022 8:55:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3024; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll585700004611686018427387904617Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30243052hv-cinder-masteS-1-5-209/30/2022 8:55:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-MASTE; User = HV-CINDER-MASTE\cloudbase-init; ClientProcessId = 3152; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT RemainingWindowsReArmCount, KeyManagementServiceListeningPort, KeyManagementServiceDnsPublishing, KeyManagementServiceLowPriority, ClientMachineId, KeyManagementServiceHostCaching, Version FROM SoftwareLicensingService; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904616Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6003012hv-cinder-masteS-1-5-189/30/2022 8:55:44 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
SppProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3024; ProviderPath = %SystemRoot%\System32\sppwmi.dll585700004611686018427387904615Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30243052hv-cinder-masteS-1-5-209/30/2022 8:55:43 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3116; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\CIMV2 : SELECT SMBIOSAssetTag FROM Win32_SystemEnclosure ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904614Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002080hv-cinder-masteS-1-5-189/30/2022 8:55:36 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3116; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904613Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002644hv-cinder-masteS-1-5-189/30/2022 8:55:28 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2104; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904612Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational21043204hv-cinder-masteS-1-5-189/30/2022 8:55:23 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3024; ProviderPath = %windir%\system32\wbem\servercompprov.dll585700004611686018427387904611Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30243052hv-cinder-masteS-1-5-209/30/2022 8:55:23 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904610Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904609Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904608Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904607Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904606Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904605Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904604Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904603Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904602Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904601Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904600Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904599Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904598Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904597Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904596Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904595Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904594Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904593Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904592Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904591Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904590Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904589Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904588Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904587Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904586Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904585Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904584Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904583Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904582Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904581Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904580Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904579Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904578Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904577Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904576Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904575Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904574Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904573Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904572Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904571Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904570Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904569Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904568Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904567Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904566Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {D6A8B5B2-BA54-48A3-8416-D579D3DFD655}; ClientMachine = HV-CINDER-MASTE; User = ; ClientProcessId = 600; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904565Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3024; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904564Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30243052hv-cinder-masteS-1-5-209/30/2022 8:55:07 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 600; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904563Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6001312hv-cinder-masteS-1-5-189/30/2022 8:55:05 AM41895835-d4aa-0005-575a-8941aad4d801microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary586000004611686018427387904562Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002968hv-cinder-masteS-1-5-189/30/2022 8:55:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904561Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6001316hv-cinder-masteS-1-5-189/30/2022 8:55:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3756; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904560Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37563788hv-cinder-masteS-1-5-189/30/2022 8:55:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3756; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904559Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37563788hv-cinder-masteS-1-5-189/30/2022 8:55:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3024; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904558Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30243048hv-cinder-masteS-1-5-209/30/2022 8:54:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2572; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown585802004611686018427387904557Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002996hv-cinder-masteS-1-5-189/30/2022 8:54:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = HV-CINDER-MASTE; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2072; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User : __Namespace.name="S_1_5_21_1616555695_3013856299_2103617988_500"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904556Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6002976hv-cinder-masteS-1-5-189/30/2022 8:54:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-HNNEC9J7A3A; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2132; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100A; PossibleCause = Unknown585802004611686018427387904555Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5442324WIN-5T344G8GM1HS-1-5-189/30/2022 8:54:22 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-HNNEC9J7A3A; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2132; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100A; PossibleCause = Unknown585802004611686018427387904554Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5442324WIN-5T344G8GM1HS-1-5-189/30/2022 8:54:22 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-HNNEC9J7A3A; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2252; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown585802004611686018427387904553Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5442572WIN-5T344G8GM1HS-1-5-189/30/2022 8:53:37 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-HNNEC9J7A3A; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1792; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : select * from Win32_OperatingSystem; ResultCode = 0x8004100A; PossibleCause = Unknown585802004611686018427387904552Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5442568WIN-5T344G8GM1HS-1-5-189/30/2022 8:53:37 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4848; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\wmi : select * from WDMClassesOfDriver where ClassName = "RNDISMPStatisticsOID"; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904551Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9763432WIN-5T344G8GM1HS-1-5-181/19/2018 9:48:09 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4848; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\wmi : select * from WMIBinaryMofResource where Name = "C:\\windows\\System32\\drivers\\en-US\\netvsc.sys.mui[NdisMofResource]"; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904550Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9763432WIN-5T344G8GM1HS-1-5-181/19/2018 9:48:09 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4460; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904549Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational44605048WIN-5T344G8GM1HS-1-5-201/19/2018 9:46:31 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4460; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904548Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational44605048WIN-5T344G8GM1HS-1-5-201/19/2018 9:46:31 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4848; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904547Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational48484776WIN-5T344G8GM1HS-1-5-181/19/2018 9:45:30 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4956; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\Defender : SELECT * FROM MSFT_MpComputerStatus; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904546Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9761176WIN-5T344G8GM1HS-1-5-181/19/2018 9:42:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ProtectionManagement provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = "%ProgramData%\Microsoft\Windows Defender\Platform\4.12.17007.18011-0\ProtectionManagement.dll"585700004611686018427387904545Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37522228WIN-5T344G8GM1HS-1-5-191/19/2018 9:42:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MsNetImPlatform provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\ndisimplatcim.dll585700004611686018427387904544Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27763064WIN-5T344G8GM1HS-1-5-201/19/2018 9:42:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4120; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904543Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational41204148WIN-5T344G8GM1HS-1-5-181/19/2018 9:42:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904542Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27761292WIN-5T344G8GM1HS-1-5-201/19/2018 9:42:48 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904541Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37522228WIN-5T344G8GM1HS-1-5-191/19/2018 9:42:48 