Message	Id	Version	Qualifiers	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	RelatedActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
Microsoft File Share Shadow Copy Provider is loaded	0	0		4	0	0	-9223372036854775808	8	Microsoft-Windows-FileShareShadowCopyProvider	89300202-3cec-4981-9171-19f59559e0f2	Microsoft-Windows-FileShareShadowCopyProvider/Operational	1552	1644	n-h1-771363-3.cbci-771363-3.local	S-1-5-18	1/25/2021 8:16:14 AM			microsoft-windows-fileshareshadowcopyprovider/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Microsoft File Share Shadow Copy Provider is unloaded.	1	0		4	0	0	-9223372036854775808	7	Microsoft-Windows-FileShareShadowCopyProvider	89300202-3cec-4981-9171-19f59559e0f2	Microsoft-Windows-FileShareShadowCopyProvider/Operational	1216	1172	n-h1-771363-3	S-1-5-18	1/25/2021 8:15:47 AM			microsoft-windows-fileshareshadowcopyprovider/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Microsoft File Share Shadow Copy Provider is loaded	0	0		4	0	0	-9223372036854775808	6	Microsoft-Windows-FileShareShadowCopyProvider	89300202-3cec-4981-9171-19f59559e0f2	Microsoft-Windows-FileShareShadowCopyProvider/Operational	1216	1308	n-h1-771363-3	S-1-5-18	1/25/2021 7:34:32 AM			microsoft-windows-fileshareshadowcopyprovider/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Microsoft File Share Shadow Copy Provider is unloaded.	1	0		4	0	0	-9223372036854775808	5	Microsoft-Windows-FileShareShadowCopyProvider	89300202-3cec-4981-9171-19f59559e0f2	Microsoft-Windows-FileShareShadowCopyProvider/Operational	1216	1308	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:48:13 AM			microsoft-windows-fileshareshadowcopyprovider/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Microsoft File Share Shadow Copy Provider is loaded	0	0		4	0	0	-9223372036854775808	4	Microsoft-Windows-FileShareShadowCopyProvider	89300202-3cec-4981-9171-19f59559e0f2	Microsoft-Windows-FileShareShadowCopyProvider/Operational	1216	1336	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:33 AM			microsoft-windows-fileshareshadowcopyprovider/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Microsoft File Share Shadow Copy Provider is unloaded.	1	0		4	0	0	-9223372036854775808	3	Microsoft-Windows-FileShareShadowCopyProvider	89300202-3cec-4981-9171-19f59559e0f2	Microsoft-Windows-FileShareShadowCopyProvider/Operational	1188	1316	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:41:15 AM			microsoft-windows-fileshareshadowcopyprovider/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Microsoft File Share Shadow Copy Provider is loaded	0	0		4	0	0	-9223372036854775808	2	Microsoft-Windows-FileShareShadowCopyProvider	89300202-3cec-4981-9171-19f59559e0f2	Microsoft-Windows-FileShareShadowCopyProvider/Operational	1188	1344	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM			microsoft-windows-fileshareshadowcopyprovider/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Microsoft File Share Shadow Copy Provider primary metadata store is created.	2	0		4	0	0	-9223372036854775808	1	Microsoft-Windows-FileShareShadowCopyProvider	89300202-3cec-4981-9171-19f59559e0f2	Microsoft-Windows-FileShareShadowCopyProvider/Operational	1188	1344	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 9:38:50 AM			microsoft-windows-fileshareshadowcopyprovider/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]