API tools faq
paste
7OVO7

Temp logs Windows

7OVO7
Sep 6th, 2025
245
0
Never
8
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 246.28 KB | None | 0 0
raw download clone embed print report
  1.  
  2. TimeCreated : 06/09/2025 14:01:12
  3. ProviderName : Microsoft-Windows-AppXDeploymentServer/Operational
  4. Id : 2562
  5. LevelDisplayName :
  6. Message :
  7.  
  8. TimeCreated : 06/09/2025 13:58:34
  9. ProviderName : Chrome
  10. Id : 256
  11. LevelDisplayName : Information
  12. Message : [8956:12780:0906/135834.781:INFO:chrome\browser\extensions\extension_garbage_collector.cc:184] Garbage collection for extensions on file thread is complete.
  13.  
  14. TimeCreated : 06/09/2025 13:58:13
  15. ProviderName : Microsoft-Windows-DistributedCOM
  16. Id : 10016
  17. LevelDisplayName : Warning
  18. Message : The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
  19. {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
  20. and APPID
  21. {15C20B67-12E7-4BB6-92BB-7AFF07997402}
  22. to the user DESKTOP-098P9D8\tovot SID (S-1-5-21-69511818-2281423806-1859989881-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
  23.  
  24. TimeCreated : 06/09/2025 13:57:00
  25. ProviderName : Microsoft-Windows-DistributedCOM
  26. Id : 10010
  27. LevelDisplayName : Error
  28. Message : The server Windows.Gaming.GameBar.PresenceServer.Internal.PresenceWriter did not register with DCOM within the required timeout.
  29.  
  30. TimeCreated : 06/09/2025 13:56:57
  31. ProviderName : Microsoft-Windows-DistributedCOM
  32. Id : 10010
  33. LevelDisplayName : Error
  34. Message : The server Windows.Gaming.GameBar.PresenceServer.Internal.PresenceWriter did not register with DCOM within the required timeout.
  35.  
  36. TimeCreated : 06/09/2025 13:31:36
  37. ProviderName : Microsoft-Windows-Security-SPP
  38. Id : 16384
  39. LevelDisplayName : Information
  40. Message : Successfully scheduled Software Protection service for re-start at 2125-08-13T11:31:36Z. Reason: RulesEngine.
  41.  
  42. TimeCreated : 06/09/2025 13:31:06
  43. ProviderName : Microsoft-Windows-Security-SPP
  44. Id : 16394
  45. LevelDisplayName : Information
  46. Message : Offline downlevel migration succeeded.
  47.  
  48. TimeCreated : 06/09/2025 13:24:44
  49. ProviderName : Microsoft-Windows-Security-SPP
  50. Id : 16384
  51. LevelDisplayName : Information
  52. Message : Successfully scheduled Software Protection service for re-start at 2125-08-13T11:23:44Z. Reason: RulesEngine.
  53.  
  54. TimeCreated : 06/09/2025 13:24:43
  55. ProviderName : Chrome
  56. Id : 256
  57. LevelDisplayName : Information
  58. Message : [14304:13916:0906/132443.583:INFO:chrome\browser\extensions\extension_garbage_collector.cc:184] Garbage collection for extensions on file thread is complete.
  59.  
  60. TimeCreated : 06/09/2025 13:24:17
  61. ProviderName : SecurityCenter
  62. Id : 15
  63. LevelDisplayName : Information
  64. Message : Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.
  65.  
  66. TimeCreated : 06/09/2025 13:24:15
  67. ProviderName : Microsoft-Windows-DistributedCOM
  68. Id : 10016
  69. LevelDisplayName : Warning
  70. Message : The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
  71. {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
  72. and APPID
  73. {15C20B67-12E7-4BB6-92BB-7AFF07997402}
  74. to the user DESKTOP-098P9D8\tovot SID (S-1-5-21-69511818-2281423806-1859989881-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
  75.  
  76. TimeCreated : 06/09/2025 13:24:15
  77. ProviderName : SecurityCenter
  78. Id : 1
  79. LevelDisplayName : Information
  80. Message : The Windows Security Center Service has started.
  81.  
  82. TimeCreated : 06/09/2025 13:24:14
  83. ProviderName : Microsoft-Windows-DistributedCOM
  84. Id : 10016
  85. LevelDisplayName : Warning
  86. Message : The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
  87. Windows.SecurityCenter.WscDataProtection
  88. and APPID
  89. Unavailable
  90. to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
  91.  
  92. TimeCreated : 06/09/2025 13:24:14
  93. ProviderName : Microsoft-Windows-DistributedCOM
  94. Id : 10016
  95. LevelDisplayName : Warning
  96. Message : The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
  97. Windows.SecurityCenter.SecurityAppBroker
  98. and APPID
  99. Unavailable
  100. to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
  101.  
  102. TimeCreated : 06/09/2025 13:24:14
  103. ProviderName : Microsoft-Windows-DistributedCOM
  104. Id : 10016
  105. LevelDisplayName : Warning
  106. Message : The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
  107. Windows.SecurityCenter.WscBrokerManager
  108. and APPID
  109. Unavailable
  110. to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
  111.  
  112. TimeCreated : 06/09/2025 13:24:14
  113. ProviderName : Microsoft-Windows-Security-SPP
  114. Id : 16394
  115. LevelDisplayName : Information
  116. Message : Offline downlevel migration succeeded.
  117.  
  118. TimeCreated : 06/09/2025 13:24:14
  119. ProviderName : Microsoft-Windows-Security-SPP
  120. Id : 900
  121. LevelDisplayName : Information
  122. Message : The Software Protection service is starting.
  123. Parameters:<explicit>
  124.  
  125. TimeCreated : 06/09/2025 13:24:05
  126. ProviderName : Microsoft-Windows-UserModePowerService
  127. Id : 51
  128. LevelDisplayName : Information
  129. Message : Process C:\Program Files\QuickCPU\QuickCPU.exe (process ID:7792) reset overlay policy scheme from {ded574b5-45a0-4f42-8737-46345c09c238} to {ded574b5-45a0-4f42-8737-46345c09c238}
  130.  
  131. TimeCreated : 06/09/2025 13:23:27
  132. ProviderName : Microsoft-Windows-UserModePowerService
  133. Id : 51
  134. LevelDisplayName : Information
  135. Message : Process C:\Program Files\QuickCPU\QuickCPU.exe (process ID:7792) reset overlay policy scheme from {ded574b5-45a0-4f42-8737-46345c09c238} to {ded574b5-45a0-4f42-8737-46345c09c238}
  136.  
  137. TimeCreated : 06/09/2025 13:23:27
  138. ProviderName : Microsoft-Windows-UserModePowerService
  139. Id : 51
  140. LevelDisplayName : Information
  141. Message : Process C:\Program Files\QuickCPU\QuickCPU.exe (process ID:7792) reset overlay policy scheme from {ded574b5-45a0-4f42-8737-46345c09c238} to {ded574b5-45a0-4f42-8737-46345c09c238}
  142.  
  143. TimeCreated : 06/09/2025 13:23:27
  144. ProviderName : Microsoft-Windows-UserModePowerService
  145. Id : 51
  146. LevelDisplayName : Information
  147. Message : Process C:\Program Files\QuickCPU\QuickCPU.exe (process ID:7792) reset overlay policy scheme from {ded574b5-45a0-4f42-8737-46345c09c238} to {ded574b5-45a0-4f42-8737-46345c09c238}
  148.  
  149. TimeCreated : 06/09/2025 13:23:18
  150. ProviderName : Service Control Manager
  151. Id : 7045
  152. LevelDisplayName : Information
  153. Message : A service was installed in the system.
  154.  
  155. Service Name: cbhardwarelink2
  156. Service File Name: C:\Program Files\QuickCPU\hwdlink.sys
  157. Service Type: kernel mode driver
  158. Service Start Type: demand start
  159. Service Account:
  160.  
  161. TimeCreated : 06/09/2025 13:23:00
  162. ProviderName : Service Control Manager
  163. Id : 7040
  164. LevelDisplayName : Information
  165. Message : The start type of the Windhawk service was changed from auto start to demand start.
  166.  
  167. TimeCreated : 06/09/2025 13:22:48
  168. ProviderName : Microsoft-Windows-Security-SPP
  169. Id : 903
  170. LevelDisplayName : Information
  171. Message : The Software Protection service has stopped.
  172.  
  173.  
  174. TimeCreated : 06/09/2025 13:22:48
  175. ProviderName : Microsoft-Windows-Security-SPP
  176. Id : 16384
  177. LevelDisplayName : Information
  178. Message : Successfully scheduled Software Protection service for re-start at 2125-08-13T11:22:48Z. Reason: RulesEngine.
  179.  
  180. TimeCreated : 06/09/2025 13:22:40
  181. ProviderName : googledrivefs31931
  182. Id : 1
  183. LevelDisplayName : Information
  184. Message : Starting FCB garbage collector with 2000 ms interval.
  185.  
  186. TimeCreated : 06/09/2025 13:22:40
  187. ProviderName : googledrivefs31931
  188. Id : 1
  189. LevelDisplayName : Information
  190. Message : Activating keepalive handle from process 10628.
  191.  
  192. TimeCreated : 06/09/2025 13:22:40
  193. ProviderName : googledrivefs31931
  194. Id : 1
  195. LevelDisplayName : Information
  196. Message : Opened keepalive file from process 10628.
  197.  
  198. TimeCreated : 06/09/2025 13:22:40
  199. ProviderName : googledrivefs31931
  200. Id : 1
  201. LevelDisplayName : Information
  202. Message : Opened file with user mode dispatch blocked: "\__drive_fs_keepalive"
  203.  
  204. TimeCreated : 06/09/2025 13:22:40
  205. ProviderName : googledrivefs31931
  206. Id : 1
  207. LevelDisplayName : Information
  208. Message : Handle created before IOCTL_EVENT_WAIT for file "\$Extend\$Reparse:$R:$INDEX_ALLOCATION"
  209.  
  210. TimeCreated : 06/09/2025 13:22:40
  211. ProviderName : googledrivefs31931
  212. Id : 1
  213. LevelDisplayName : Information
  214. Message : Handle created before IOCTL_EVENT_WAIT for file "(null)"
  215.  
  216. TimeCreated : 06/09/2025 13:22:40
  217. ProviderName : googledrivefs31931
  218. Id : 1
  219. LevelDisplayName : Information
  220. Message : Handle created before IOCTL_EVENT_WAIT for file "(null)"
  221.  
  222. TimeCreated : 06/09/2025 13:22:40
  223. ProviderName : googledrivefs31931
  224. Id : 1
  225. LevelDisplayName : Information
  226. Message : Finished event start with status 1 and flags: 0
  227.  
  228. TimeCreated : 06/09/2025 13:22:40
  229. ProviderName : googledrivefs31931
  230. Id : 1
  231. LevelDisplayName : Information
  232. Message : Returning actual mount point G
  233.  
  234. TimeCreated : 06/09/2025 13:22:40
  235. ProviderName : googledrivefs31931
  236. Id : 1
  237. LevelDisplayName : Information
  238. Message : Mounting successfully done.
  239.  
  240. TimeCreated : 06/09/2025 13:22:40
  241. ProviderName : googledrivefs31931
  242. Id : 1
  243. LevelDisplayName : Information
  244. Message : Link name matches the current one.
  245.  
  246. TimeCreated : 06/09/2025 13:22:40
  247. ProviderName : googledrivefs31931
  248. Id : 1
  249. LevelDisplayName : Information
  250. Message : Link created: "\DosDevices\G:"
  251.  
  252. TimeCreated : 06/09/2025 13:22:40
  253. ProviderName : googledrivefs31931
  254. Id : 1
  255. LevelDisplayName : Information
  256. Message : Link created: "\??\Volume{add9acb5-8b13-11f0-b654-c1e7718d50cb}"
  257.  
  258. TimeCreated : 06/09/2025 13:22:40
  259. ProviderName : googledrivefs31931
  260. Id : 1
  261. LevelDisplayName : Information
  262. Message : Returning suggested name: "\DosDevices\G:"
  263.  
  264. TimeCreated : 06/09/2025 13:22:40
  265. ProviderName : googledrivefs31931
  266. Id : 1
  267. LevelDisplayName : Information
  268. Message : Mount manager is querying for desired drive letter. ForceDriveLetterAutoAssignment = 0
  269.  
  270. TimeCreated : 06/09/2025 13:22:40
  271. ProviderName : googledrivefs31931
  272. Id : 1
  273. LevelDisplayName : Information
  274. Message : Mount entry found: \DosDevices\G: -> \Device\Volume{f5ae2bcb-da01-3bf2-8935-408102040811}
  275.  
  276. TimeCreated : 06/09/2025 13:22:40
  277. ProviderName : googledrivefs31931
  278. Id : 1
  279. LevelDisplayName : Information
  280. Message : Found entry with matching device name: \Device\Volume{f5ae2bcb-da01-3bf2-8935-408102040811}
  281.  
  282. TimeCreated : 06/09/2025 13:22:40
  283. ProviderName : googledrivefs31931
  284. Id : 1
  285. LevelDisplayName : Information
  286. Message : Finding mount entry; lockGlobal = 1; mount point = .
  287.  
  288. TimeCreated : 06/09/2025 13:22:40
  289. ProviderName : googledrivefs31931
  290. Id : 1
  291. LevelDisplayName : Information
  292. Message : 5-408102040811}"
  293.  
  294. TimeCreated : 06/09/2025 13:22:40
  295. ProviderName : googledrivefs31931
  296. Id : 1
  297. LevelDisplayName : Information
  298. Message : Mounting volume using MountPoint "\DosDevices\G:" device "\Device\Volume{f5ae2bcb-da01-3bf2-893
  299.  
  300. TimeCreated : 06/09/2025 13:22:40
  301. ProviderName : googledrivefs31931
  302. Id : 1
  303. LevelDisplayName : Information
  304. Message : Event start using mount ID: 1; device name: \Volume{f5ae2bcb-da01-3bf2-8935-408102040811}.
  305.  
  306. TimeCreated : 06/09/2025 13:22:40
  307. ProviderName : googledrivefs31931
  308. Id : 1
  309. LevelDisplayName : Information
  310. Message : Inserted new mount entry.
  311.  
  312. TimeCreated : 06/09/2025 13:22:40
  313. ProviderName : googledrivefs31931
  314. Id : 1
  315. LevelDisplayName : Information
  316. Message : ume{f5ae2bcb-da01-3bf2-8935-408102040811}" created
  317.  
  318. TimeCreated : 06/09/2025 13:22:40
  319. ProviderName : googledrivefs31931
  320. Id : 1
  321. LevelDisplayName : Information
  322. Message : SymbolicLink: "\DosDevices\Global\Volume{f5ae2bcb-da01-3bf2-8935-408102040811}" -> "\Device\Vol
  323.  
  324. TimeCreated : 06/09/2025 13:22:40
  325. ProviderName : googledrivefs31931
  326. Id : 1
  327. LevelDisplayName : Information
  328. Message : ; type: 8
  329.  