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904540Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27763064WIN-5T344G8GM1HS-1-5-201/19/2018 9:42:48 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904539Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27763064WIN-5T344G8GM1HS-1-5-201/19/2018 9:42:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904538Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27763064WIN-5T344G8GM1HS-1-5-201/19/2018 9:42:16 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4120; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904537Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational41204148WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:43 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904536Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27761292WIN-5T344G8GM1HS-1-5-201/19/2018 9:41:39 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3752; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904535Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37522228WIN-5T344G8GM1HS-1-5-191/19/2018 9:41:39 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904534Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27762812WIN-5T344G8GM1HS-1-5-201/19/2018 9:41:39 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 976; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904533Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762172WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMad8d0f9c-9109-0001-0a10-8dad0991d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary586000004611686018427387904532Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904531Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational976388WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904530Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904529Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904528Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904527Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904526Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904525Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904524Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904523Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904522Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904521Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904520Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904519Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904518Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904517Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904516Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904515Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904514Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904513Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904512Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904511Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904510Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904509Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904508Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904507Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904506Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904505Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904504Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904503Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904502Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904501Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904500Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904499Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904498Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904497Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904496Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904495Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904494Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904493Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904492Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904491Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904490Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904489Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904488Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904487Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904486Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9663586B-26CE-4E7F-A115-7420EF71DDF6}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 976; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904485Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762680WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2776; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904484Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27762848WIN-5T344G8GM1HS-1-5-201/19/2018 9:41:31 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2204; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown585802004611686018427387904483Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762692WIN-5T344G8GM1HS-1-5-181/19/2018 9:41:30 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3176; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904482Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational31761548WIN-5T344G8GM1HS-1-5-201/19/2018 9:40:26 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_RegisteredSubprofile; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904481Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_SubProfileRequiresProfile; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904480Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_RegisteredProfile; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904479Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ReferencedProfile; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904478Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementSoftwareIdentity; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904477Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementConformsToProfileEx; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904476Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\interop\ms_409 : MSFTSM_ElementConformsToProfile; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904475Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3952; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\cimv2\storage\ms_409 : __Namespace.Name='iscsitarget'; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904474Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9564728WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904473Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39684084WIN-5T344G8GM1HS-1-5-181/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2712; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904472Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational2712592WIN-5T344G8GM1HS-1-5-201/19/2018 9:38:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2712; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904471Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational2712592WIN-5T344G8GM1HS-1-5-201/19/2018 9:38:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904470Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43482924WIN-5T344G8GM1HS-1-5-201/19/2018 9:35:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4444; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904469Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational44444516WIN-5T344G8GM1HS-1-5-191/19/2018 9:35:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904468Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43484632WIN-5T344G8GM1HS-1-5-201/19/2018 9:35:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904467Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43484632WIN-5T344G8GM1HS-1-5-201/19/2018 9:35:41 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4348; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904466Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43484632WIN-5T344G8GM1HS-1-5-201/19/2018 9:35:41 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904465Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational48241600WIN-5T344G8GM1HS-1-5-201/19/2018 9:34:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1548; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904464Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational15482160WIN-5T344G8GM1HS-1-5-191/19/2018 9:34:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904463Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational48241600WIN-5T344G8GM1HS-1-5-201/19/2018 9:34:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904462Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational48244808WIN-5T344G8GM1HS-1-5-201/19/2018 9:34:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 764; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904461Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational7641020WIN-5T344G8GM1HS-1-5-181/19/2018 9:33:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904460Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational48244808WIN-5T344G8GM1HS-1-5-201/19/2018 9:32:20 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4824; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904459Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational48244808WIN-5T344G8GM1HS-1-5-201/19/2018 9:32:20 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904458Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39684084WIN-5T344G8GM1HS-1-5-181/19/2018 9:31:16 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1520; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904457Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational15202704WIN-5T344G8GM1HS-1-5-201/19/2018 9:29:44 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1520; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904456Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational15202704WIN-5T344G8GM1HS-1-5-201/19/2018 9:29:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4693033F-66F0-46C4-8E27-99621765768B}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4124; Component = Core; Operation = Start IWbemServices::ExecMethod - root\microsoft\windows\servermanager : MSFT_ServerManagerTasks::GetServerFeature; ResultCode = 0x800706BE; PossibleCause = Could not send status to client585802004611686018427387904455Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562716WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {4693033F-66F0-46C4-8E27-99621765768B}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 4124; Component = Unknown; Operation = Start IWbemServices::ExecMethod - root\microsoft\windows\servermanager : MSFT_ServerManagerTasks::GetServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904454Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational956432WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:32 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4608; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904453Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational46084636WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:30 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904452Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28722896WIN-5T344G8GM1HS-1-5-201/19/2018 9:27:26 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4344; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904451Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43444368WIN-5T344G8GM1HS-1-5-191/19/2018 