Message	Id	Version	Qualifiers	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	RelatedActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
NTFS global corruption action state is now 0.	100	0		4	0	0	2305843009213693953	13	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/WHC	4	8	n-h2-771362-3	S-1-5-18	1/25/2021 7:33:42 AM			microsoft-windows-ntfs/whc	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS global corruption action state is now 0.	100	0		4	0	0	2305843009213693953	12	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/WHC	4	8	WIN-5T344G8GM1H	S-1-5-18	1/25/2021 7:32:04 AM			microsoft-windows-ntfs/whc	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS global corruption action state is now 0.	100	0		4	0	0	2305843009213693953	11	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/WHC	4	8	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:27 AM			microsoft-windows-ntfs/whc	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS global corruption action state is now 0.	100	0		4	0	0	2305843009213693953	10	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/WHC	4	8	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:27:12 AM			microsoft-windows-ntfs/whc	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS global corruption action state is now 0.	100	0		4	0	0	2305843009213693953	9	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/WHC	4	8	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:26:30 AM			microsoft-windows-ntfs/whc	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS global corruption action state is now 0.	100	0		4	0	0	2305843009213693953	8	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/WHC	4	8	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:22:57 AM			microsoft-windows-ntfs/whc	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS global corruption action state is now 0.	100	0		4	0	0	2305843009213693953	7	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/WHC	4	8	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:54:47 AM			microsoft-windows-ntfs/whc	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS global corruption action state is now 0.	100	0		4	0	0	2305843009213693953	6	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/WHC	4	8	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:49:58 AM			microsoft-windows-ntfs/whc	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS global corruption action state is now 0.	100	0		4	0	0	2305843009213693953	5	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/WHC	4	8	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 10:23:52 AM			microsoft-windows-ntfs/whc	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS global corruption action state is now 0.	100	0		4	0	0	2305843009213693953	4	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/WHC	4	8	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 6:06:20 PM			microsoft-windows-ntfs/whc	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS global corruption action state is now 0.	100	0		4	0	0	2305843009213693953	3	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/WHC	4	8	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:42:06 PM			microsoft-windows-ntfs/whc	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS global corruption action state is now 0.	100	0		4	0	0	2305843009213693953	2	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/WHC	4	8	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 9:01:48 AM			microsoft-windows-ntfs/whc	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
NTFS global corruption action state is now 0.	100	0		4	0	0	2305843009213693953	1	Microsoft-Windows-Ntfs	3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482	Microsoft-Windows-Ntfs/WHC	4	8	WIN-PD8DQPRRTAO	S-1-5-18	1/17/2018 3:00:49 AM			microsoft-windows-ntfs/whc	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]