  330. TimeCreated : 06/09/2025 13:22:40
  331. ProviderName : googledrivefs31931
  332. Id : 1
  333. LevelDisplayName : Information
  334. Message : \DosDevices\Global\Volume{f5ae2bcb-da01-3bf2-8935-408102040811}"; mount point: "\DosDevices\G:"
  335.  
  336. TimeCreated : 06/09/2025 13:22:40
  337. ProviderName : googledrivefs31931
  338. Id : 1
  339. LevelDisplayName : Information
  340. Message : disk device name: "\Device\Volume{f5ae2bcb-da01-3bf2-8935-408102040811}"; symbolic link name: "
  341.  
  342. TimeCreated : 06/09/2025 13:22:40
  343. ProviderName : googledrivefs31931
  344. Id : 1
  345. LevelDisplayName : Information
  346. Message : Set volume security descriptor successfully.
  347.  
  348. TimeCreated : 06/09/2025 13:22:40
  349. ProviderName : googledrivefs31931
  350. Id : 1
  351. LevelDisplayName : Information
  352. Message : Creating disk device; mount point = G; mount ID = 1l
  353.  
  354. TimeCreated : 06/09/2025 13:22:40
  355. ProviderName : googledrivefs31931
  356. Id : 1
  357. LevelDisplayName : Information
  358. Message : No mount entry found.
  359.  
  360. TimeCreated : 06/09/2025 13:22:40
  361. ProviderName : googledrivefs31931
  362. Id : 1
  363. LevelDisplayName : Information
  364. Message : Finding mount entry; lockGlobal = 0; mount point = \DosDevices\G:.
  365.  
  366. TimeCreated : 06/09/2025 13:22:40
  367. ProviderName : googledrivefs31931
  368. Id : 1
  369. LevelDisplayName : Information
  370. Message : Entered event start.
  371.  
  372. TimeCreated : 06/09/2025 13:22:24
  373. ProviderName : Microsoft-Windows-CertificateServicesClient-CertEnroll
  374. Id : 86
  375. LevelDisplayName : Error
  376. Message : SCEP Certificate enrollment initialization for WORKGROUP\DESKTOP-098P9D8$ via https://AMD-KeyId-578c545f796951421221a4a578acdb5f682f89c8.microsoftaik.azure.net/templates/Aik/scep failed:
  377.  
  378. GetCACaps
  379. GetCACaps: Not Found
  380. {"Message":"The authority \"amd-keyid-578c545f796951421221a4a578acdb5f682f89c8.microsoftaik.azure.net\" does not exist."}
  381. HTTP/1.1 404 Not Found
  382. Date: Sat, 06 Sep 2025 11:22:26 GMT
  383. Content-Length: 121
  384. Content-Type: application/json; charset=utf-8
  385. X-Content-Type-Options: nosniff
  386. Strict-Transport-Security: max-age=31536000;includeSubDomains
  387. x-ms-request-id: 8340e430-ecba-4acb-ad34-773192471f7f
  388.  
  389. Method: GET(281ms)
  390. Stage: GetCACaps
  391. Not found (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)
  392.  
  393. TimeCreated : 06/09/2025 13:22:24
  394. ProviderName : Microsoft-Windows-CertificateServicesClient-CertEnroll
  395. Id : 57
  396. LevelDisplayName : Error
  397. Message : The "Microsoft Pluton Cryptographic Provider" provider was not loaded because initialization failed.
  398.  
  399. TimeCreated : 06/09/2025 13:22:24
  400. ProviderName : Microsoft-Windows-TPM-WMI
  401. Id : 1025
  402. LevelDisplayName : Information
  403. Message : The TPM was successfully provisioned and is now ready for use.
  404.  
  405. TimeCreated : 06/09/2025 13:22:21
  406. ProviderName : Service Control Manager
  407. Id : 7045
  408. LevelDisplayName : Information
  409. Message : A service was installed in the system.
  410.  
  411. Service Name: HWiNFO Kernel Driver (v206)
  412. Service File Name: C:\Users\tovot\AppData\Local\Temp\HWiNFO_x64_206.sys
  413. Service Type: kernel mode driver
  414. Service Start Type: demand start
  415. Service Account:
  416.  
  417. TimeCreated : 06/09/2025 13:22:21
  418. ProviderName : Microsoft-Windows-CertificateServicesClient-CertEnroll
  419. Id : 86
  420. LevelDisplayName : Error
  421. Message : SCEP Certificate enrollment initialization for Local system via https://AMD-KeyId-578c545f796951421221a4a578acdb5f682f89c8.microsoftaik.azure.net/templates/Aik/scep failed:
  422.  
  423. GetCACaps
  424. GetCACaps: Not Found
  425. {"Message":"The authority \"amd-keyid-578c545f796951421221a4a578acdb5f682f89c8.microsoftaik.azure.net\" does not exist."}
  426. HTTP/1.1 404 Not Found
  427. Date: Sat, 06 Sep 2025 11:22:23 GMT
  428. Content-Length: 121
  429. Content-Type: application/json; charset=utf-8
  430. X-Content-Type-Options: nosniff
  431. Strict-Transport-Security: max-age=31536000;includeSubDomains
  432. x-ms-request-id: e76825e4-cbd7-474d-a846-fbc2451d1e1e
  433.  
  434. Method: GET(687ms)
  435. Stage: GetCACaps
  436. Not found (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)
  437.  
  438. TimeCreated : 06/09/2025 13:22:20
  439. ProviderName : Microsoft-Windows-CertificateServicesClient-CertEnroll
  440. Id : 57
  441. LevelDisplayName : Error
  442. Message : The "Microsoft Pluton Cryptographic Provider" provider was not loaded because initialization failed.
  443.  
  444. TimeCreated : 06/09/2025 13:22:20
  445. ProviderName : Microsoft-Windows-TPM-WMI
  446. Id : 1282
  447. LevelDisplayName : Information
  448. Message : The TBS device identifier has been generated.
  449.  
  450. TimeCreated : 06/09/2025 13:22:18
  451. ProviderName : Service Control Manager
  452. Id : 7045
  453. LevelDisplayName : Information
  454. Message : A service was installed in the system.
  455.  
  456. Service Name: MagicianSataModeReader
  457. Service File Name: C:\Program Files (x86)\Samsung\Samsung Magician/magdrvamd64.sys
  458. Service Type: kernel mode driver
  459. Service Start Type: demand start
  460. Service Account:
  461.  
  462. TimeCreated : 06/09/2025 13:22:16
  463. ProviderName : Microsoft-Windows-Security-SPP
  464. Id : 902
  465. LevelDisplayName : Information
  466. Message : The Software Protection service has started.
  467. 10.0.26100.4946
  468.  
  469. TimeCreated : 06/09/2025 13:22:16
  470. ProviderName : Microsoft-Windows-Security-SPP
  471. Id : 1003
  472. LevelDisplayName : Information
  473. Message : The Software Protection service has completed licensing status check.
  474. Application Id=55c92734-d682-4d71-983e-d6ec3f16059f
  475. Licensing Status=
  476. 1: 01eb852c-424d-4060-94b8-c10d799d7364, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  477. 2: 040fa323-92b1-4baf-97a2-5b67feaefddb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  478. 3: 0724cb7d-3437-4cb7-93cb-830375d0079d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  479. 4: 0ad2ac98-7bb9-4201-8d92-312299201369, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  480. 5: 19de9b2f-0166-4abb-9534-56ea69a80edb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  481. 6: 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  482. 7: 221a02da-e2a1-4b75-864c-0a4410a33fdf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  483. 8: 265f3fad-6a1c-4bdd-ae30-c75efa556ccb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  484. 9: 291ece0e-9c38-40ca-a9e1-32cc7ec19507, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  485. 10: 2936d1d2-913a-4542-b54e-ce5a602a2a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  486. 11: 2c293c26-a45a-4a2a-a350-c69a67097529, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  487. 12: 2de67392-b7a7-462a-b1ca-108dd189f588, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  488. 13: 2ffd8952-423e-4903-b993-72a1aa44cf82, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  489. 14: 30a42c86-b7a0-4a34-8c90-ff177cb2acb7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  490. 15: 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  491. 16: 3502365a-f88a-4ba4-822a-5769d3073b65, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  492. 17: 377333b1-8b5d-48d6-9679-1225c872d37c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  493. 18: 3df374ef-d444-4494-a5a1-4b0d9fd0e203, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  494. 19: 3ebce241-ea87-4946-8a4f-80d00e921dff, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  495. 20: 3f1afc82-f8ac-4f6c-8005-1d233e606eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  496. 21: 4322a811-697c-44dc-865e-3e2fdcb86009, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  497. 22: 49cd895b-53b2-4dc4-a5f7-b18aa019ad37, 1, 1 [(0 )(1 )(2 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(3 )]
  498. 23: 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  499. 24: 4f3da0d2-271d-4508-ae81-626b60809a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  500. 25: 5d78c4e9-aeb3-4b40-8ac2-6a6005e0ad6d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  501. 26: 60b3ec1b-9545-4921-821f-311b129dd6f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  502. 27: 613d217f-7f13-4268-9907-1662339531cd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  503. 28: 62f0c100-9c53-4e02-b886-a3528ddfe7f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  504. 29: 6365275e-368d-46ca-a0ef-fc0404119333, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  505. 30: 721f9237-9341-4453-a661-09e8baa6cca5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  506. 31: 73111121-5638-40f6-bc11-f1d7b0d64300, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  507. 32: 7a802526-4c94-4bd1-ba14-835a1aca2120, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  508. 33: 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  509. 34: 80083eae-7031-4394-9e88-4901973d56fe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  510. 35: 82bbc092-bc50-4e16-8e18-b74fc486aec3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  511. 36: 8ab9bdd1-1f67-4997-82d9-8878520837d9, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  512. 37: 8b351c9c-f398-4515-9900-09df49427262, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  513. 38: 90da7373-1c51-430b-bf26-c97e9c5cdc31, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  514. 39: 92fb8726-92a8-4ffc-94ce-f82e07444653, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  515. 40: 95dca82f-385d-4d39-b85b-5c73fa285d6f, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  516. 41: 97cde3ae-e908-4b59-ac96-a17645c5b57e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  517. 42: a48938aa-62fa-4966-9d44-9f04da3f72f2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  518. 43: b0773a15-df3a-4312-9ad2-83d69648e356, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  519. 44: b4bfe195-541e-4e64-ad23-6177f19e395e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  520. 45: b68e61d2-68ca-4757-be45-0cc2f3e68eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  521. 46: bd3762d7-270d-4760-8fb3-d829ca45278a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  522. 47: c86d5194-4840-4dae-9c1c-0301003a5ab0, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  523. 48: ca7df2e3-5ea0-47b8-9ac1-b1be4d8edd69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  524. 49: d552befb-48cc-4327-8f39-47d2d94f987c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  525. 50: d6eadb3b-5ca8-4a6b-986e-35b550756111, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  526. 51: df96023b-dcd9-4be2-afa0-c6c871159ebe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  527. 52: e0c42288-980c-4788-a014-c080d2e1926e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  528. 53: e4db50ea-bda1-4566-b047-0ca50abc6f07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  529. 54: e558417a-5123-4f6f-91e7-385c1c7ca9d4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  530. 55: e7a950a2-e548-4f10-bf16-02ec848e0643, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  531. 56: eb6d346f-1c60-4643-b960-40ec31596c45, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  532. 57: ec868e65-fadf-4759-b23e-93fe37f2cc29, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  533. 58: ef51e000-2659-4f25-8345-3de70a9cf4c4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  534. 59: f7af7d09-40e4-419c-a49b-eae366689ebd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  535. 60: fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  536. 61: fe74f55b-0338-41d6-b267-4a201abe7285, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  537.  
  538.  
  539.  
  540. TimeCreated : 06/09/2025 13:22:16
  541. ProviderName : Microsoft-Windows-Security-SPP
  542. Id : 1066
  543. LevelDisplayName : Information
  544. Message : Initialization status for service objects.
  545. C:\WINDOWS\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
  546. C:\WINDOWS\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000
  547. C:\WINDOWS\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
  548. C:\WINDOWS\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000
  549. C:\WINDOWS\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000
  550. C:\WINDOWS\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
  551. C:\WINDOWS\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000
  552. C:\WINDOWS\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
  553. C:\WINDOWS\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000
  554.  
  555.  
  556. TimeCreated : 06/09/2025 13:22:16
  557. ProviderName : Microsoft-Windows-Security-SPP
  558. Id : 16394
  559. LevelDisplayName : Information
  560. Message : Offline downlevel migration succeeded.
  561.  
  562. TimeCreated : 06/09/2025 13:22:16
  563. ProviderName : Microsoft-Windows-Security-SPP
  564. Id : 900
  565. LevelDisplayName : Information
  566. Message : The Software Protection service is starting.
  567. Parameters:TriggerStarted:6
  568.  
  569. TimeCreated : 06/09/2025 13:22:14
  570. ProviderName : TPM
  571. Id : 18
  572. LevelDisplayName : Information
  573. Message : This event triggers the Trusted Platform Module (TPM) provisioning/status check to run.
  574.  
  575. TimeCreated : 06/09/2025 13:22:14
  576. ProviderName : Service Control Manager
  577. Id : 7026
  578. LevelDisplayName : Information
  579. Message : The following boot-start or system-start driver(s) did not load:
  580. dam
  581.  
  582. TimeCreated : 06/09/2025 13:22:13
  583. ProviderName : Microsoft-Windows-Winlogon
  584. Id : 6000
  585. LevelDisplayName : Information
  586. Message : The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.
  587.  
  588. TimeCreated : 06/09/2025 13:22:13
  589. ProviderName : Microsoft-Windows-Winlogon
  590. Id : 6003
  591. LevelDisplayName : Information
  592. Message : The winlogon notification subscriber <SessionEnv> was unavailable to handle a critical notification event.
  593.  
  594. TimeCreated : 06/09/2025 13:22:13
  595. ProviderName : Microsoft-Windows-Winlogon
  596. Id : 7001
  597. LevelDisplayName : Information
  598. Message : User Logon Notification for Customer Experience Improvement Program
  599.  
  600. TimeCreated : 06/09/2025 13:22:03
  601. ProviderName : Microsoft-Windows-HttpService
  602. Id : 112
  603. LevelDisplayName : Information
  604. Message : Attempted to reserve URL http://+:80/116B50EB-ECE2-41ac-8429-9F9E963361B7/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  605.  
  606. TimeCreated : 06/09/2025 13:22:03
  607. ProviderName : Microsoft-Windows-HttpService
  608. Id : 112
  609. LevelDisplayName : Information
  610. Message : Attempted to reserve URL https://+:443/C574AC30-5794-4AEE-B1BB-6651C5315029/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  611.  
  612. TimeCreated : 06/09/2025 13:22:03
  613. ProviderName : Microsoft-Windows-HttpService
  614. Id : 112
  615. LevelDisplayName : Information
  616. Message : Attempted to reserve URL http://+:80/0131501b-d67f-491b-9a40-c4bf27bcb4d4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  617.  