9:27:26 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904450Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28722900WIN-5T344G8GM1HS-1-5-201/19/2018 9:27:25 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904449Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28722900WIN-5T344G8GM1HS-1-5-201/19/2018 9:27:20 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904448Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28722900WIN-5T344G8GM1HS-1-5-201/19/2018 9:27:19 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 956; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904447Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562284WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:18 AMaff0bd57-9107-0002-9bbd-f0af0791d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = root\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary586000004611686018427387904446Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:18 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904445Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562284WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:18 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904444Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904443Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904442Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904441Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904440Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904439Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904438Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904437Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904436Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904435Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904434Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904433Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904432Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904431Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904430Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904429Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904428Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904427Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904426Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904425Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904424Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904423Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904422Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904421Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904420Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904419Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904418Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904417Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904416Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904415Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904414Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904413Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562868WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904412Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904411Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904410Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904409Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904408Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904407Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904406Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904405Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562868WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904404Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904403Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904402Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904401Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904400Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904399Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904398Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904397Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904396Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904395Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904394Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904393Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904392Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904391Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904390Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904389Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904388Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904387Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904386Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904385Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904384Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904383Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904382Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904381Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904380Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904379Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904378Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904377Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904376Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904375Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904374Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904373Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904372Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904371Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904370Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904369Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904368Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904367Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904366Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904365Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904364Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904363Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904362Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904361Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904360Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904359Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904358Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904357Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904356Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904355Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904354Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {FD8B735D-48A5-4AFF-82A0-4530749B9C93}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 956; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904353Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562860WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2872; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904352Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28722900WIN-5T344G8GM1HS-1-5-201/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2336; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown585802004611686018427387904351Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562864WIN-5T344G8GM1HS-1-5-181/19/2018 9:27:17 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\virtualization\v2; NotificationQuery = SELECT * FROM __ClassOperationEvent; UserName = .\SYSTEM; ClientProcessID = 0, ClientMachine = ; PossibleCause = Temporary586000004611686018427387904350Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2360; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - root\virtualization\v2 : Msvm_ResourcePoolComponent.Name="Microsoft|RDV Integration Component Resource Pool|V2.0"; ResultCode = 0x80041010; PossibleCause = Unknown585802004611686018427387904349Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskState; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904348Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904347Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904346Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904345Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904344Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904343Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904342Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904341Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904340Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904339Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904338Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904337Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904336Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904335Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904334Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682824WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904333Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904332Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904331Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904330Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904329Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\HyperVCluster\v2\ms_409 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904328Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 968; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904327Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682948WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AM96ed06e7-9107-0000-3d07-ed960791d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904326Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682948WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:51 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualDiskChangedRange; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904325Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VHDSSnapshotInformation; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904324Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VHDSetInformation; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904323Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904322Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904321Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904320Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904319Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904318Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904317Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904316Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904315Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904314Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904313Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904312Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904311Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualDiskChangedRange; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904310Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VHDSSnapshotInformation; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904309Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VHDSetInformation; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904308Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualHardDiskSettingData; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904307Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_VirtualHardDiskInfo; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904306Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_SummaryInformationBase; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904305Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : