Message	Id	Version	Qualifiers	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	RelatedActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
Summary of disk space usage, since last event: Lowest free space in bytes: 71643836416 Highest free space in bytes: 74730901504 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	26	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	316	n-h1-760454-2	S-1-5-18	11/27/2020 5:53:53 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	25	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	212	n-h1-760454-2	S-1-5-18	11/27/2020 5:53:48 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 2230226944 Highest free space in bytes: 2243268608 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	24	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	476	WIN-5T344G8GM1H	S-1-5-18	11/27/2020 5:52:23 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: \\?\Volume{be07386b-0000-0000-0000-100000000000} Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	23	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	212	WIN-5T344G8GM1H	S-1-5-18	11/27/2020 5:52:17 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 29832175616 Highest free space in bytes: 29835325440 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	22	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	1988	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:32 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	21	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	196	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:28 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 29901320192 Highest free space in bytes: 29926395904 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	20	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	2020	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:18 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	19	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	184	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:12 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 29918121984 Highest free space in bytes: 29918121984 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	18	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	168	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:37 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	17	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	192	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:31 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 28502818816 Highest free space in bytes: 29979299840 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	16	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	124	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:23:03 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	15	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	184	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:22:58 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 28196282368 Highest free space in bytes: 28346654720 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	14	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	312	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:52 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	13	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	184	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:47 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 28216385536 Highest free space in bytes: 28366708736 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	12	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	124	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:50:04 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	11	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	184	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:49:59 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 27284545536 Highest free space in bytes: 27288723456 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	10	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	192	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:23:59 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	9	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	192	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 10:23:53 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 24009318400 Highest free space in bytes: 24158986240 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	8	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	376	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:26 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	7	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	184	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:21 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 26337353728 Highest free space in bytes: 26549157888 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	6	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	120	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:42:12 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	5	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	192	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:42:06 PM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 32134189056 Highest free space in bytes: 32134750208 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	4	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	200	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 9:01:54 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: C: Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	3	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	176	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 9:01:49 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Summary of disk space usage, since last event: Lowest free space in bytes: 32485502976 Highest free space in bytes: 33967284224 Page file size in bytes: 0 Volume guid: {BE07386B-0000-0000-0000-100000000000} Volume name: C: Is boot volume: true	142	0		4	0	0	4611686018429485056	2	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	336	WIN-PD8DQPRRTAO	S-1-5-18	1/17/2018 3:00:55 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The NTFS volume has been successfully mounted. Volume GUID: {BE07386B-0000-0000-0000-100000000000} Volume Name: \\?\Volume{be07386b-0000-0000-0000-100000000000} Volume Label: OS Device Name: \Device\HarddiskVolume1	4	0		4	6	0	4611686018427387936	1	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/Operational	4	200	WIN-PD8DQPRRTAO	S-1-5-18	1/17/2018 3:00:49 AM			microsoft-windows-ntfs/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]