  618. TimeCreated : 06/09/2025 13:22:03
  619. ProviderName : Microsoft-Windows-HttpService
  620. Id : 112
  621. LevelDisplayName : Information
  622. Message : Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  623.  
  624. TimeCreated : 06/09/2025 13:22:03
  625. ProviderName : Microsoft-Windows-HttpService
  626. Id : 112
  627. LevelDisplayName : Information
  628. Message : Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  629.  
  630. TimeCreated : 06/09/2025 13:22:03
  631. ProviderName : Microsoft-Windows-HttpService
  632. Id : 112
  633. LevelDisplayName : Information
  634. Message : Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  635.  
  636. TimeCreated : 06/09/2025 13:22:03
  637. ProviderName : Microsoft-Windows-HttpService
  638. Id : 112
  639. LevelDisplayName : Information
  640. Message : Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  641.  
  642. TimeCreated : 06/09/2025 13:22:03
  643. ProviderName : Microsoft-Windows-HttpService
  644. Id : 112
  645. LevelDisplayName : Information
  646. Message : Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  647.  
  648. TimeCreated : 06/09/2025 13:22:03
  649. ProviderName : Microsoft-Windows-HttpService
  650. Id : 112
  651. LevelDisplayName : Information
  652. Message : Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  653.  
  654. TimeCreated : 06/09/2025 13:22:03
  655. ProviderName : Microsoft-Windows-HttpService
  656. Id : 112
  657. LevelDisplayName : Information
  658. Message : Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  659.  
  660. TimeCreated : 06/09/2025 13:22:03
  661. ProviderName : Microsoft-Windows-HttpService
  662. Id : 112
  663. LevelDisplayName : Information
  664. Message : Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  665.  
  666. TimeCreated : 06/09/2025 13:22:03
  667. ProviderName : Microsoft-Windows-HttpService
  668. Id : 112
  669. LevelDisplayName : Information
  670. Message : Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  671.  
  672. TimeCreated : 06/09/2025 13:22:03
  673. ProviderName : Microsoft-Windows-HttpService
  674. Id : 112
  675. LevelDisplayName : Information
  676. Message : Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  677.  
  678. TimeCreated : 06/09/2025 13:22:03
  679. ProviderName : Microsoft-Windows-HttpService
  680. Id : 112
  681. LevelDisplayName : Information
  682. Message : Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  683.  
  684. TimeCreated : 06/09/2025 13:22:03
  685. ProviderName : Microsoft-Windows-HttpService
  686. Id : 112
  687. LevelDisplayName : Information
  688. Message : Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  689.  
  690. TimeCreated : 06/09/2025 13:22:02
  691. ProviderName : Service Control Manager
  692. Id : 7001
  693. LevelDisplayName : Error
  694. Message : The CloudflareWARP service depends on the WlanSvc service which failed to start because of the following error:
  695. The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
  696.  
  697. TimeCreated : 06/09/2025 13:21:59
  698. ProviderName : Microsoft-Windows-TPM-WMI
  699. Id : 1038
  700. LevelDisplayName : Information
  701. Message : Pre-attestation health checks confirm that the device is expected to pass attestation.
  702. Please see C:\WINDOWS\Logs\MeasuredBoot\0000000334-0000000000.json for detailed information on what checks were made.
  703.  
  704. TimeCreated : 06/09/2025 13:21:59
  705. ProviderName : Microsoft-Windows-TPM-WMI
  706. Id : 1041
  707. LevelDisplayName : Information
  708. Message : Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":true,"ValueFromTcgLog":true,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]}
  709.  
  710. TimeCreated : 06/09/2025 13:21:58
  711. ProviderName : Microsoft-Windows-Search
  712. Id : 1003
  713. LevelDisplayName : Information
  714. Message : The Windows Search Service started.
  715.  
  716.  
  717. TimeCreated : 06/09/2025 13:21:58
  718. ProviderName : Novabench Service
  719. Id : 0
  720. LevelDisplayName : Information
  721. Message : Service started successfully.
  722.  
  723. TimeCreated : 06/09/2025 13:21:57
  724. ProviderName : Microsoft-Windows-UserModePowerService
  725. Id : 12
  726. LevelDisplayName : Information
  727. Message : Process C:\Windows\System32\DriverStore\FileRepository\u0417877.inf_amd64_8b2c2b61b3f8a9e5\B417004\atieclxx.exe (process ID:2280) reset policy scheme from {b0432ffb-84c5-4086-bab1-643de75d6e75} to {b0432ffb-84c5-4086-bab1-643de75d6e75}
  728.  
  729. TimeCreated : 06/09/2025 13:21:57
  730. ProviderName : edgeupdate
  731. Id : 0
  732. LevelDisplayName : Information
  733. Message : Service stopped.
  734.  
  735. TimeCreated : 06/09/2025 13:21:56
  736. ProviderName : Microsoft-Windows-DHCPv6-Client
  737. Id : 51046
  738. LevelDisplayName : Information
  739. Message : DHCPv6 client service is started
  740.  
  741. TimeCreated : 06/09/2025 13:21:56
  742. ProviderName : Microsoft-Windows-Dhcp-Client
  743. Id : 50036
  744. LevelDisplayName : Information
  745. Message : DHCPv4 client service is started
  746.  
  747. TimeCreated : 06/09/2025 13:21:56
  748. ProviderName : Microsoft-Windows-Dhcp-Client
  749. Id : 50103
  750. LevelDisplayName : Information
  751. Message : DHCPv4 client registered for shutdown notification
  752.  
  753. TimeCreated : 06/09/2025 13:21:56
  754. ProviderName : Microsoft-Windows-Dhcp-Client
  755. Id : 50036
  756. LevelDisplayName : Information
  757. Message : DHCPv4 client service is started
  758.  
  759. TimeCreated : 06/09/2025 13:21:56
  760. ProviderName : Microsoft-Windows-Hyper-V-VmSwitch
  761. Id : 277
  762. LevelDisplayName : Information
  763. Message : vmswitch.sys build 26100.amd64.ge_release_svc_prod1, debug false, official true, 1 1
  764.  
  765. TimeCreated : 06/09/2025 13:21:56
  766. ProviderName : Microsoft-Windows-WMI
  767. Id : 5617
  768. LevelDisplayName : Information
  769. Message : Windows Management Instrumentation Service subsystems initialized successfully
  770.  
  771. TimeCreated : 06/09/2025 13:21:57
  772. ProviderName : RtkAudioUniversalService
  773. Id : 0
  774. LevelDisplayName :
  775. Message :
  776.  
  777. TimeCreated : 06/09/2025 13:21:55
  778. ProviderName : Microsoft-Windows-WMI
  779. Id : 5615
  780. LevelDisplayName : Information
  781. Message : Windows Management Instrumentation Service started sucessfully
  782.  
  783. TimeCreated : 06/09/2025 13:21:55
  784. ProviderName : Microsoft-Windows-User Profiles Service
  785. Id : 1531
  786. LevelDisplayName : Information
  787. Message : The User Profile Service has started successfully.
  788.  
  789.  
  790.  
  791. TimeCreated : 06/09/2025 13:21:56
  792. ProviderName : Microsoft-Windows-EventSystem
  793. Id : 4625
  794. LevelDisplayName : Information
  795. Message : The EventSystem sub system is suppressing duplicate event log entries for a duration of 86400 seconds. The suppression timeout can be controlled by a REG_DWORD value named SuppressDuplicateDuration under the following registry key: HKLM\Software\Microsoft\EventSystem\EventLog.
  796.  
  797. TimeCreated : 06/09/2025 13:21:55
  798. ProviderName : Microsoft-Windows-FilterManager
  799. Id : 6
  800. LevelDisplayName : Information
  801. Message : File System Filter 'bindflt' (10.0, ‎2032‎-‎10‎-‎09T08:28:18.000000000Z) has successfully loaded and registered with Filter Manager.
  802.  
  803. TimeCreated : 06/09/2025 13:21:55
  804. ProviderName : Microsoft-Windows-FilterManager
  805. Id : 6
  806. LevelDisplayName : Information
  807. Message : File System Filter 'storqosflt' (10.0, ‎2021‎-‎03‎-‎19T12:47:34.000000000Z) has successfully loaded and registered with Filter Manager.
  808.  
  809. TimeCreated : 06/09/2025 13:21:55
  810. ProviderName : Microsoft-Windows-FilterManager
  811. Id : 6
  812. LevelDisplayName : Information
  813. Message : File System Filter 'UnionFS' (10.0, ‎2047‎-‎02‎-‎21T13:01:20.000000000Z) has successfully loaded and registered with Filter Manager.
  814.  
  815. TimeCreated : 06/09/2025 13:21:55
  816. ProviderName : Microsoft-Windows-FilterManager
  817. Id : 6
  818. LevelDisplayName : Information
  819. Message : File System Filter 'CldFlt' (10.0, ‎2066‎-‎10‎-‎18T01:52:14.000000000Z) has successfully loaded and registered with Filter Manager.
  820.  
  821. TimeCreated : 06/09/2025 13:21:55
  822. ProviderName : Microsoft-Windows-FilterManager
  823. Id : 1
  824. LevelDisplayName : Information
  825. Message : File System Filter 'CldFlt' (Version 10.0, ‎2066‎-‎10‎-‎18T01:52:14.000000000Z) unloaded successfully.
  826.  
  827. TimeCreated : 06/09/2025 13:21:55
  828. ProviderName : Microsoft-Windows-FilterManager
  829. Id : 6
  830. LevelDisplayName : Information
  831. Message : File System Filter 'CldFlt' (10.0, ‎2066‎-‎10‎-‎18T01:52:14.000000000Z) has successfully loaded and registered with Filter Manager.
  832.  
  833. TimeCreated : 06/09/2025 13:21:55
  834. ProviderName : Microsoft-Windows-FilterManager
  835. Id : 6
  836. LevelDisplayName : Information
  837. Message : File System Filter 'luafv' (10.0, ‎2105‎-‎10‎-‎05T07:54:15.000000000Z) has successfully loaded and registered with Filter Manager.
  838.  
  839. TimeCreated : 06/09/2025 13:21:55
  840. ProviderName : Microsoft-Windows-FilterManager
  841. Id : 6
  842. LevelDisplayName : Information
  843. Message : File System Filter 'wcifs' (10.0, ‎2053‎-‎03‎-‎11T06:36:57.000000000Z) has successfully loaded and registered with Filter Manager.
  844.  
  845. TimeCreated : 06/09/2025 13:21:55
  846. ProviderName : Microsoft-Windows-FilterManager
  847. Id : 6
  848. LevelDisplayName : Information
  849. Message : File System Filter 'bfs' (10.0, ‎2101‎-‎07‎-‎17T22:54:57.000000000Z) has successfully loaded and registered with Filter Manager.
  850.  
  851. TimeCreated : 06/09/2025 13:21:55
  852. ProviderName : Microsoft-Windows-Directory-Services-SAM
  853. Id : 16983
  854. LevelDisplayName : Information
  855. Message : The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.
  856.  
  857. For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
  858.  
  859.  
  860. TimeCreated : 06/09/2025 13:21:55
  861. ProviderName : Microsoft-Windows-Directory-Services-SAM
  862. Id : 16977
  863. LevelDisplayName : Information
  864. Message : The domain is configured with the following minimum password length-related settings.
  865.  
  866. MinimumPasswordLength: 0
  867.  
  868. RelaxMinimumPasswordLengthLimits: 0
  869.  
  870. MinimumPasswordLengthAudit: -1
  871.  
  872. For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
  873.  
  874.  
  875. TimeCreated : 06/09/2025 13:21:55
  876. ProviderName : Microsoft-Windows-Directory-Services-SAM
  877. Id : 16962
  878. LevelDisplayName : Information
  879. Message : Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
  880. For more information please see http://go.microsoft.com/fwlink/?LinkId=787651.
  881.  
  882. TimeCreated : 06/09/2025 13:21:55
  883. ProviderName : LsaSrv
  884. Id : 6156
  885. LevelDisplayName : Information
  886. Message : Credential Guard auto enablement status.
  887.  
  888. Hardware Requirements for Virtualization Based Security: 1
  889. Domain Joined: 0
  890. Azure AD Joined: 0
  891. Licensed for Credential Guard: 0
  892. Domain Controller: 0
  893.  
  894. TimeCreated : 06/09/2025 13:21:55
  895. ProviderName : Microsoft-Windows-Wininit
  896. Id : 12
  897. LevelDisplayName : Information
  898. Message : LSASS.exe was started as a protected process with level: 4.
  899.  
  900. TimeCreated : 06/09/2025 13:21:55
  901. ProviderName : Microsoft-Windows-Wininit
  902. Id : 14
  903. LevelDisplayName : Information
  904. Message : Credential Guard configuration:
  905.  
  906. Registry Configuration: 0x0
  907. Test Configuration: 0
  908. Auto Enablement: 0
  909.  
  910. TimeCreated : 06/09/2025 13:21:54
  911. ProviderName : Microsoft-Windows-Wininit
  912. Id : 23
  913. LevelDisplayName : Information
  914. Message : Boot App Anti-Rollback: Initialize Completed with status:
  915. HRESULT: The operation completed successfully.
  916. New timer needed: false
  917. New timer waiting for system update completion: false
  918. Previous latch timer exists but disabled by registry: false
  919.  
  920.  
  921. TimeCreated : 06/09/2025 13:21:54
  922. ProviderName : Microsoft-Windows-Wininit
  923. Id : 25
  924. LevelDisplayName : Information
  925. Message : Boot App Anti-Rollback: Previous timer resumed with status:
  926.  
  927. HRESULT: The operation completed successfully.
  928. Previous timer present: true
  929. Start time: ‎2025‎-‎07‎-‎09T13:26:19.604845700Z
  930. Grace period: 51840000000000
  931. Attempted recovery enforcement succeeded: false
  932.  
  933.  
  934. TimeCreated : 06/09/2025 13:21:54
  935. ProviderName : Microsoft-Windows-Wininit
  936. Id : 24
  937. LevelDisplayName : Information
  938. Message : Boot App Anti-Rollback: Timer start completed with status:
  939.  
  940. Win32Error: 0
  941. Start time: ‎2025‎-‎07‎-‎09T13:26:19.604845700Z
  942. Grace period: 51840000000000
  943. Due time: ‎2025‎-‎09‎-‎07T13:26:19.604845700Z
  944.  
  945.  
  946. TimeCreated : 06/09/2025 13:21:54
  947. ProviderName : Microsoft-Windows-Wininit
  948. Id : 19
  949. LevelDisplayName : Information
  950. Message : Virtualization Based Security new timer creation status
  951.  
  952. HRESULT: The operation completed successfully.
  953. New latch timer needed: false
  954. New latch timer waiting for system update completion: false
  955. Previous latch timer exists but disabled by registry: false
  956. Policy file exists: false
  957.  
  958.  
  959. TimeCreated : 06/09/2025 13:21:52
  960. ProviderName : Microsoft-Windows-Kernel-General
  961. Id : 24
  962. LevelDisplayName : Information
  963. Message : The time zone information was refreshed with exit reason 0. Current time zone bias is -120.
  964.  