Msvm_ServicingSettings; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904304Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_SettingsDefineState; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904303Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ServiceAffectsElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904302Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ManagedElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904301Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ElementSettingData; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904300Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_ElementCapabilities; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904299Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_Dependency; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904298Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_Component; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904297Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1528; Component = Unknown; Operation = Start IWbemServices::DeleteClass - root\virtualization\v2\ms_409 : CIM_AffectedJobElement; ResultCode = 0x80041002; PossibleCause = Unknown585802004611686018427387904296Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9682820WIN-5T344G8GM1HS-1-5-181/19/2018 9:26:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904295Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28402880WIN-5T344G8GM1HS-1-5-201/19/2018 9:26:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904294Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28402880WIN-5T344G8GM1HS-1-5-201/19/2018 9:26:44 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2840; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904293Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28402864WIN-5T344G8GM1HS-1-5-201/19/2018 9:26:42 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 308; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904292Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562620WIN-5T344G8GM1HS-1-5-181/19/2018 9:25:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 308; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904291Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational956404WIN-5T344G8GM1HS-1-5-181/19/2018 9:25:02 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2528; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904290Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25283456WIN-5T344G8GM1HS-1-5-181/19/2018 9:24:56 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904289Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25084092WIN-5T344G8GM1HS-1-5-201/19/2018 9:24:53 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2736; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904288Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27363804WIN-5T344G8GM1HS-1-5-191/19/2018 9:24:53 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904287Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25084092WIN-5T344G8GM1HS-1-5-201/19/2018 9:24:53 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2508; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904286Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25082824WIN-5T344G8GM1HS-1-5-201/19/2018 9:24:53 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3200; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904285Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational32003644WIN-5T344G8GM1HS-1-5-181/19/2018 9:23:15 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904284Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28562920WIN-5T344G8GM1HS-1-5-201/19/2018 9:23:12 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2540; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904283Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25403240WIN-5T344G8GM1HS-1-5-191/19/2018 9:23:12 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904282Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28562884WIN-5T344G8GM1HS-1-5-201/19/2018 9:23:11 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904281Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28562884WIN-5T344G8GM1HS-1-5-201/19/2018 9:23:05 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904280Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28562884WIN-5T344G8GM1HS-1-5-201/19/2018 9:23:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 956; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904279Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562916WIN-5T344G8GM1HS-1-5-181/19/2018 9:23:03 AM17f2f0cc-9107-0002-12f1-f2170791d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904278Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9562908WIN-5T344G8GM1HS-1-5-181/19/2018 9:23:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904277Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28562884WIN-5T344G8GM1HS-1-5-201/19/2018 9:23:02 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3808; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904276Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38084032WIN-5T344G8GM1HS-1-5-181/19/2018 9:14:59 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904275Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational26642720WIN-5T344G8GM1HS-1-5-201/19/2018 9:14:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2972; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904274Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational2972156WIN-5T344G8GM1HS-1-5-191/19/2018 9:14:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904273Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational26642720WIN-5T344G8GM1HS-1-5-201/19/2018 9:14:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2664; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904272Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational26641584WIN-5T344G8GM1HS-1-5-201/19/2018 9:14:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = WIN-5T344G8GM1H\Administrator; ClientProcessId = 1860; Component = Unknown; Operation = Start IWbemServices::PutInstance - root\cimv2 : Win32_ComputerSystem.Name="WIN-5T344G8GM1H"; ResultCode = 0x80041001; PossibleCause = Unknown585802004611686018427387904271Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11804136WIN-5T344G8GM1HS-1-5-181/19/2018 9:11:39 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4368; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904270Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43684496WIN-5T344G8GM1HS-1-5-201/19/2018 9:10:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1784; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904269Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational17842240WIN-5T344G8GM1HS-1-5-181/19/2018 9:05:00 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904268Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational952452WIN-5T344G8GM1HS-1-5-201/19/2018 9:04:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1152; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904267Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11521396WIN-5T344G8GM1HS-1-5-191/19/2018 9:04:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904266Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational952452WIN-5T344G8GM1HS-1-5-201/19/2018 9:04:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 952; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904265Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9521000WIN-5T344G8GM1HS-1-5-201/19/2018 9:04:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3176; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904264Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational31763364WIN-5T344G8GM1HS-1-5-181/19/2018 8:58:49 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904263Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational46724700WIN-5T344G8GM1HS-1-5-201/19/2018 8:57:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904262Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational46724700WIN-5T344G8GM1HS-1-5-201/19/2018 8:57:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 88; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystemProduct; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904261Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11801284WIN-5T344G8GM1HS-1-5-181/19/2018 8:56:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4672; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904260Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational46724700WIN-5T344G8GM1HS-1-5-201/19/2018 8:56:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1180; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904259Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11804340WIN-5T344G8GM1HS-1-5-181/19/2018 8:56:46 AM289cfce6-9103-0003-f9fd-9c280391d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904258Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11804340WIN-5T344G8GM1HS-1-5-181/19/2018 8:56:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904257Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39684008WIN-5T344G8GM1HS-1-5-201/19/2018 8:55:06 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904256Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39684008WIN-5T344G8GM1HS-1-5-201/19/2018 8:55:05 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904255Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational36883696WIN-5T344G8GM1HS-1-5-181/19/2018 8:55:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904254Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39684020WIN-5T344G8GM1HS-1-5-201/19/2018 8:54:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4024; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904253Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational40244052WIN-5T344G8GM1HS-1-5-191/19/2018 8:54:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904252Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39684008WIN-5T344G8GM1HS-1-5-201/19/2018 8:54:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3968; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904251Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational39683996WIN-5T344G8GM1HS-1-5-201/19/2018 8:54:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3880; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904250Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38803916WIN-5T344G8GM1HS-1-5-201/19/2018 8:54:38 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {7C5C4FFB-9102-0000-4A51-5C7C0291D301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 1192; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904249Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11923004WIN-5T344G8GM1HS-1-5-181/19/2018 8:54:34 AM7c5c4ffb-9102-0000-4a51-5c7c0291d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1200; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904248Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational12002840WIN-5T344G8GM1HS-1-5-181/19/2018 8:54:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 