  965. TimeCreated : 06/09/2025 13:21:51
  966. ProviderName : Microsoft-Windows-Ntfs
  967. Id : 98
  968. LevelDisplayName : Information
  969. Message : Volume \\?\Volume{782f0bab-934f-418a-a308-f262a56c228a} (\Device\HarddiskVolume4) is healthy. No action is needed.
  970.  
  971. TimeCreated : 06/09/2025 13:21:51
  972. ProviderName : Microsoft-Windows-Kernel-Processor-Power
  973. Id : 55
  974. LevelDisplayName : Information
  975. Message : Processor 5 in group 0 exposes the following power management capabilities:
  976.  
  977. Idle state type: ACPI Idle (C) States (2 state(s))
  978.  
  979. Performance state type: ACPI Performance (P) / Throttle (T) States
  980. Nominal Frequency (MHz): 3400
  981. Maximum performance percentage: 100
  982. Minimum performance percentage: 45
  983. Minimum throttle percentage: 45
  984.  
  985. TimeCreated : 06/09/2025 13:21:51
  986. ProviderName : Microsoft-Windows-Kernel-Processor-Power
  987. Id : 55
  988. LevelDisplayName : Information
  989. Message : Processor 4 in group 0 exposes the following power management capabilities:
  990.  
  991. Idle state type: ACPI Idle (C) States (2 state(s))
  992.  
  993. Performance state type: ACPI Performance (P) / Throttle (T) States
  994. Nominal Frequency (MHz): 3400
  995. Maximum performance percentage: 100
  996. Minimum performance percentage: 45
  997. Minimum throttle percentage: 45
  998.  
  999. TimeCreated : 06/09/2025 13:21:51
  1000. ProviderName : Microsoft-Windows-Kernel-Processor-Power
  1001. Id : 55
  1002. LevelDisplayName : Information
  1003. Message : Processor 3 in group 0 exposes the following power management capabilities:
  1004.  
  1005. Idle state type: ACPI Idle (C) States (2 state(s))
  1006.  
  1007. Performance state type: ACPI Performance (P) / Throttle (T) States
  1008. Nominal Frequency (MHz): 3400
  1009. Maximum performance percentage: 100
  1010. Minimum performance percentage: 45
  1011. Minimum throttle percentage: 45
  1012.  
  1013. TimeCreated : 06/09/2025 13:21:51
  1014. ProviderName : Microsoft-Windows-Kernel-Processor-Power
  1015. Id : 55
  1016. LevelDisplayName : Information
  1017. Message : Processor 2 in group 0 exposes the following power management capabilities:
  1018.  
  1019. Idle state type: ACPI Idle (C) States (2 state(s))
  1020.  
  1021. Performance state type: ACPI Performance (P) / Throttle (T) States
  1022. Nominal Frequency (MHz): 3400
  1023. Maximum performance percentage: 100
  1024. Minimum performance percentage: 45
  1025. Minimum throttle percentage: 45
  1026.  
  1027. TimeCreated : 06/09/2025 13:21:51
  1028. ProviderName : Microsoft-Windows-Kernel-Processor-Power
  1029. Id : 55
  1030. LevelDisplayName : Information
  1031. Message : Processor 1 in group 0 exposes the following power management capabilities:
  1032.  
  1033. Idle state type: ACPI Idle (C) States (2 state(s))
  1034.  
  1035. Performance state type: ACPI Performance (P) / Throttle (T) States
  1036. Nominal Frequency (MHz): 3400
  1037. Maximum performance percentage: 100
  1038. Minimum performance percentage: 45
  1039. Minimum throttle percentage: 45
  1040.  
  1041. TimeCreated : 06/09/2025 13:21:51
  1042. ProviderName : Microsoft-Windows-Kernel-Processor-Power
  1043. Id : 55
  1044. LevelDisplayName : Information
  1045. Message : Processor 0 in group 0 exposes the following power management capabilities:
  1046.  
  1047. Idle state type: ACPI Idle (C) States (2 state(s))
  1048.  
  1049. Performance state type: ACPI Performance (P) / Throttle (T) States
  1050. Nominal Frequency (MHz): 3400
  1051. Maximum performance percentage: 100
  1052. Minimum performance percentage: 45
  1053. Minimum throttle percentage: 45
  1054.  
  1055. TimeCreated : 06/09/2025 13:21:51
  1056. ProviderName : Microsoft-Windows-Ntfs
  1057. Id : 98
  1058. LevelDisplayName : Information
  1059. Message : Volume E: (\Device\HarddiskVolume7) is healthy. No action is needed.
  1060.  
  1061. TimeCreated : 06/09/2025 13:21:50
  1062. ProviderName : Microsoft-Windows-Kernel-Power
  1063. Id : 172
  1064. LevelDisplayName : Information
  1065. Message : Connectivity state in standby: Disconnected, Reason: NIC compliance
  1066.  
  1067. TimeCreated : 06/09/2025 13:21:50
  1068. ProviderName : Microsoft-Windows-FilterManager
  1069. Id : 6
  1070. LevelDisplayName : Information
  1071. Message : File System Filter 'npsvctrig' (10.0, ‎1978‎-‎05‎-‎14T11:13:30.000000000Z) has successfully loaded and registered with Filter Manager.
  1072.  
  1073. TimeCreated : 06/09/2025 13:21:50
  1074. ProviderName : Microsoft-Windows-FilterManager
  1075. Id : 6
  1076. LevelDisplayName : Information
  1077. Message : File System Filter 'UCPD' (10.0, ‎2007‎-‎02‎-‎05T07:30:28.000000000Z) has successfully loaded and registered with Filter Manager.
  1078.  
  1079. TimeCreated : 06/09/2025 13:21:50
  1080. ProviderName : Microsoft-Windows-FilterManager
  1081. Id : 6
  1082. LevelDisplayName : Information
  1083. Message : File System Filter 'FileCrypt' (10.0, ‎2075‎-‎09‎-‎01T00:07:07.000000000Z) has successfully loaded and registered with Filter Manager.
  1084.  
  1085. TimeCreated : 06/09/2025 13:21:50
  1086. ProviderName : Microsoft-Windows-Ntfs
  1087. Id : 98
  1088. LevelDisplayName : Information
  1089. Message : Volume C: (\Device\HarddiskVolume3) is healthy. No action is needed.
  1090.  
  1091. TimeCreated : 06/09/2025 13:21:50
  1092. ProviderName : Microsoft-Windows-Ntfs
  1093. Id : 98
  1094. LevelDisplayName : Information
  1095. Message : Volume D: (\Device\HarddiskVolume6) is healthy. No action is needed.
  1096.  
  1097. TimeCreated : 06/09/2025 13:21:50
  1098. ProviderName : Microsoft-Windows-Ntfs
  1099. Id : 98
  1100. LevelDisplayName : Information
  1101. Message : Volume F: (\Device\HarddiskVolume5) is healthy. No action is needed.
  1102.  
  1103. TimeCreated : 06/09/2025 13:21:50
  1104. ProviderName : Microsoft-Windows-BitLocker-Driver
  1105. Id : 24709
  1106. LevelDisplayName : Information
  1107. Message : This event contains the boot-time final TPM PCR values and TCG log data.
  1108.  
  1109. TimeCreated : 06/09/2025 13:21:50
  1110. ProviderName : Microsoft-Windows-BitLocker-Driver
  1111. Id : 24709
  1112. LevelDisplayName : Information
  1113. Message : This event contains the boot-time final TPM PCR values and TCG log data.
  1114.  
  1115. TimeCreated : 06/09/2025 13:21:50
  1116. ProviderName : Microsoft-Windows-BitLocker-Driver
  1117. Id : 24709
  1118. LevelDisplayName : Information
  1119. Message : This event contains the boot-time final TPM PCR values and TCG log data.
  1120.  
  1121. TimeCreated : 06/09/2025 13:21:50
  1122. ProviderName : Microsoft-Windows-BitLocker-Driver
  1123. Id : 24711
  1124. LevelDisplayName : Information
  1125. Message : A V2 TPM protector was used to start Windows.
  1126. Binding ID: {e0f3b476-a73e-4425-805b-0c939f260e04}.
  1127.  
  1128. TimeCreated : 06/09/2025 13:21:50
  1129. ProviderName : Microsoft-Windows-BitLocker-Driver
  1130. Id : 24709
  1131. LevelDisplayName : Information
  1132. Message : This event contains the boot-time final TPM PCR values and TCG log data.
  1133.  
  1134. TimeCreated : 06/09/2025 13:21:49
  1135. ProviderName : Microsoft-Windows-FilterManager
  1136. Id : 6
  1137. LevelDisplayName : Information
  1138. Message : File System Filter 'WdFilter' (10.0, ‎2020‎-‎11‎-‎18T19:24:15.000000000Z) has successfully loaded and registered with Filter Manager.
  1139.  
  1140. TimeCreated : 06/09/2025 13:21:49
  1141. ProviderName : Microsoft-Windows-FilterManager
  1142. Id : 6
  1143. LevelDisplayName : Information
  1144. Message : File System Filter 'Wof' (10.0, ‎2033‎-‎09‎-‎03T01:41:44.000000000Z) has successfully loaded and registered with Filter Manager.
  1145.  
  1146. TimeCreated : 06/09/2025 13:21:49
  1147. ProviderName : Microsoft-Windows-FilterManager
  1148. Id : 6
  1149. LevelDisplayName : Information
  1150. Message : File System Filter 'FileInfo' (10.0, ‎2093‎-‎04‎-‎02T03:29:43.000000000Z) has successfully loaded and registered with Filter Manager.
  1151.  
  1152. TimeCreated : 06/09/2025 13:21:48
  1153. ProviderName : Microsoft-Windows-HAL
  1154. Id : 16
  1155. LevelDisplayName : Information
  1156. Message : IOMMU fault reporting has been initialized.
  1157.  
  1158. TimeCreated : 06/09/2025 13:21:48
  1159. ProviderName : Microsoft-Windows-Kernel-General
  1160. Id : 20
  1161. LevelDisplayName : Information
  1162. Message : The leap second configuration has been updated.
  1163. Reason: Leap second data initialized from registry during boot
  1164. Leap seconds enabled: true
  1165. New leap second count: 0
  1166. Old leap second count: 0
  1167.  
  1168. TimeCreated : 06/09/2025 13:21:48
  1169. ProviderName : Microsoft-Windows-Kernel-Boot
  1170. Id : 30
  1171. LevelDisplayName : Information
  1172. Message : The firmware reported boot metrics.
  1173.  
  1174. TimeCreated : 06/09/2025 13:21:48
  1175. ProviderName : Microsoft-Windows-Kernel-Boot
  1176. Id : 27
  1177. LevelDisplayName : Information
  1178. Message : The boot type was 0x0.
  1179.  
  1180. TimeCreated : 06/09/2025 13:21:48
  1181. ProviderName : Microsoft-Windows-Kernel-Boot
  1182. Id : 25
  1183. LevelDisplayName : Information
  1184. Message : The boot menu policy was 0x1.
  1185.  
  1186. TimeCreated : 06/09/2025 13:21:48
  1187. ProviderName : Microsoft-Windows-Kernel-Boot
  1188. Id : 238
  1189. LevelDisplayName : Information
  1190. Message : EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ‎2025‎-‎09‎-‎06T13:21:47.000000000Z.
  1191.  
  1192. TimeCreated : 06/09/2025 13:21:48
  1193. ProviderName : Microsoft-Windows-Kernel-Boot
  1194. Id : 247
  1195. LevelDisplayName : Information
  1196. Message : Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware.
  1197.  
  1198. TimeCreated : 06/09/2025 13:21:48
  1199. ProviderName : Microsoft-Windows-Kernel-Boot
  1200. Id : 20
  1201. LevelDisplayName : Information
  1202. Message : The last shutdown's success status was true. The last boot's success status was true.
  1203.  
  1204. TimeCreated : 06/09/2025 13:21:48
  1205. ProviderName : Microsoft-Windows-Kernel-Boot
  1206. Id : 32
  1207. LevelDisplayName : Information
  1208. Message : The bootmgr spent 0 ms waiting for user input.
  1209.  
  1210. TimeCreated : 06/09/2025 13:21:48
  1211. ProviderName : Microsoft-Windows-Kernel-Boot
  1212. Id : 18
  1213. LevelDisplayName : Information
  1214. Message : There are 0x1 boot options on this system.
  1215.  
  1216. TimeCreated : 06/09/2025 13:21:48
  1217. ProviderName : Microsoft-Windows-Kernel-Boot
  1218. Id : 153
  1219. LevelDisplayName : Information
  1220. Message : Virtualization-based security (policies: 0) is disabled.
  1221.  
  1222. TimeCreated : 06/09/2025 13:21:48
  1223. ProviderName : Microsoft-Windows-Kernel-General
  1224. Id : 25
  1225. LevelDisplayName : Information
  1226. Message : The system time was initialized to ‎2025‎-‎09‎-‎06T11:21:48.500000000Z.
  1227.  
  1228. Loader time: ‎2025‎-‎09‎-‎06T11:21:47.000000000Z
  1229. Internal boot flags: 0x2
  1230. HAL RTC error code: 0x0
  1231. RTC time is in UTC: false
  1232. Soft boot: false
  1233. Success: true
  1234. Phase: 0
  1235.  
  1236. TimeCreated : 06/09/2025 13:21:48
  1237. ProviderName : Microsoft-Windows-Kernel-General
  1238. Id : 12
  1239. LevelDisplayName : Information
  1240. Message : The operating system started at system time ‎2025‎-‎09‎-‎06T11:21:48.500000000Z.
  1241.  
  1242. TimeCreated : 06/09/2025 13:05:51
  1243. ProviderName : Microsoft-Windows-Kernel-General
  1244. Id : 13
  1245. LevelDisplayName : Information
  1246. Message : The operating system is shutting down at system time ‎2025‎-‎09‎-‎06T11:05:51.267181100Z.
  1247.  
  1248. TimeCreated : 06/09/2025 13:05:51
  1249. ProviderName : Microsoft-Windows-Kernel-Power
  1250. Id : 577
  1251. LevelDisplayName : Information
  1252. Message : The system has prepared for a system initiated reboot from Active.
  1253.  
  1254. TimeCreated : 06/09/2025 13:05:49
  1255. ProviderName : Microsoft-Windows-Kernel-Power
  1256. Id : 109
  1257. LevelDisplayName : Information
  1258. Message : The kernel power manager has initiated a shutdown transition.
  1259.  
  1260. Action: Power Action Shutdown Off
  1261. Event Code: 0x0
  1262. Reason: Kernel API
  1263.  
  1264. TimeCreated : 06/09/2025 13:21:56
  1265. ProviderName : EventLog
  1266. Id : 6013
  1267. LevelDisplayName : Information
  1268. Message : The system uptime is 7 seconds.
  1269.  
  1270. TimeCreated : 06/09/2025 13:21:56
  1271. ProviderName : EventLog
  1272. Id : 6005
  1273. LevelDisplayName : Information
  1274. Message : The Event log service was started.
  1275.  
  1276. TimeCreated : 06/09/2025 13:21:56
  1277. ProviderName : EventLog
  1278. Id : 6009
  1279. LevelDisplayName : Information
  1280. Message : Microsoft (R) Windows (R) 10.00. 26100 Multiprocessor Free.
  1281.  