1192, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary586000004611686018427387904247Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11922792WIN-5T344G8GM1HS-1-5-181/19/2018 8:52:27 AM7c5c4ffb-9102-0001-8851-5c7c0291d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1192; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll585700004611686018427387904246Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11922792WIN-5T344G8GM1HS-1-5-181/19/2018 8:52:27 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1192; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904245Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11922796WIN-5T344G8GM1HS-1-5-181/19/2018 8:51:57 AM7c5c4ffb-9102-0001-5f51-5c7c0291d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904244Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11922796WIN-5T344G8GM1HS-1-5-181/19/2018 8:51:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904243Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38323932WIN-5T344G8GM1HS-1-5-201/19/2018 8:51:38 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904242Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38323872WIN-5T344G8GM1HS-1-5-201/19/2018 8:51:37 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 428; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904241Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational4281316WIN-5T344G8GM1HS-1-5-181/19/2018 8:51:13 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904240Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38323872WIN-5T344G8GM1HS-1-5-201/19/2018 8:51:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3888; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904239Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38883916WIN-5T344G8GM1HS-1-5-191/19/2018 8:51:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904238Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38323872WIN-5T344G8GM1HS-1-5-201/19/2018 8:51:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3832; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904237Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38323860WIN-5T344G8GM1HS-1-5-201/19/2018 8:51:04 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4796; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904236Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational4796840WIN-5T344G8GM1HS-1-5-201/19/2018 8:45:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2284; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904235Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational22842676WIN-5T344G8GM1HS-1-5-181/19/2018 8:44:15 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904234Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25482728WIN-5T344G8GM1HS-1-5-201/19/2018 8:44:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2300; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904233Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational23004360WIN-5T344G8GM1HS-1-5-191/19/2018 8:44:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904232Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25482728WIN-5T344G8GM1HS-1-5-201/19/2018 8:44:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2548; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904231Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25483736WIN-5T344G8GM1HS-1-5-201/19/2018 8:44:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1052; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904230Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational10524868WIN-5T344G8GM1HS-1-5-201/19/2018 8:36:56 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3184; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904229Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational3184404WIN-5T344G8GM1HS-1-5-181/19/2018 8:34:15 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_WIN32_TERMINALSERVICE_Prov provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\system32\tscfgwmi.dll585700004611686018427387904228Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11644616WIN-5T344G8GM1HS-1-5-201/19/2018 8:34:14 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4600; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryStaticData; ResultCode = 0x80041010; PossibleCause = Unknown585802004611686018427387904227Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9644904WIN-5T344G8GM1HS-1-5-181/19/2018 8:34:14 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 4600; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM BatteryFullChargedCapacity; ResultCode = 0x80041010; PossibleCause = Unknown585802004611686018427387904226Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9644904WIN-5T344G8GM1HS-1-5-181/19/2018 8:34:13 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
PowerWmiProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SYSTEMROOT%\system32\PowerWmiProvider.dll585700004611686018427387904225Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641368WIN-5T344G8GM1HS-1-5-201/19/2018 8:34:13 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
StorageWMI provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\System32\storagewmi.dll585700004611686018427387904224Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641368WIN-5T344G8GM1HS-1-5-201/19/2018 8:34:11 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904223Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641368WIN-5T344G8GM1HS-1-5-201/19/2018 8:34:11 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904222Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641368WIN-5T344G8GM1HS-1-5-201/19/2018 8:34:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2920; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904221Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational29204532WIN-5T344G8GM1HS-1-5-191/19/2018 8:34:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904220Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641368WIN-5T344G8GM1HS-1-5-201/19/2018 8:34:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904219Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641532WIN-5T344G8GM1HS-1-5-201/19/2018 8:34:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {9A81CB05-910F-0003-8ACC-819A0F91D301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 964; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904218Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9644228WIN-5T344G8GM1HS-1-5-181/19/2018 8:33:15 AM9a81cb05-910f-0003-8acc-819a0f91d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904217Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9641824WIN-5T344G8GM1HS-1-5-181/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904216Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9645076WIN-5T344G8GM1HS-1-5-181/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll585700004611686018427387904215Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641532WIN-5T344G8GM1HS-1-5-201/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904214Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9645076WIN-5T344G8GM1HS-1-5-181/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904213Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9645076WIN-5T344G8GM1HS-1-5-181/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904212Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9641824WIN-5T344G8GM1HS-1-5-181/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904211Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9645076WIN-5T344G8GM1HS-1-5-181/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll585700004611686018427387904210Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641532WIN-5T344G8GM1HS-1-5-201/19/2018 8:33:01 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 3976; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\CIMV2 : SELECT SMBIOSAssetTag FROM Win32_SystemEnclosure ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904209Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9645076WIN-5T344G8GM1HS-1-5-181/19/2018 8:32:59 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904208Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641532WIN-5T344G8GM1HS-1-5-201/19/2018 8:32:59 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904207Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11642868WIN-5T344G8GM1HS-1-5-201/19/2018 8:32:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1912; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904206Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational19123084WIN-5T344G8GM1HS-1-5-181/19/2018 8:32:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1164; ProviderPath = %windir%\system32\wbem\servercompprov.dll585700004611686018427387904205Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11641532WIN-5T344G8GM1HS-1-5-201/19/2018 8:32:58 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 996; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904204Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational996456WIN-5T344G8GM1HS-1-5-201/19/2018 8:29:00 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 996; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904203Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational996456WIN-5T344G8GM1HS-1-5-201/19/2018 8:29:00 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4324; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904202Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational43243568WIN-5T344G8GM1HS-1-5-181/19/2018 8:27:56 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 964, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary586000004611686018427387904201Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9643260WIN-5T344G8GM1HS-1-5-181/19/2018 8:26:55 AM9a81cb05-910f-0000-a4cc-819a0f91d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 964; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll585700004611686018427387904200Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9643260WIN-5T344G8GM1HS-1-5-181/19/2018 8:26:55 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904199Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723768WIN-5T344G8GM1HS-1-5-201/19/2018 8:26:50 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904198Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723768WIN-5T344G8GM1HS-1-5-201/19/2018 8:25:57 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 964; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904197Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9644648WIN-5T344G8GM1HS-1-5-181/19/2018 8:25:52 AM9a81cb05-910f-0003-4bcc-819a0f91d301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904196Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9644648WIN-5T344G8GM1HS-1-5-181/19/2018 8:25:52 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904195Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723768WIN-5T344G8GM1HS-1-5-201/19/2018 8:24:46 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4124; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904194Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational41244152WIN-5T344G8GM1HS-1-5-181/19/2018 8:24:15 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904193Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723820WIN-5T344G8GM1HS-1-5-201/19/2018 8:24:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3084; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904192Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational30843436WIN-5T344G8GM1HS-1-5-191/19/2018 