  1282. TimeCreated : 06/09/2025 13:05:48
  1283. ProviderName : Microsoft-Windows-Dhcp-Client
  1284. Id : 50037
  1285. LevelDisplayName : Information
  1286. Message : DHCPv4 client service is stopped. ShutDown Flag value is 1
  1287.  
  1288. TimeCreated : 06/09/2025 13:05:48
  1289. ProviderName : Microsoft-Windows-DHCPv6-Client
  1290. Id : 51057
  1291. LevelDisplayName : Information
  1292. Message : DHCPv6 client service stop is almost done.DHCP Context Ref count is 1
  1293.  
  1294. TimeCreated : 06/09/2025 13:05:48
  1295. ProviderName : Microsoft-Windows-DHCPv6-Client
  1296. Id : 51047
  1297. LevelDisplayName : Information
  1298. Message : DHCPv6 client service is stopped. ShutDown Flag value is 1
  1299.  
  1300. TimeCreated : 06/09/2025 13:05:48
  1301. ProviderName : Microsoft-Windows-Dhcp-Client
  1302. Id : 50106
  1303. LevelDisplayName : Information
  1304. Message : DHCPv4 is waiting on DHCPv6 service to stop
  1305.  
  1306. TimeCreated : 06/09/2025 13:05:48
  1307. ProviderName : Microsoft-Windows-Dhcp-Client
  1308. Id : 50105
  1309. LevelDisplayName : Information
  1310. Message : DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT
  1311.  
  1312. TimeCreated : 06/09/2025 13:05:48
  1313. ProviderName : Microsoft-Windows-Dhcp-Client
  1314. Id : 50104
  1315. LevelDisplayName : Information
  1316. Message : DHCPv4 client received shutdown notification
  1317.  
  1318. TimeCreated : 06/09/2025 13:05:48
  1319. ProviderName : EventLog
  1320. Id : 6006
  1321. LevelDisplayName : Information
  1322. Message : The Event log service was stopped.
  1323.  
  1324. TimeCreated : 06/09/2025 13:05:48
  1325. ProviderName : Microsoft-Windows-User Profiles Service
  1326. Id : 1532
  1327. LevelDisplayName : Information
  1328. Message : The User Profile Service has stopped.
  1329.  
  1330.  
  1331.  
  1332. TimeCreated : 06/09/2025 13:05:48
  1333. ProviderName : RtkAudioUniversalService
  1334. Id : 0
  1335. LevelDisplayName :
  1336. Message :
  1337.  
  1338. TimeCreated : 06/09/2025 13:05:47
  1339. ProviderName : Microsoft-Windows-Winlogon
  1340. Id : 7002
  1341. LevelDisplayName : Information
  1342. Message : User Logoff Notification for Customer Experience Improvement Program
  1343.  
  1344. TimeCreated : 06/09/2025 13:05:47
  1345. ProviderName : Microsoft-Windows-Winlogon
  1346. Id : 6000
  1347. LevelDisplayName : Information
  1348. Message : The winlogon notification subscriber <Wlansvc> was unavailable to handle a notification event.
  1349.  
  1350. TimeCreated : 06/09/2025 13:05:47
  1351. ProviderName : Microsoft-Windows-Winlogon
  1352. Id : 6000
  1353. LevelDisplayName : Information
  1354. Message : The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.
  1355.  
  1356. TimeCreated : 06/09/2025 13:05:47
  1357. ProviderName : Microsoft-Windows-Winlogon
  1358. Id : 6000
  1359. LevelDisplayName : Information
  1360. Message : The winlogon notification subscriber <WSearch> was unavailable to handle a notification event.
  1361.  
  1362. TimeCreated : 06/09/2025 13:05:46
  1363. ProviderName : googledrivefs31931
  1364. Id : 1
  1365. LevelDisplayName : Information
  1366. Message : Finished event release.
  1367.  
  1368. TimeCreated : 06/09/2025 13:05:46
  1369. ProviderName : googledrivefs31931
  1370. Id : 1
  1371. LevelDisplayName : Information
  1372. Message : Finished deleting device.
  1373.  
  1374. TimeCreated : 06/09/2025 13:05:46
  1375. ProviderName : googledrivefs31931
  1376. Id : 1
  1377. LevelDisplayName : Information
  1378. Message : Deleting volume device object.
  1379.  
  1380. TimeCreated : 06/09/2025 13:05:46
  1381. ProviderName : googledrivefs31931
  1382. Id : 1
  1383. LevelDisplayName : Information
  1384. Message : Removing mount entry.
  1385.  
  1386. TimeCreated : 06/09/2025 13:05:46
  1387. ProviderName : googledrivefs31931
  1388. Id : 1
  1389. LevelDisplayName : Information
  1390. Message : Mount entry found: \DosDevices\G: -> \Device\Volume{f5ae2bcb-da01-3bf2-8935-408102040811}
  1391.  
  1392. TimeCreated : 06/09/2025 13:05:46
  1393. ProviderName : googledrivefs31931
  1394. Id : 1
  1395. LevelDisplayName : Information
  1396. Message : Found entry with matching device name: \Device\Volume{f5ae2bcb-da01-3bf2-8935-408102040811}
  1397.  
  1398. TimeCreated : 06/09/2025 13:05:46
  1399. ProviderName : googledrivefs31931
  1400. Id : 1
  1401. LevelDisplayName : Information
  1402. Message : Finding mount entry; lockGlobal = 1; mount point = .
  1403.  
  1404. TimeCreated : 06/09/2025 13:05:46
  1405. ProviderName : googledrivefs31931
  1406. Id : 1
  1407. LevelDisplayName : Information
  1408. Message : Deleting device object.
  1409.  
  1410. TimeCreated : 06/09/2025 13:05:46
  1411. ProviderName : googledrivefs31931
  1412. Id : 1
  1413. LevelDisplayName : Information
  1414. Message : Cleaning up all change notification waiters.
  1415.  
  1416. TimeCreated : 06/09/2025 13:05:46
  1417. ProviderName : googledrivefs31931
  1418. Id : 1
  1419. LevelDisplayName : Information
  1420. Message : Stopping FCB garbage collector.
  1421.  
  1422. TimeCreated : 06/09/2025 13:05:46
  1423. ProviderName : googledrivefs31931
  1424. Id : 1
  1425. LevelDisplayName : Information
  1426. Message : Starting unmount for device "\Device\Volume{f5ae2bcb-da01-3bf2-8935-408102040811}"
  1427.  
  1428. TimeCreated : 06/09/2025 13:05:46
  1429. ProviderName : googledrivefs31931
  1430. Id : 1
  1431. LevelDisplayName : Information
  1432. Message : Mount manager is disabled for this device or dokan initiated deletion; ignoring.
  1433.  
  1434. TimeCreated : 06/09/2025 13:05:46
  1435. ProviderName : googledrivefs31931
  1436. Id : 1
  1437. LevelDisplayName : Information
  1438. Message : Link deleted: "\DosDevices\G:"
  1439.  
  1440. TimeCreated : 06/09/2025 13:05:46
  1441. ProviderName : googledrivefs31931
  1442. Id : 1
  1443. LevelDisplayName : Information
  1444. Message : Mount manager is disabled for this device or dokan initiated deletion; ignoring.
  1445.  
  1446. TimeCreated : 06/09/2025 13:05:46
  1447. ProviderName : googledrivefs31931
  1448. Id : 1
  1449. LevelDisplayName : Information
  1450. Message : Link deleted: "\??\Volume{ba56d176-8af7-11f0-b653-8d129e426ec3}"
  1451.  
  1452. TimeCreated : 06/09/2025 13:05:46
  1453. ProviderName : googledrivefs31931
  1454. Id : 1
  1455. LevelDisplayName : Information
  1456. Message : 40811}"
  1457.  
  1458. TimeCreated : 06/09/2025 13:05:46
  1459. ProviderName : googledrivefs31931
  1460. Id : 1
  1461. LevelDisplayName : Information
  1462. Message : Issuing a clean mount manager delete for device "\Device\Volume{f5ae2bcb-da01-3bf2-8935-4081020
  1463.  
  1464. TimeCreated : 06/09/2025 13:05:46
  1465. ProviderName : googledrivefs31931
  1466. Id : 1
  1467. LevelDisplayName : Information
  1468. Message : Entered event release.
  1469.  
  1470. TimeCreated : 06/09/2025 13:05:46
  1471. ProviderName : googledrivefs31931
  1472. Id : 1
  1473. LevelDisplayName : Information
  1474. Message : Unmounting due to keepalive close.
  1475.  
  1476. TimeCreated : 06/09/2025 13:05:46
  1477. ProviderName : Microsoft-Windows-Winsrv
  1478. Id : 10001
  1479. LevelDisplayName : Information
  1480. Message : The following application attempted to veto the shutdown: Process Governor.exe.
  1481.  
  1482. TimeCreated : 06/09/2025 13:05:45
  1483. ProviderName : User32
  1484. Id : 1074
  1485. LevelDisplayName : Information
  1486. Message : The process C:\Windows\System32\RuntimeBroker.exe (DESKTOP-098P9D8) has initiated the power off of computer DESKTOP-098P9D8 on behalf of user DESKTOP-098P9D8\tovot for the following reason: Other (Unplanned)
  1487. Reason Code: 0x0
  1488. Shutdown Type: power off
  1489. Comment:
  1490.  
  1491. TimeCreated : 06/09/2025 13:03:25
  1492. ProviderName : Microsoft-Windows-UserModePowerService
  1493. Id : 51
  1494. LevelDisplayName : Information
  1495. Message : Process C:\Program Files\QuickCPU\QuickCPU.exe (process ID:11236) reset overlay policy scheme from {ded574b5-45a0-4f42-8737-46345c09c238} to {ded574b5-45a0-4f42-8737-46345c09c238}
  1496.  
  1497. TimeCreated : 06/09/2025 13:03:25
  1498. ProviderName : Microsoft-Windows-UserModePowerService
  1499. Id : 51
  1500. LevelDisplayName : Information
  1501. Message : Process C:\Program Files\QuickCPU\QuickCPU.exe (process ID:11236) reset overlay policy scheme from {ded574b5-45a0-4f42-8737-46345c09c238} to {ded574b5-45a0-4f42-8737-46345c09c238}
  1502.  
  1503. TimeCreated : 06/09/2025 13:03:25
  1504. ProviderName : Microsoft-Windows-UserModePowerService
  1505. Id : 51
  1506. LevelDisplayName : Information
  1507. Message : Process C:\Program Files\QuickCPU\QuickCPU.exe (process ID:11236) reset overlay policy scheme from {ded574b5-45a0-4f42-8737-46345c09c238} to {ded574b5-45a0-4f42-8737-46345c09c238}
  1508.  
  1509. TimeCreated : 06/09/2025 13:03:18
  1510. ProviderName : Service Control Manager
  1511. Id : 7045
  1512. LevelDisplayName : Information
  1513. Message : A service was installed in the system.
  1514.  
  1515. Service Name: cbhardwarelink2
  1516. Service File Name: C:\Program Files\QuickCPU\hwdlink.sys
  1517. Service Type: kernel mode driver
  1518. Service Start Type: demand start
  1519. Service Account:
  1520.  
  1521. TimeCreated : 06/09/2025 13:03:00
  1522. ProviderName : Microsoft-Windows-UserModePowerService
  1523. Id : 12
  1524. LevelDisplayName : Information
  1525. Message : Process C:\Program Files\QuickCPU\QuickCPU.exe (process ID:10512) reset policy scheme from {b0432ffb-84c5-4086-bab1-643de75d6e75} to {b0432ffb-84c5-4086-bab1-643de75d6e75}
  1526.  
  1527. TimeCreated : 06/09/2025 13:02:41
  1528. ProviderName : Microsoft-Windows-UserModePowerService
  1529. Id : 12
  1530. LevelDisplayName : Information
  1531. Message : Process C:\Program Files\QuickCPU\QuickCPU.exe (process ID:10512) reset policy scheme from {b0432ffb-84c5-4086-bab1-643de75d6e75} to {b0432ffb-84c5-4086-bab1-643de75d6e75}
  1532.  
  1533. TimeCreated : 06/09/2025 13:02:24
  1534. ProviderName : Microsoft-Windows-UserModePowerService
  1535. Id : 12
  1536. LevelDisplayName : Information
  1537. Message : Process C:\Program Files\QuickCPU\QuickCPU.exe (process ID:10512) reset policy scheme from {b0432ffb-84c5-4086-bab1-643de75d6e75} to {b0432ffb-84c5-4086-bab1-643de75d6e75}
  1538.  
  1539. TimeCreated : 06/09/2025 13:02:12
  1540. ProviderName : Microsoft-Windows-UserModePowerService
  1541. Id : 12
  1542. LevelDisplayName : Information
  1543. Message : Process C:\Program Files\QuickCPU\QuickCPU.exe (process ID:10512) reset policy scheme from {b0432ffb-84c5-4086-bab1-643de75d6e75} to {b0432ffb-84c5-4086-bab1-643de75d6e75}
  1544.  
  1545. TimeCreated : 06/09/2025 12:55:24
  1546. ProviderName : Microsoft-Windows-Security-SPP
  1547. Id : 16384
  1548. LevelDisplayName : Information
  1549. Message : Successfully scheduled Software Protection service for re-start at 2125-08-13T10:55:24Z. Reason: RulesEngine.
  1550.  
  1551. TimeCreated : 06/09/2025 12:54:53
  1552. ProviderName : Microsoft-Windows-Security-SPP
  1553. Id : 16394
  1554. LevelDisplayName : Information
  1555. Message : Offline downlevel migration succeeded.
  1556.  
  1557. TimeCreated : 06/09/2025 12:51:03
  1558. ProviderName : Chrome
  1559. Id : 256
  1560. LevelDisplayName : Information
  1561. Message : [3040:11804:0906/125103.215:INFO:chrome\browser\extensions\extension_garbage_collector.cc:184] Garbage collection for extensions on file thread is complete.
  1562.  
  1563. TimeCreated : 06/09/2025 12:50:35
  1564. ProviderName : Microsoft-Windows-DistributedCOM
  1565. Id : 10016
  1566. LevelDisplayName : Warning
  1567. Message : The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
  1568. {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
  1569. and APPID
  1570. {15C20B67-12E7-4BB6-92BB-7AFF07997402}
  1571. to the user DESKTOP-098P9D8\tovot SID (S-1-5-21-69511818-2281423806-1859989881-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
  1572.  
  1573. TimeCreated : 06/09/2025 12:46:26
  1574. ProviderName : Microsoft-Windows-UserModePowerService
  1575. Id : 12
  1576. LevelDisplayName : Information
  1577. Message : Process C:\Program Files\QuickCPU\QuickCPU.exe (process ID:10512) reset policy scheme from {b0432ffb-84c5-4086-bab1-643de75d6e75} to {b0432ffb-84c5-4086-bab1-643de75d6e75}
  1578.  
  1579. TimeCreated : 06/09/2025 12:46:17
  1580. ProviderName : Microsoft-Windows-UserModePowerService
  1581. Id : 12
  1582. LevelDisplayName : Information
  1583. Message : Process C:\Program Files\QuickCPU\QuickCPU.exe (process ID:10512) reset policy scheme from {b0432ffb-84c5-4086-bab1-643de75d6e75} to {b0432ffb-84c5-4086-bab1-643de75d6e75}
  1584.  
  1585. TimeCreated : 06/09/2025 12:36:20
  1586. ProviderName : Microsoft-Windows-DistributedCOM
  1587. Id : 10010
  1588. LevelDisplayName : Error
  1589. Message : The server Windows.Gaming.GameBar.PresenceServer.Internal.PresenceWriter did not register with DCOM within the required timeout.
  1590.  
  1591. TimeCreated : 06/09/2025 12:36:16
  1592. ProviderName : Microsoft-Windows-DistributedCOM
  1593. Id : 10010
  1594. LevelDisplayName : Error
  1595. Message : The server Windows.Gaming.GameBar.PresenceServer.Internal.PresenceWriter did not register with DCOM within the required timeout.
  1596.  
  1597. TimeCreated : 06/09/2025 12:36:00
  1598. ProviderName : Microsoft-Windows-UserModePowerService
  1599. Id : 12
  1600. LevelDisplayName : Information
  1601. Message : Process C:\Program Files\QuickCPU\QuickCPU.exe (process ID:10512) reset policy scheme from {b0432ffb-84c5-4086-bab1-643de75d6e75} to {b0432ffb-84c5-4086-bab1-643de75d6e75}
  1602.  
  1603. TimeCreated : 06/09/2025 12:35:57
  1604. ProviderName : Microsoft-Windows-UserModePowerService
  1605. Id : 51
  1606. LevelDisplayName : Information
  1607. Message : Process C:\Program Files\QuickCPU\QuickCPU.exe (process ID:10512) reset overlay policy scheme from {ded574b5-45a0-4f42-8737-46345c09c238} to {ded574b5-45a0-4f42-8737-46345c09c238}
  1608.  
  1609. TimeCreated : 06/09/2025 12:35:36
  1610. ProviderName : Microsoft-Windows-UserModePowerService
  1611. Id : 51
  1612. LevelDisplayName : Information
  1613. Message : Process C:\Program Files\QuickCPU\QuickCPU.exe (process ID:10512) reset overlay policy scheme from {ded574b5-45a0-4f42-8737-46345c09c238} to {ded574b5-45a0-4f42-8737-46345c09c238}
  1614.  
  1615. TimeCreated : 06/09/2025 12:34:09
  1616. ProviderName : Microsoft-Windows-UserModePowerService
  1617. Id : 51
  1618. LevelDisplayName : Information
  1619. Message : Process C:\Program Files\QuickCPU\QuickCPU.exe (process ID:10512) reset overlay policy scheme from {ded574b5-45a0-4f42-8737-46345c09c238} to {ded574b5-45a0-4f42-8737-46345c09c238}
  1620.  
  1621. TimeCreated : 06/09/2025 12:34:09
  1622. ProviderName : Microsoft-Windows-UserModePowerService
  1623. Id : 51
  1624. LevelDisplayName : Information
  1625. Message : Process C:\Program Files\QuickCPU\QuickCPU.exe (process ID:10512) reset overlay policy scheme from {00000000-0000-0000-0000-000000000000} to {ded574b5-45a0-4f42-8737-46345c09c238}
  1626.  
  1627. TimeCreated : 06/09/2025 12:33:49
  1628. ProviderName : Microsoft-Windows-UserModePowerService
  1629. Id : 12
  1630. LevelDisplayName : Information
  1631. Message : Process C:\Program Files\QuickCPU\QuickCPU.exe (process ID:10512) reset policy scheme from {b0432ffb-84c5-4086-bab1-643de75d6e75} to {b0432ffb-84c5-4086-bab1-643de75d6e75}
  1632.  
  1633. TimeCreated : 06/09/2025 12:30:28
  1634. ProviderName : Microsoft-Windows-UserModePowerService
  1635. Id : 51
  1636. LevelDisplayName : Information
  1637. Message : Process C:\Program Files\QuickCPU\QuickCPU.exe (process ID:10512) reset overlay policy scheme from {00000000-0000-0000-0000-000000000000} to {00000000-0000-0000-0000-000000000000}
  1638.  
  1639. TimeCreated : 06/09/2025 12:30:28
  1640. ProviderName : Microsoft-Windows-UserModePowerService
  1641. Id : 51
  1642. LevelDisplayName : Information
  1643. Message : Process C:\Program Files\QuickCPU\QuickCPU.exe (process ID:10512) reset overlay policy scheme from {00000000-0000-0000-0000-000000000000} to {00000000-0000-0000-0000-000000000000}
  1644.  
  1645. TimeCreated : 06/09/2025 12:30:28
  1646. ProviderName : Microsoft-Windows-UserModePowerService
  1647. Id : 51
  1648. LevelDisplayName : Information
  1649. Message : Process C:\Program Files\QuickCPU\QuickCPU.exe (process ID:10512) reset overlay policy scheme from {00000000-0000-0000-0000-000000000000} to {00000000-0000-0000-0000-000000000000}
  1650.  
  1651. TimeCreated : 06/09/2025 12:30:15
  1652. ProviderName : Service Control Manager
  1653. Id : 7045
  1654. LevelDisplayName : Information
  1655. Message : A service was installed in the system.
  1656.  
  1657. Service Name: cbhardwarelink2
  1658. Service File Name: C:\Program Files\QuickCPU\hwdlink.sys
  1659. Service Type: kernel mode driver
  1660. Service Start Type: demand start
  1661. Service Account:
  1662.  
  1663. TimeCreated : 06/09/2025 12:30:09
  1664. ProviderName : MsiInstaller
  1665. Id : 1033
  1666. LevelDisplayName : Information
  1667. Message : Windows Installer installed the product. Product Name: Quick CPU. Product Version: 5.2.0.0. Product Language: 1033. Manufacturer: CoderBag LLC. Installation success or error status: 0.
  1668.  
  1669. TimeCreated : 06/09/2025 12:30:09
  1670. ProviderName : MsiInstaller
  1671. Id : 11707
  1672. LevelDisplayName : Information
  1673. Message : Product: Quick CPU -- Installation completed successfully.
  1674.  
  1675. TimeCreated : 06/09/2025 12:30:05
  1676. ProviderName : Microsoft-Windows-RestartManager
  1677. Id : 10001
  1678. LevelDisplayName : Information
  1679. Message : Ending session 0 started ‎2025‎-‎09‎-‎06T10:30:02.843776700Z.
  1680.  
  1681. TimeCreated : 06/09/2025 12:30:05
  1682. ProviderName : MsiInstaller
  1683. Id : 1042
  1684. LevelDisplayName : Information
  1685. Message : Ending a Windows Installer transaction: D:\WINDOWS\Downloads\QuickCpuSetup.msi. Client Process Id: 4296.
  1686.  
  1687. TimeCreated : 06/09/2025 12:30:02
  1688. ProviderName : Microsoft-Windows-RestartManager
  1689. Id : 10000
  1690. LevelDisplayName : Information
  1691. Message : Starting session 0 - ‎2025‎-‎09‎-‎06T10:30:02.843776700Z.
  1692.  
  1693. TimeCreated : 06/09/2025 12:30:01
  1694. ProviderName : MsiInstaller
  1695. Id : 1040
  1696. LevelDisplayName : Information
  1697. Message : Beginning a Windows Installer transaction: D:\WINDOWS\Downloads\QuickCpuSetup.msi. Client Process Id: 4296.
  1698.  
  1699. TimeCreated : 06/09/2025 12:27:56
  1700. ProviderName : Microsoft-Windows-Security-SPP
  1701. Id : 16384
  1702. LevelDisplayName : Information
  1703. Message : Successfully scheduled Software Protection service for re-start at 2125-08-13T10:27:56Z. Reason: RulesEngine.
  1704.  
  1705. TimeCreated : 06/09/2025 12:27:25
  1706. ProviderName : Microsoft-Windows-Security-SPP
  1707. Id : 16394
  1708. LevelDisplayName : Information
  1709. Message : Offline downlevel migration succeeded.
  1710.  
  1711. TimeCreated : 06/09/2025 12:24:12
  1712. ProviderName : SecurityCenter
  1713. Id : 15
  1714. LevelDisplayName : Information
  1715. Message : Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.
  1716.  
  1717. TimeCreated : 06/09/2025 12:24:12
  1718. ProviderName : Microsoft-Windows-WindowsUpdateClient
  1719. Id : 19
  1720. LevelDisplayName : Information
  1721. Message : Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.435.618.0) - Current Channel (Broad)
  1722.  
  1723. TimeCreated : 06/09/2025 12:24:11
  1724. ProviderName : Microsoft-Windows-Security-SPP
  1725. Id : 16384
  1726. LevelDisplayName : Information
  1727. Message : Successfully scheduled Software Protection service for re-start at 2125-08-13T10:24:11Z. Reason: RulesEngine.
  1728.  
  1729. TimeCreated : 06/09/2025 12:24:00
  1730. ProviderName : Microsoft-Windows-WindowsUpdateClient
  1731. Id : 43
  1732. LevelDisplayName : Information
  1733. Message : Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.435.618.0) - Current Channel (Broad)
  1734.  
  1735. TimeCreated : 06/09/2025 12:23:49
  1736. ProviderName : Microsoft-Windows-WindowsUpdateClient
  1737. Id : 44
  1738. LevelDisplayName : Information
  1739. Message : Windows Update started downloading an update.
  1740.  
  1741. TimeCreated : 06/09/2025 12:23:10
  1742. ProviderName : Microsoft-Windows-Security-SPP
  1743. Id : 16394
  1744. LevelDisplayName : Information
  1745. Message : Offline downlevel migration succeeded.
  1746.  
  1747. TimeCreated : 06/09/2025 12:16:18
  1748. ProviderName : Microsoft-Windows-Security-SPP
  1749. Id : 16384
  1750. LevelDisplayName : Information
  1751. Message : Successfully scheduled Software Protection service for re-start at 2125-08-13T10:16:18Z. Reason: RulesEngine.
  1752.  
  1753. TimeCreated : 06/09/2025 12:15:47
  1754. ProviderName : Microsoft-Windows-Security-SPP
  1755. Id : 16394
  1756. LevelDisplayName : Information
  1757. Message : Offline downlevel migration succeeded.
  1758.  
  1759. TimeCreated : 06/09/2025 12:15:12
  1760. ProviderName : Chrome
  1761. Id : 256
  1762. LevelDisplayName : Information
  1763. Message : [1568:5720:0906/121512.802:INFO:chrome\browser\extensions\extension_garbage_collector.cc:184] Garbage collection for extensions on file thread is complete.
  1764.  
  1765. TimeCreated : 06/09/2025 12:14:54
  1766. ProviderName : Microsoft-Windows-DistributedCOM
  1767. Id : 10016
  1768. LevelDisplayName : Warning
  1769. Message : The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
  1770. {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
  1771. and APPID
  1772. {15C20B67-12E7-4BB6-92BB-7AFF07997402}
  1773. to the user DESKTOP-098P9D8\tovot SID (S-1-5-21-69511818-2281423806-1859989881-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
  1774.  
  1775. TimeCreated : 06/09/2025 12:02:48
  1776. ProviderName : Microsoft-Windows-Security-SPP
  1777. Id : 16384
  1778. LevelDisplayName : Information
  1779. Message : Successfully scheduled Software Protection service for re-start at 2125-08-13T10:02:48Z. Reason: RulesEngine.
  1780.  
  1781. TimeCreated : 06/09/2025 12:02:18
  1782. ProviderName : Microsoft-Windows-Security-SPP
  1783. Id : 16394
  1784. LevelDisplayName : Information
  1785. Message : Offline downlevel migration succeeded.
  1786.  
  1787. TimeCreated : 06/09/2025 12:00:00
  1788. ProviderName : EventLog
  1789. Id : 6013
  1790. LevelDisplayName : Information
  1791. Message : The system uptime is 7096 seconds.
  1792.  
  1793. TimeCreated : 06/09/2025 11:24:40
  1794. ProviderName : Chrome
  1795. Id : 256
  1796. LevelDisplayName : Information
  1797. Message : [7012:1464:0906/112440.134:INFO:chrome\browser\extensions\extension_garbage_collector.cc:184] Garbage collection for extensions on file thread is complete.
  1798.  
  1799. TimeCreated : 06/09/2025 11:24:12
  1800. ProviderName : Microsoft-Windows-DistributedCOM
  1801. Id : 10016
  1802. LevelDisplayName : Warning
  1803. Message : The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
  1804. {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
  1805. and APPID
  1806. {15C20B67-12E7-4BB6-92BB-7AFF07997402}
  1807. to the user DESKTOP-098P9D8\tovot SID (S-1-5-21-69511818-2281423806-1859989881-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
  1808.  
  1809. TimeCreated : 06/09/2025 11:19:11
  1810. ProviderName : Microsoft-Windows-Security-SPP
  1811. Id : 16384
  1812. LevelDisplayName : Information
  1813. Message : Successfully scheduled Software Protection service for re-start at 2125-08-13T09:19:11Z. Reason: RulesEngine.
  1814.  
  1815. TimeCreated : 06/09/2025 11:18:41
  1816. ProviderName : Microsoft-Windows-Security-SPP
  1817. Id : 16394
  1818. LevelDisplayName : Information
  1819. Message : Offline downlevel migration succeeded.
  1820.  
  1821. TimeCreated : 06/09/2025 11:12:07
  1822. ProviderName : Chrome
  1823. Id : 256
  1824. LevelDisplayName : Information
  1825. Message : [15124:11096:0906/111207.698:INFO:chrome\browser\extensions\extension_garbage_collector.cc:184] Garbage collection for extensions on file thread is complete.
  1826.  
  1827. TimeCreated : 06/09/2025 11:11:46
  1828. ProviderName : Microsoft-Windows-DistributedCOM
  1829. Id : 10016
  1830. LevelDisplayName : Warning
  1831. Message : The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
  1832. {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
  1833. and APPID
  1834. {15C20B67-12E7-4BB6-92BB-7AFF07997402}
  1835. to the user DESKTOP-098P9D8\tovot SID (S-1-5-21-69511818-2281423806-1859989881-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
  1836.  
  1837. TimeCreated : 06/09/2025 11:07:45
  1838. ProviderName : Microsoft-Windows-Security-SPP
  1839. Id : 16384
  1840. LevelDisplayName : Information
  1841. Message : Successfully scheduled Software Protection service for re-start at 2125-08-13T09:07:45Z. Reason: RulesEngine.
  1842.  
  1843. TimeCreated : 06/09/2025 11:07:15
  1844. ProviderName : Microsoft-Windows-Security-SPP
  1845. Id : 16394
  1846. LevelDisplayName : Information
  1847. Message : Offline downlevel migration succeeded.
  1848.  
  1849. TimeCreated : 06/09/2025 10:56:51
  1850. ProviderName : Microsoft-Windows-Security-SPP
  1851. Id : 16384
  1852. LevelDisplayName : Information
  1853. Message : Successfully scheduled Software Protection service for re-start at 2125-08-13T08:56:51Z. Reason: RulesEngine.