8:24:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904191Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723800WIN-5T344G8GM1HS-1-5-201/19/2018 8:24:08 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904190Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723800WIN-5T344G8GM1HS-1-5-201/19/2018 8:24:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904189Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723800WIN-5T344G8GM1HS-1-5-201/19/2018 8:24:03 AMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3868; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904188Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38683176WIN-5T344G8GM1HS-1-5-181/16/2018 6:37:16 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904187Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25042192WIN-5T344G8GM1HS-1-5-201/16/2018 6:37:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2788; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904186Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27882624WIN-5T344G8GM1HS-1-5-191/16/2018 6:37:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904185Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25042192WIN-5T344G8GM1HS-1-5-201/16/2018 6:37:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2504; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904184Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational25042440WIN-5T344G8GM1HS-1-5-201/16/2018 6:37:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4024; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904183Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational40243868WIN-5T344G8GM1HS-1-5-181/16/2018 6:27:16 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904182Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational12883280WIN-5T344G8GM1HS-1-5-201/16/2018 6:27:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1500; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904181Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational15002664WIN-5T344G8GM1HS-1-5-191/16/2018 6:27:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904180Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational12883280WIN-5T344G8GM1HS-1-5-201/16/2018 6:27:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1288; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904179Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational12884056WIN-5T344G8GM1HS-1-5-201/16/2018 6:27:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 652; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904178Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational6521972WIN-5T344G8GM1HS-1-5-181/16/2018 6:17:16 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904177Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational40323152WIN-5T344G8GM1HS-1-5-201/16/2018 6:17:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904176Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational36883124WIN-5T344G8GM1HS-1-5-191/16/2018 6:17:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904175Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational40321184WIN-5T344G8GM1HS-1-5-201/16/2018 6:17:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4032; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904174Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational40321160WIN-5T344G8GM1HS-1-5-201/16/2018 6:17:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1088; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904173Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational10884088WIN-5T344G8GM1HS-1-5-181/16/2018 6:10:25 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904172Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27841752WIN-5T344G8GM1HS-1-5-201/16/2018 6:08:29 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1176; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904171Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11763928WIN-5T344G8GM1HS-1-5-181/16/2018 6:08:20 PMb65c0852-8ef4-0003-8709-5cb6f48ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904170Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11763928WIN-5T344G8GM1HS-1-5-181/16/2018 6:08:20 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904169Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27841752WIN-5T344G8GM1HS-1-5-201/16/2018 6:07:37 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904168Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27841752WIN-5T344G8GM1HS-1-5-201/16/2018 6:07:36 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904167Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27844072WIN-5T344G8GM1HS-1-5-201/16/2018 6:07:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4076; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904166Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational40761920WIN-5T344G8GM1HS-1-5-191/16/2018 6:07:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904165Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27844060WIN-5T344G8GM1HS-1-5-201/16/2018 6:07:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904164Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27842824WIN-5T344G8GM1HS-1-5-201/16/2018 6:07:14 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904163Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762580WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:34 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904162Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762580WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:34 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesConfigured FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904161Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762640WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:34 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_TpmProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = C:\Windows\system32\wbem\Win32_TPM.dll585700004611686018427387904160Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27842824WIN-5T344G8GM1HS-1-5-201/16/2018 6:06:34 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT VirtualizationBasedSecurityStatus FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904159Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762640WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904158Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762580WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT SecurityServicesRunning FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904157Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762580WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT AvailableSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904156Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762580WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\Microsoft\Windows\DeviceGuard : SELECT RequiredSecurityProperties FROM Win32_DeviceGuard ; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904155Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762580WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Win32_DeviceGuard provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %SystemRoot%\System32\Win32_DeviceGuard.dll585700004611686018427387904154Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27842824WIN-5T344G8GM1HS-1-5-201/16/2018 6:06:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904153Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762640WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:33 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904152Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27842824WIN-5T344G8GM1HS-1-5-201/16/2018 6:06:32 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2584; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904151Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11762640WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:32 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2832; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904150Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28322860WIN-5T344G8GM1HS-1-5-181/16/2018 6:06:27 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2784; ProviderPath = %windir%\system32\wbem\servercompprov.dll585700004611686018427387904149Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27842812WIN-5T344G8GM1HS-1-5-201/16/2018 6:06:27 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4892; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904148Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational4892836WIN-5T344G8GM1HS-1-5-201/16/2018 6:02:36 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4256; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904147Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42564144WIN-5T344G8GM1HS-1-5-181/16/2018 5:53:30 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904146Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational49763800WIN-5T344G8GM1HS-1-5-201/16/2018 5:53:24 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5092; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904145Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational50922628WIN-5T344G8GM1HS-1-5-191/16/2018 5:53:24 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904144Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational49763800WIN-5T344G8GM1HS-1-5-201/16/2018 5:53:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4976; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904143Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational49765116WIN-5T344G8GM1HS-1-5-201/16/2018 5:53:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {53B2B737-8EF1-0000-6DB9-B253F18ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 1152; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904142Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11524780WIN-5T344G8GM1HS-1-5-181/16/2018 5:50:11 PM53b2b737-8ef1-0000-6db9-b253f18ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3688; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904141Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational36882160WIN-5T344G8GM1HS-1-5-181/16/2018 5:46:15 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 1152, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary586000004611686018427387904140Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11524676WIN-5T344G8GM1HS-1-5-181/16/2018 5:44:23 PM53b2b737-8ef1-0003-feb9-b253f18ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1152; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll585700004611686018427387904139Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11524676WIN-5T344G8GM1HS-1-5-181/16/2018 5:44:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 400; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystemProduct; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904138Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11522600WIN-5T344G8GM1HS-1-5-181/16/2018 5:44:12 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4212; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904137Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational42124236WIN-5T344G8GM1HS-1-5-181/16/2018 5:43:31 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904136Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9762796WIN-5T344G8GM1HS-1-5-201/16/2018 5:43:29 