  1854.  
  1855. TimeCreated : 06/09/2025 10:56:21
  1856. ProviderName : Microsoft-Windows-Security-SPP
  1857. Id : 16394
  1858. LevelDisplayName : Information
  1859. Message : Offline downlevel migration succeeded.
  1860.  
  1861. TimeCreated : 06/09/2025 10:56:20
  1862. ProviderName : Microsoft-Windows-Kernel-General
  1863. Id : 16
  1864. LevelDisplayName : Information
  1865. Message : The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages.
  1866.  
  1867. TimeCreated : 06/09/2025 10:24:21
  1868. ProviderName : Chrome
  1869. Id : 256
  1870. LevelDisplayName : Information
  1871. Message : [14472:14944:0906/102421.763:INFO:chrome\browser\extensions\extension_garbage_collector.cc:184] Garbage collection for extensions on file thread is complete.
  1872.  
  1873. TimeCreated : 06/09/2025 10:24:04
  1874. ProviderName : Microsoft-Windows-DistributedCOM
  1875. Id : 10016
  1876. LevelDisplayName : Warning
  1877. Message : The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
  1878. {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
  1879. and APPID
  1880. {15C20B67-12E7-4BB6-92BB-7AFF07997402}
  1881. to the user DESKTOP-098P9D8\tovot SID (S-1-5-21-69511818-2281423806-1859989881-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
  1882.  
  1883. TimeCreated : 06/09/2025 10:22:42
  1884. ProviderName : Microsoft-Windows-DistributedCOM
  1885. Id : 10010
  1886. LevelDisplayName : Error
  1887. Message : The server Windows.Gaming.GameBar.PresenceServer.Internal.PresenceWriter did not register with DCOM within the required timeout.
  1888.  
  1889. TimeCreated : 06/09/2025 10:22:27
  1890. ProviderName : Microsoft-Windows-DistributedCOM
  1891. Id : 10010
  1892. LevelDisplayName : Error
  1893. Message : The server Windows.Gaming.GameBar.PresenceServer.Internal.PresenceWriter did not register with DCOM within the required timeout.
  1894.  
  1895. TimeCreated : 06/09/2025 10:15:23
  1896. ProviderName : Microsoft-Windows-Security-SPP
  1897. Id : 16384
  1898. LevelDisplayName : Information
  1899. Message : Successfully scheduled Software Protection service for re-start at 2125-08-13T08:15:23Z. Reason: RulesEngine.
  1900.  
  1901. TimeCreated : 06/09/2025 10:14:52
  1902. ProviderName : Microsoft-Windows-Security-SPP
  1903. Id : 16394
  1904. LevelDisplayName : Information
  1905. Message : Offline downlevel migration succeeded.
  1906.  
  1907. TimeCreated : 06/09/2025 10:11:46
  1908. ProviderName : Microsoft-Windows-DistributedCOM
  1909. Id : 10016
  1910. LevelDisplayName : Warning
  1911. Message : The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
  1912. {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
  1913. and APPID
  1914. {15C20B67-12E7-4BB6-92BB-7AFF07997402}
  1915. to the user DESKTOP-098P9D8\tovot SID (S-1-5-21-69511818-2281423806-1859989881-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
  1916.  
  1917. TimeCreated : 06/09/2025 10:11:19
  1918. ProviderName : Microsoft-Windows-Kernel-General
  1919. Id : 16
  1920. LevelDisplayName : Information
  1921. Message : The access history in hive \??\C:\Users\tovot\AppData\Local\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\SystemAppData\Helium\UserClasses.dat was cleared updating 1 keys and creating 1 modified pages.
  1922.  
  1923. TimeCreated : 06/09/2025 10:11:19
  1924. ProviderName : Microsoft-Windows-Kernel-General
  1925. Id : 16
  1926. LevelDisplayName : Information
  1927. Message : The access history in hive \??\C:\Users\tovot\AppData\Local\Packages\Clipchamp.Clipchamp_yxz26nhyzhsrt\SystemAppData\Helium\User.dat was cleared updating 6 keys and creating 2 modified pages.
  1928.  
  1929. TimeCreated : 06/09/2025 10:07:59
  1930. ProviderName : SecurityCenter
  1931. Id : 15
  1932. LevelDisplayName : Information
  1933. Message : Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.
  1934.  
  1935. TimeCreated : 06/09/2025 10:07:57
  1936. ProviderName : SecurityCenter
  1937. Id : 15
  1938. LevelDisplayName : Information
  1939. Message : Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.
  1940.  
  1941. TimeCreated : 06/09/2025 10:07:52
  1942. ProviderName : Service Control Manager
  1943. Id : 7000
  1944. LevelDisplayName : Error
  1945. Message : The R0FanControl service failed to start due to the following error:
  1946. Operation did not complete successfully because the file contains a virus or potentially unwanted software.
  1947.  
  1948. TimeCreated : 06/09/2025 10:07:52
  1949. ProviderName : Service Control Manager
  1950. Id : 7045
  1951. LevelDisplayName : Information
  1952. Message : A service was installed in the system.
  1953.  
  1954. Service Name: R0FanControl
  1955. Service File Name: C:\Program Files (x86)\FanControl\FanControl.sys
  1956. Service Type: kernel mode driver
  1957. Service Start Type: demand start
  1958. Service Account:
  1959.  
  1960. TimeCreated : 06/09/2025 10:07:50
  1961. ProviderName : Service Control Manager
  1962. Id : 7000
  1963. LevelDisplayName : Error
  1964. Message : The R0FanControl service failed to start due to the following error:
  1965. Operation did not complete successfully because the file contains a virus or potentially unwanted software.
  1966.  
  1967. TimeCreated : 06/09/2025 10:07:50
  1968. ProviderName : Service Control Manager
  1969. Id : 7045
  1970. LevelDisplayName : Information
  1971. Message : A service was installed in the system.
  1972.  
  1973. Service Name: R0FanControl
  1974. Service File Name: C:\Program Files (x86)\FanControl\FanControl.sys
  1975. Service Type: kernel mode driver
  1976. Service Start Type: demand start
  1977. Service Account:
  1978.  
  1979. TimeCreated : 06/09/2025 10:07:06
  1980. ProviderName : Microsoft-Windows-Security-SPP
  1981. Id : 16384
  1982. LevelDisplayName : Information
  1983. Message : Successfully scheduled Software Protection service for re-start at 2125-08-13T08:07:06Z. Reason: RulesEngine.
  1984.  
  1985. TimeCreated : 06/09/2025 10:06:36
  1986. ProviderName : Microsoft-Windows-Security-SPP
  1987. Id : 16394
  1988. LevelDisplayName : Information
  1989. Message : Offline downlevel migration succeeded.
  1990.  
  1991. TimeCreated : 06/09/2025 10:05:40
  1992. ProviderName : SecurityCenter
  1993. Id : 15
  1994. LevelDisplayName : Information
  1995. Message : Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.
  1996.  
  1997. TimeCreated : 06/09/2025 10:05:39
  1998. ProviderName : Chrome
  1999. Id : 256
  2000. LevelDisplayName : Information
  2001. Message : [8208:4472:0906/100539.604:INFO:chrome\browser\extensions\extension_garbage_collector.cc:184] Garbage collection for extensions on file thread is complete.
  2002.  
  2003. TimeCreated : 06/09/2025 10:05:38
  2004. ProviderName : SecurityCenter
  2005. Id : 15
  2006. LevelDisplayName : Information
  2007. Message : Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.
  2008.  
  2009. TimeCreated : 06/09/2025 10:05:33
  2010. ProviderName : Service Control Manager
  2011. Id : 7000
  2012. LevelDisplayName : Error
  2013. Message : The R0FanControl service failed to start due to the following error:
  2014. Operation did not complete successfully because the file contains a virus or potentially unwanted software.
  2015.  
  2016. TimeCreated : 06/09/2025 10:05:33
  2017. ProviderName : Service Control Manager
  2018. Id : 7045
  2019. LevelDisplayName : Information
  2020. Message : A service was installed in the system.
  2021.  
  2022. Service Name: R0FanControl
  2023. Service File Name: C:\Program Files (x86)\FanControl\FanControl.sys
  2024. Service Type: kernel mode driver
  2025. Service Start Type: demand start
  2026. Service Account:
  2027.  
  2028. TimeCreated : 06/09/2025 10:05:31
  2029. ProviderName : Service Control Manager
  2030. Id : 7000
  2031. LevelDisplayName : Error
  2032. Message : The R0FanControl service failed to start due to the following error:
  2033. Operation did not complete successfully because the file contains a virus or potentially unwanted software.
  2034.  
  2035. TimeCreated : 06/09/2025 10:05:31
  2036. ProviderName : Service Control Manager
  2037. Id : 7045
  2038. LevelDisplayName : Information
  2039. Message : A service was installed in the system.
  2040.  
  2041. Service Name: R0FanControl
  2042. Service File Name: C:\Program Files (x86)\FanControl\FanControl.sys
  2043. Service Type: kernel mode driver
  2044. Service Start Type: demand start
  2045. Service Account:
  2046.  
  2047. TimeCreated : 06/09/2025 10:04:40
  2048. ProviderName : Microsoft-Windows-Security-SPP
  2049. Id : 903
  2050. LevelDisplayName : Information
  2051. Message : The Software Protection service has stopped.
  2052.  
  2053.  
  2054. TimeCreated : 06/09/2025 10:04:40
  2055. ProviderName : Microsoft-Windows-Security-SPP
  2056. Id : 16384
  2057. LevelDisplayName : Information
  2058. Message : Successfully scheduled Software Protection service for re-start at 2125-08-13T08:04:40Z. Reason: RulesEngine.
  2059.  
  2060. TimeCreated : 06/09/2025 10:04:12
  2061. ProviderName : SecurityCenter
  2062. Id : 15
  2063. LevelDisplayName : Information
  2064. Message : Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.
  2065.  
  2066. TimeCreated : 06/09/2025 10:04:10
  2067. ProviderName : SecurityCenter
  2068. Id : 1
  2069. LevelDisplayName : Information
  2070. Message : The Windows Security Center Service has started.
  2071.  
  2072. TimeCreated : 06/09/2025 10:04:10
  2073. ProviderName : Microsoft-Windows-Security-SPP
  2074. Id : 902
  2075. LevelDisplayName : Information
  2076. Message : The Software Protection service has started.
  2077. 10.0.26100.4946
  2078.  
  2079. TimeCreated : 06/09/2025 10:04:10
  2080. ProviderName : Microsoft-Windows-Security-SPP
  2081. Id : 1003
  2082. LevelDisplayName : Information
  2083. Message : The Software Protection service has completed licensing status check.
  2084. Application Id=55c92734-d682-4d71-983e-d6ec3f16059f
  2085. Licensing Status=
  2086. 1: 01eb852c-424d-4060-94b8-c10d799d7364, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2087. 2: 040fa323-92b1-4baf-97a2-5b67feaefddb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2088. 3: 0724cb7d-3437-4cb7-93cb-830375d0079d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2089. 4: 0ad2ac98-7bb9-4201-8d92-312299201369, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2090. 5: 19de9b2f-0166-4abb-9534-56ea69a80edb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2091. 6: 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2092. 7: 221a02da-e2a1-4b75-864c-0a4410a33fdf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2093. 8: 265f3fad-6a1c-4bdd-ae30-c75efa556ccb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2094. 9: 291ece0e-9c38-40ca-a9e1-32cc7ec19507, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2095. 10: 2936d1d2-913a-4542-b54e-ce5a602a2a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2096. 11: 2c293c26-a45a-4a2a-a350-c69a67097529, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2097. 12: 2de67392-b7a7-462a-b1ca-108dd189f588, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2098. 13: 2ffd8952-423e-4903-b993-72a1aa44cf82, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2099. 14: 30a42c86-b7a0-4a34-8c90-ff177cb2acb7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2100. 15: 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2101. 16: 3502365a-f88a-4ba4-822a-5769d3073b65, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2102. 17: 377333b1-8b5d-48d6-9679-1225c872d37c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2103. 18: 3df374ef-d444-4494-a5a1-4b0d9fd0e203, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2104. 19: 3ebce241-ea87-4946-8a4f-80d00e921dff, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2105. 20: 3f1afc82-f8ac-4f6c-8005-1d233e606eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2106. 21: 4322a811-697c-44dc-865e-3e2fdcb86009, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2107. 22: 49cd895b-53b2-4dc4-a5f7-b18aa019ad37, 1, 1 [(0 )(1 )(2 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(3 )]
  2108. 23: 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2109. 24: 4f3da0d2-271d-4508-ae81-626b60809a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2110. 25: 5d78c4e9-aeb3-4b40-8ac2-6a6005e0ad6d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2111. 26: 60b3ec1b-9545-4921-821f-311b129dd6f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2112. 27: 613d217f-7f13-4268-9907-1662339531cd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2113. 28: 62f0c100-9c53-4e02-b886-a3528ddfe7f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2114. 29: 6365275e-368d-46ca-a0ef-fc0404119333, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2115. 30: 721f9237-9341-4453-a661-09e8baa6cca5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2116. 31: 73111121-5638-40f6-bc11-f1d7b0d64300, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2117. 32: 7a802526-4c94-4bd1-ba14-835a1aca2120, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2118. 33: 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2119. 34: 80083eae-7031-4394-9e88-4901973d56fe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2120. 35: 82bbc092-bc50-4e16-8e18-b74fc486aec3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2121. 36: 8ab9bdd1-1f67-4997-82d9-8878520837d9, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2122. 37: 8b351c9c-f398-4515-9900-09df49427262, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2123. 38: 90da7373-1c51-430b-bf26-c97e9c5cdc31, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2124. 39: 92fb8726-92a8-4ffc-94ce-f82e07444653, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2125. 40: 95dca82f-385d-4d39-b85b-5c73fa285d6f, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2126. 41: 97cde3ae-e908-4b59-ac96-a17645c5b57e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2127. 42: a48938aa-62fa-4966-9d44-9f04da3f72f2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2128. 43: b0773a15-df3a-4312-9ad2-83d69648e356, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2129. 44: b4bfe195-541e-4e64-ad23-6177f19e395e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2130. 45: b68e61d2-68ca-4757-be45-0cc2f3e68eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2131. 46: bd3762d7-270d-4760-8fb3-d829ca45278a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2132. 47: c86d5194-4840-4dae-9c1c-0301003a5ab0, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2133. 48: ca7df2e3-5ea0-47b8-9ac1-b1be4d8edd69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2134. 49: d552befb-48cc-4327-8f39-47d2d94f987c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2135. 50: d6eadb3b-5ca8-4a6b-986e-35b550756111, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2136. 51: df96023b-dcd9-4be2-afa0-c6c871159ebe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2137. 52: e0c42288-980c-4788-a014-c080d2e1926e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2138. 53: e4db50ea-bda1-4566-b047-0ca50abc6f07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2139. 54: e558417a-5123-4f6f-91e7-385c1c7ca9d4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2140. 55: e7a950a2-e548-4f10-bf16-02ec848e0643, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2141. 56: eb6d346f-1c60-4643-b960-40ec31596c45, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2142. 57: ec868e65-fadf-4759-b23e-93fe37f2cc29, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2143. 58: ef51e000-2659-4f25-8345-3de70a9cf4c4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2144. 59: f7af7d09-40e4-419c-a49b-eae366689ebd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2145. 60: fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2146. 61: fe74f55b-0338-41d6-b267-4a201abe7285, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  2147.  