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904135Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9763216WIN-5T344G8GM1HS-1-5-201/16/2018 5:43:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3208; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904134Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational32083308WIN-5T344G8GM1HS-1-5-191/16/2018 5:43:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904133Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational976324WIN-5T344G8GM1HS-1-5-201/16/2018 5:43:23 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll585700004611686018427387904132Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational976324WIN-5T344G8GM1HS-1-5-201/16/2018 5:43:17 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 976; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904131Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational976324WIN-5T344G8GM1HS-1-5-201/16/2018 5:43:17 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 1152; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent585900004611686018427387904130Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11522720WIN-5T344G8GM1HS-1-5-181/16/2018 5:42:38 PM53b2b737-8ef1-0001-8eb7-b253f18ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 586100004611686018427387904129Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational11522720WIN-5T344G8GM1HS-1-5-181/16/2018 5:42:38 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4626349-8EA8-0003-B36D-62A4A88ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904128Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9243696WIN-5T344G8GM1HS-1-5-181/16/2018 5:37:24 PMa4626349-8ea8-0003-b36d-62a4a88ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 164; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904127Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational1643628WIN-5T344G8GM1HS-1-5-201/16/2018 5:35:48 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WmiPerfInst provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3868; ProviderPath = C:\Windows\System32\wbem\WmiPerfInst.dll585700004611686018427387904126Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38681388WIN-5T344G8GM1HS-1-5-191/16/2018 5:35:07 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4924; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904125Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational4924428WIN-5T344G8GM1HS-1-5-181/16/2018 5:35:04 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WmiPerfClass provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 4924; ProviderPath = C:\Windows\System32\wbem\WmiPerfClass.dll585700004611686018427387904124Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational49245928WIN-5T344G8GM1HS-1-5-181/16/2018 5:35:03 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 924, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary586000004611686018427387904123Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242052WIN-5T344G8GM1HS-1-5-181/16/2018 5:34:06 PMa4626349-8ea8-0002-ed6e-62a4a88ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 924; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll585700004611686018427387904122Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242052WIN-5T344G8GM1HS-1-5-181/16/2018 5:34:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5028; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904121Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational50285328WIN-5T344G8GM1HS-1-5-181/16/2018 5:32:53 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904120Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational58045824WIN-5T344G8GM1HS-1-5-201/16/2018 5:32:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3816; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904119Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational38161224WIN-5T344G8GM1HS-1-5-191/16/2018 5:32:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904118Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational58045824WIN-5T344G8GM1HS-1-5-201/16/2018 5:32:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5804; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904117Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational5804912WIN-5T344G8GM1HS-1-5-201/16/2018 5:32:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3180; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904116Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational3180804WIN-5T344G8GM1HS-1-5-181/16/2018 5:22:47 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904115Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37725300WIN-5T344G8GM1HS-1-5-201/16/2018 5:22:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 888; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904114Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational8885288WIN-5T344G8GM1HS-1-5-191/16/2018 5:22:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904113Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37725300WIN-5T344G8GM1HS-1-5-201/16/2018 5:22:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3772; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904112Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational37723704WIN-5T344G8GM1HS-1-5-201/16/2018 5:22:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5964; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll585700004611686018427387904111Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational59643468WIN-5T344G8GM1HS-1-5-181/16/2018 5:12:54 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {A4626349-8EA8-0000-8A6D-62A4A88ED301}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; ResultCode = 0x80041032; PossibleCause = Unknown585802004611686018427387904110Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9241992WIN-5T344G8GM1HS-1-5-181/16/2018 5:12:41 PMa4626349-8ea8-0000-8a6d-62a4a88ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll585700004611686018427387904109Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational12601960WIN-5T344G8GM1HS-1-5-201/16/2018 5:12:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2736; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll585700004611686018427387904108Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27362320WIN-5T344G8GM1HS-1-5-191/16/2018 5:12:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904107Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational12601960WIN-5T344G8GM1HS-1-5-201/16/2018 5:12:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1260; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll585700004611686018427387904106Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational12601936WIN-5T344G8GM1HS-1-5-201/16/2018 5:12:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = ROOT\CIMV2; NotificationQuery = SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'; UserName = ; ClientProcessID = 924, ClientMachine = WIN-5T344G8GM1H; PossibleCause = Temporary586000004611686018427387904105Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9243016WIN-5T344G8GM1HS-1-5-181/16/2018 5:06:17 PMa4626349-8ea8-0003-146c-62a4a88ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMI Kernel Trace Event Provider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 924; ProviderPath = C:\Windows\System32\wbem\krnlprov.dll585700004611686018427387904104Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9243016WIN-5T344G8GM1HS-1-5-181/16/2018 5:06:17 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3428; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll585700004611686018427387904103Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational34285844WIN-5T344G8GM1HS-1-5-201/16/2018 5:06:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3428; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904102Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational34285844WIN-5T344G8GM1HS-1-5-201/16/2018 5:06:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll585700004611686018427387904101Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27681104WIN-5T344G8GM1HS-1-5-181/16/2018 5:05:59 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll585700004611686018427387904100Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28563704WIN-5T344G8GM1HS-1-5-201/16/2018 5:04:01 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/CIMV2; NotificationQuery = select * from MSFT_SCMEventLogEvent; OwnerName = S-1-5-32-544; HostProcessID = 924; Provider= SCM Event Provider, queryID = 0; PossibleCause = Permanent58590000461168601842738790499Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9243356WIN-5T344G8GM1HS-1-5-181/16/2018 5:03:48 PMa4626349-8ea8-0003-c36b-62a4a88ed301microsoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Namespace = //./root/subscription; Eventfilter = SCM Event Log Filter (refer to its activate eventid:5859); Consumer = NTEventLogEventConsumer="SCM Event Log Consumer"; PossibleCause = Binding EventFilter: instance of __EventFilter { CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventNamespace = "root\\cimv2"; Name = "SCM Event Log Filter"; Query = "select * from MSFT_SCMEventLogEvent"; QueryLanguage = "WQL"; }; Perm. Consumer: instance of NTEventLogEventConsumer { Category = 0; CreatorSID = {1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0}; EventType = 1; Name = "SCM Event Log Consumer"; NameOfUserSIDProperty = "sid"; SourceName = "Service Control Manager"; }; 58610000461168601842738790498Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9241768WIN-5T344G8GM1HS-1-5-181/16/2018 5:03:48 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
MSVDS__PROVIDER provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\vdswmi.dll58570000461168601842738790497Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28563704WIN-5T344G8GM1HS-1-5-201/16/2018 5:02:51 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
nettcpip provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\NetTCPIP.dll58570000461168601842738790496Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational2856812WIN-5T344G8GM1HS-1-5-201/16/2018 5:02:39 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NetAdapterCim provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 5960; ProviderPath = %systemroot%\system32\wbem\NetAdapterCim.dll58570000461168601842738790495Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational59605988WIN-5T344G8GM1HS-1-5-191/16/2018 5:02:39 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
mgmtprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\mgmtprovider.dll58570000461168601842738790494Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28563084WIN-5T344G8GM1HS-1-5-201/16/2018 5:02:39 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2972; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ID FROM Win32_ServerFeature; ResultCode = 0x80041032; PossibleCause = Unknown58580200461168601842738790493Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242352WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:13 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790492Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{F9C77450-3A41-477E-9310-9ACD617BD9E3}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790491Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790490Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790489Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790488Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790487Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790486Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790485Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790484Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790483Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790482Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790481Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790480Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790479Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790478Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790477Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790476Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790475Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790474Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790473Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790472Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790471Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790470Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790469Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{5794DAFD-BE60-433f-88A2-1A31939AC01F}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790468Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4D2F9B6F-1E52-4711-A382-6A8B1A003DE6}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790467Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790466Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790465Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790464Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790463Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790462Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{25537BA6-77A8-11D2-9B6C-0000F8080861}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790461Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790460Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790459Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790458Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {822AD6C6-A4A6-4A78-B264-65E46A20EFBB}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\User\S_1_5_21_416071247_492812682_1642729393_500 : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790457Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242512WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll58570000461168601842738790456Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27681124WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WMIProv provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2768; ProviderPath = %systemroot%\system32\wbem\wmiprov.dll58570000461168601842738790455Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational27681124WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:11 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FC491EF1-C4AA-4CE1-B329-414B101DB823}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790454Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790453Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{FB2CA36D-0B40-4307-821B-A13B252DE56C}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790452Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{f3ccc681-b74c-4060-9f26-cd84525dca2a}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790451Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790450Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790449Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E5094040-C46C-4115-B030-04FB2E545B00}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790448Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790447Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{e437bc1c-aa7d-11d2-a382-00c04f991e27}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790446Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790445Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790444Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{c6dc5466-785a-11d2-84d0-00c04fb169f7}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790443Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C631DF4C-088F-4156-B058-4375F0853CD8}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790442Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790441Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{C34B2751-1CF4-44F5-9262-C3FC39666591}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790440Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790439Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790438Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790437Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{B087BE9D-ED37-454f-AF9C-04291E351182}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790436Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{AADCED64-746C-4633-A97C-D61349046527}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790435Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{A3F3E39B-5D83-4940-B954-28315B82F0A8}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790434Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{91FBB303-0CD5-4055-BF42-E512A681B325}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790433Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{8A28E2C5-8D06-49A4-A08C-632DAA493E17}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790432Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{827D319E-6EAC-11D2-A4EA-00C04F79F83A}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790431Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7B849a69-220F-451E-B3FE-2CB811AF94AE}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790430Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7933F41E-56F8-41d6-A31C-4148A711EE93}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790429Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{74EE6C03-5363-4554-B161-627540339CAB}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790428Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{728EE579-943C-4519-9EF7-AB56765798ED}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790427Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790426Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790425Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{6232C319-91AC-4931-9385-E70C2B099F0E}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790424Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790423Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4bcd6cde-777b-48b6-9804-43568e23545d}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790422Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{4B7C3B0F-E993-4E06-A241-3FBE06943684}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790421Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{42B5FAAE-6536-11d2-AE5A-0000F87571E3}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790420Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{426031c0-0b47-4852-b0ca-ac3d37bfcb39}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790419Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790418Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{3610eda5-77ef-11d2-8dc5-00c04fa31a66}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790417Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790416Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{2A8FDC61-2347-4C87-92F6-B05EB91A201A}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790415Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{1A6364EB-776B-4120-ADE1-B63A406A76B5}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790414Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{17D89FEC-5C44-4972-B12D-241CAEF74509}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790413Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{16be69fa-4209-4250-88cb-716cf41954e0}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790412Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{169EBF44-942F-4C43-87CE-13C93996EBBE}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790411Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0E28E245-9368-4853-AD84-6DA3BA35BB75}"; ResultCode = 0x80041002; PossibleCause = Unknown58580200461168601842738790410Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}"; ResultCode = 0x80041002; PossibleCause = Unknown5858020046116860184273879049Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {227CEB83-33CD-4922-AED0-D222BC464B1A}; ClientMachine = WIN-5T344G8GM1H; User = ; ClientProcessId = 924; Component = Unknown; Operation = Start IWbemServices::DeleteInstance - Root\Rsop\Computer : RSOP_ExtensionStatus.extensionGuid="{35378EAC-683F-11D2-A89A-00C04FBBCFA2}"; ResultCode = 0x80041002; PossibleCause = Unknown5858020046116860184273879048Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242528WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
deploymentprovider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 3440; ProviderPath = %systemroot%\system32\wbem\ServerManager.DeploymentProvider.dll5857000046116860184273879047Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational34403468WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
ServerFeatureProvider provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %windir%\system32\wbem\servercompprov.dll5857000046116860184273879046Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28563084WIN-5T344G8GM1HS-1-5-201/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-5T344G8GM1H; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2972; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : select ChassisTypes from Win32_SystemEnclosure; ResultCode = 0x80041032; PossibleCause = Unknown5858020046116860184273879045Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9242484WIN-5T344G8GM1HS-1-5-181/16/2018 5:02:09 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32a provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\wmipcima.dll5857000046116860184273879044Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28563084WIN-5T344G8GM1HS-1-5-201/16/2018 5:02:06 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CIMWin32 provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 2856; ProviderPath = %systemroot%\system32\wbem\cimwin32.dll5857000046116860184273879043Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational28562436WIN-5T344G8GM1HS-1-5-201/16/2018 5:02:05 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkInformationInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-PD8DQPRRTAO; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2508; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MSiSCSI_PortalInfoClass; ResultCode = 0x8004100A; PossibleCause = Unknown5858020046116860184273879042Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9162392WIN-PD8DQPRRTAOS-1-5-181/16/2018 5:01:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = WIN-PD8DQPRRTAO; User = NT AUTHORITY\SYSTEM; ClientProcessId = 2508; Component = Unknown; Operation = Start IWbemServices::CreateInstanceEnum - root\wmi : MS_SM_AdapterInformationQuery; ResultCode = 0x8004100A; PossibleCause = Unknown5858020046116860184273879041Microsoft-Windows-WMI-Activity1418ef04-b0b4-4623-bf7e-d74ab47bbdaaMicrosoft-Windows-WMI-Activity/Operational9162392WIN-PD8DQPRRTAOS-1-5-181/16/2018 5:01:40 PMmicrosoft-windows-wmi-activity/operationalSystem.UInt32[]System.Diagnostics.Eventing.Reader.EventBookmarkErrorInfoSystem.Collections.ObjectModel.ReadOnlyCollection`1[System.String]System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]