  2148.  
  2149.  
  2150. TimeCreated : 06/09/2025 10:04:10
  2151. ProviderName : Microsoft-Windows-Security-SPP
  2152. Id : 1066
  2153. LevelDisplayName : Information
  2154. Message : Initialization status for service objects.
  2155. C:\WINDOWS\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
  2156. C:\WINDOWS\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000
  2157. C:\WINDOWS\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
  2158. C:\WINDOWS\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000
  2159. C:\WINDOWS\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000
  2160. C:\WINDOWS\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
  2161. C:\WINDOWS\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000
  2162. C:\WINDOWS\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
  2163. C:\WINDOWS\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000
  2164.  
  2165.  
  2166. TimeCreated : 06/09/2025 10:04:09
  2167. ProviderName : Microsoft-Windows-DistributedCOM
  2168. Id : 10016
  2169. LevelDisplayName : Warning
  2170. Message : The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
  2171. Windows.SecurityCenter.WscDataProtection
  2172. and APPID
  2173. Unavailable
  2174. to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
  2175.  
  2176. TimeCreated : 06/09/2025 10:04:09
  2177. ProviderName : Microsoft-Windows-DistributedCOM
  2178. Id : 10016
  2179. LevelDisplayName : Warning
  2180. Message : The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
  2181. Windows.SecurityCenter.WscBrokerManager
  2182. and APPID
  2183. Unavailable
  2184. to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
  2185.  
  2186. TimeCreated : 06/09/2025 10:04:09
  2187. ProviderName : Microsoft-Windows-DistributedCOM
  2188. Id : 10016
  2189. LevelDisplayName : Warning
  2190. Message : The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
  2191. Windows.SecurityCenter.SecurityAppBroker
  2192. and APPID
  2193. Unavailable
  2194. to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
  2195.  
  2196. TimeCreated : 06/09/2025 10:04:09
  2197. ProviderName : Microsoft-Windows-DistributedCOM
  2198. Id : 10016
  2199. LevelDisplayName : Warning
  2200. Message : The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
  2201. Windows.SecurityCenter.SecurityAppBroker
  2202. and APPID
  2203. Unavailable
  2204. to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
  2205.  
  2206. TimeCreated : 06/09/2025 10:04:09
  2207. ProviderName : Microsoft-Windows-DistributedCOM
  2208. Id : 10016
  2209. LevelDisplayName : Warning
  2210. Message : The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
  2211. Windows.SecurityCenter.SecurityAppBroker
  2212. and APPID
  2213. Unavailable
  2214. to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
  2215.  
  2216. TimeCreated : 06/09/2025 10:04:09
  2217. ProviderName : Microsoft-Windows-DistributedCOM
  2218. Id : 10016
  2219. LevelDisplayName : Warning
  2220. Message : The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
  2221. Windows.SecurityCenter.WscBrokerManager
  2222. and APPID
  2223. Unavailable
  2224. to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
  2225.  
  2226. TimeCreated : 06/09/2025 10:04:09
  2227. ProviderName : Microsoft-Windows-DistributedCOM
  2228. Id : 10016
  2229. LevelDisplayName : Warning
  2230. Message : The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
  2231. Windows.SecurityCenter.WscBrokerManager
  2232. and APPID
  2233. Unavailable
  2234. to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
  2235.  
  2236. TimeCreated : 06/09/2025 10:04:09
  2237. ProviderName : Microsoft-Windows-Security-SPP
  2238. Id : 16394
  2239. LevelDisplayName : Information
  2240. Message : Offline downlevel migration succeeded.
  2241.  
  2242. TimeCreated : 06/09/2025 10:04:09
  2243. ProviderName : Microsoft-Windows-Security-SPP
  2244. Id : 900
  2245. LevelDisplayName : Information
  2246. Message : The Software Protection service is starting.
  2247. Parameters:<explicit>
  2248.  
  2249. TimeCreated : 06/09/2025 10:02:45
  2250. ProviderName : Service Control Manager
  2251. Id : 7000
  2252. LevelDisplayName : Error
  2253. Message : The R0FanControl service failed to start due to the following error:
  2254. Operation did not complete successfully because the file contains a virus or potentially unwanted software.
  2255.  
  2256. TimeCreated : 06/09/2025 10:02:45
  2257. ProviderName : Service Control Manager
  2258. Id : 7045
  2259. LevelDisplayName : Information
  2260. Message : A service was installed in the system.
  2261.  
  2262. Service Name: R0FanControl
  2263. Service File Name: C:\Program Files (x86)\FanControl\FanControl.sys
  2264. Service Type: kernel mode driver
  2265. Service Start Type: demand start
  2266. Service Account:
  2267.  
  2268. TimeCreated : 06/09/2025 10:02:43
  2269. ProviderName : Service Control Manager
  2270. Id : 7000
  2271. LevelDisplayName : Error
  2272. Message : The R0FanControl service failed to start due to the following error:
  2273. Operation did not complete successfully because the file contains a virus or potentially unwanted software.
  2274.  
  2275. TimeCreated : 06/09/2025 10:02:43
  2276. ProviderName : Service Control Manager
  2277. Id : 7045
  2278. LevelDisplayName : Information
  2279. Message : A service was installed in the system.
  2280.  
  2281. Service Name: R0FanControl
  2282. Service File Name: C:\Program Files (x86)\FanControl\FanControl.sys
  2283. Service Type: kernel mode driver
  2284. Service Start Type: demand start
  2285. Service Account:
  2286.  
  2287. TimeCreated : 06/09/2025 10:02:33
  2288. ProviderName : googledrivefs31931
  2289. Id : 1
  2290. LevelDisplayName : Information
  2291. Message : Activating keepalive handle from process 11580.
  2292.  
  2293. TimeCreated : 06/09/2025 10:02:33
  2294. ProviderName : googledrivefs31931
  2295. Id : 1
  2296. LevelDisplayName : Information
  2297. Message : Opened keepalive file from process 11580.
  2298.  
  2299. TimeCreated : 06/09/2025 10:02:33
  2300. ProviderName : googledrivefs31931
  2301. Id : 1
  2302. LevelDisplayName : Information
  2303. Message : Opened file with user mode dispatch blocked: "\__drive_fs_keepalive"
  2304.  
  2305. TimeCreated : 06/09/2025 10:02:33
  2306. ProviderName : googledrivefs31931
  2307. Id : 1
  2308. LevelDisplayName : Information
  2309. Message : Handle created before IOCTL_EVENT_WAIT for file "(null)"
  2310.  
  2311. TimeCreated : 06/09/2025 10:02:33
  2312. ProviderName : googledrivefs31931
  2313. Id : 1
  2314. LevelDisplayName : Information
  2315. Message : Finished event start with status 1 and flags: 0
  2316.  
  2317. TimeCreated : 06/09/2025 10:02:33
  2318. ProviderName : googledrivefs31931
  2319. Id : 1
  2320. LevelDisplayName : Information
  2321. Message : Returning actual mount point G
  2322.  
  2323. TimeCreated : 06/09/2025 10:02:33
  2324. ProviderName : googledrivefs31931
  2325. Id : 1
  2326. LevelDisplayName : Information
  2327. Message : Mounting successfully done.
  2328.  
  2329. TimeCreated : 06/09/2025 10:02:33
  2330. ProviderName : googledrivefs31931
  2331. Id : 1
  2332. LevelDisplayName : Information
  2333. Message : Link name matches the current one.
  2334.  
  2335. TimeCreated : 06/09/2025 10:02:33
  2336. ProviderName : googledrivefs31931
  2337. Id : 1
  2338. LevelDisplayName : Information
  2339. Message : Link created: "\DosDevices\G:"
  2340.  
  2341. TimeCreated : 06/09/2025 10:02:33
  2342. ProviderName : googledrivefs31931
  2343. Id : 1
  2344. LevelDisplayName : Information
  2345. Message : Link created: "\??\Volume{ba56d176-8af7-11f0-b653-8d129e426ec3}"
  2346.  
  2347. TimeCreated : 06/09/2025 10:02:33
  2348. ProviderName : googledrivefs31931
  2349. Id : 1
  2350. LevelDisplayName : Information
  2351. Message : Returning suggested name: "\DosDevices\G:"
  2352.  
  2353. TimeCreated : 06/09/2025 10:02:33
  2354. ProviderName : googledrivefs31931
  2355. Id : 1
  2356. LevelDisplayName : Information
  2357. Message : Mount manager is querying for desired drive letter. ForceDriveLetterAutoAssignment = 0
  2358.  
  2359. TimeCreated : 06/09/2025 10:02:33
  2360. ProviderName : googledrivefs31931
  2361. Id : 1
  2362. LevelDisplayName : Information
  2363. Message : Starting FCB garbage collector with 2000 ms interval.
  2364.  
  2365. TimeCreated : 06/09/2025 10:02:33
  2366. ProviderName : googledrivefs31931
  2367. Id : 1
  2368. LevelDisplayName : Information
  2369. Message : Mount entry found: \DosDevices\G: -> \Device\Volume{f5ae2bcb-da01-3bf2-8935-408102040811}
  2370.  
  2371. TimeCreated : 06/09/2025 10:02:33
  2372. ProviderName : googledrivefs31931
  2373. Id : 1
  2374. LevelDisplayName : Information
  2375. Message : Found entry with matching device name: \Device\Volume{f5ae2bcb-da01-3bf2-8935-408102040811}
  2376.  
  2377. TimeCreated : 06/09/2025 10:02:33
  2378. ProviderName : googledrivefs31931
  2379. Id : 1
  2380. LevelDisplayName : Information
  2381. Message : Finding mount entry; lockGlobal = 1; mount point = .
  2382.  
  2383. TimeCreated : 06/09/2025 10:02:33
  2384. ProviderName : googledrivefs31931
  2385. Id : 1
  2386. LevelDisplayName : Information
  2387. Message : 5-408102040811}"
  2388.  
  2389. TimeCreated : 06/09/2025 10:02:33
  2390. ProviderName : googledrivefs31931
  2391. Id : 1
  2392. LevelDisplayName : Information
  2393. Message : Mounting volume using MountPoint "\DosDevices\G:" device "\Device\Volume{f5ae2bcb-da01-3bf2-893
  2394.  
  2395. TimeCreated : 06/09/2025 10:02:33
  2396. ProviderName : googledrivefs31931
  2397. Id : 1
  2398. LevelDisplayName : Information
  2399. Message : Event start using mount ID: 1; device name: \Volume{f5ae2bcb-da01-3bf2-8935-408102040811}.
  2400.  
  2401. TimeCreated : 06/09/2025 10:02:33
  2402. ProviderName : googledrivefs31931
  2403. Id : 1
  2404. LevelDisplayName : Information
  2405. Message : Inserted new mount entry.
  2406.  
  2407. TimeCreated : 06/09/2025 10:02:33
  2408. ProviderName : googledrivefs31931
  2409. Id : 1
  2410. LevelDisplayName : Information
  2411. Message : ume{f5ae2bcb-da01-3bf2-8935-408102040811}" created
  2412.  
  2413. TimeCreated : 06/09/2025 10:02:33
  2414. ProviderName : googledrivefs31931
  2415. Id : 1
  2416. LevelDisplayName : Information
  2417. Message : SymbolicLink: "\DosDevices\Global\Volume{f5ae2bcb-da01-3bf2-8935-408102040811}" -> "\Device\Vol
  2418.  
  2419. TimeCreated : 06/09/2025 10:02:33
  2420. ProviderName : googledrivefs31931
  2421. Id : 1
  2422. LevelDisplayName : Information
  2423. Message : ; type: 8
  2424.  
  2425. TimeCreated : 06/09/2025 10:02:33
  2426. ProviderName : googledrivefs31931
  2427. Id : 1
  2428. LevelDisplayName : Information
  2429. Message : \DosDevices\Global\Volume{f5ae2bcb-da01-3bf2-8935-408102040811}"; mount point: "\DosDevices\G:"
  2430.  
  2431. TimeCreated : 06/09/2025 10:02:33
  2432. ProviderName : googledrivefs31931
  2433. Id : 1
  2434. LevelDisplayName : Information
  2435. Message : disk device name: "\Device\Volume{f5ae2bcb-da01-3bf2-8935-408102040811}"; symbolic link name: "
  2436.  
  2437. TimeCreated : 06/09/2025 10:02:33
  2438. ProviderName : googledrivefs31931
  2439. Id : 1
  2440. LevelDisplayName : Information
  2441. Message : Set volume security descriptor successfully.
  2442.  
  2443. TimeCreated : 06/09/2025 10:02:33
  2444. ProviderName : googledrivefs31931
  2445. Id : 1
  2446. LevelDisplayName : Information
  2447. Message : Creating disk device; mount point = G; mount ID = 1l
  2448.  
  2449. TimeCreated : 06/09/2025 10:02:33
  2450. ProviderName : googledrivefs31931
  2451. Id : 1
  2452. LevelDisplayName : Information
  2453. Message : No mount entry found.
  2454.  
  2455. TimeCreated : 06/09/2025 10:02:33
  2456. ProviderName : googledrivefs31931
  2457. Id : 1
  2458. LevelDisplayName : Information
  2459. Message : Finding mount entry; lockGlobal = 0; mount point = \DosDevices\G:.
  2460.  
  2461. TimeCreated : 06/09/2025 10:02:33
  2462. ProviderName : googledrivefs31931
  2463. Id : 1
  2464. LevelDisplayName : Information
  2465. Message : Entered event start.
  2466.  
  2467. TimeCreated : 06/09/2025 10:02:23
  2468. ProviderName : Microsoft-Windows-Search
  2469. Id : 1003
  2470. LevelDisplayName : Information
  2471. Message : The Windows Search Service started.
  2472.  
  2473.  
  2474. TimeCreated : 06/09/2025 10:02:20
  2475. ProviderName : Microsoft-Windows-CertificateServicesClient-CertEnroll
  2476. Id : 86
  2477. LevelDisplayName : Error
  2478. Message : SCEP Certificate enrollment initialization for WORKGROUP\DESKTOP-098P9D8$ via https://AMD-KeyId-578c545f796951421221a4a578acdb5f682f89c8.microsoftaik.azure.net/templates/Aik/scep failed:
  2479.  
  2480. GetCACaps
  2481. GetCACaps: Not Found
  2482. {"Message":"The authority \"amd-keyid-578c545f796951421221a4a578acdb5f682f89c8.microsoftaik.azure.net\" does not exist."}
  2483. HTTP/1.1 404 Not Found
  2484. Date: Sat, 06 Sep 2025 08:02:22 GMT
  2485. Content-Length: 121
  2486. Content-Type: application/json; charset=utf-8
  2487. X-Content-Type-Options: nosniff
  2488. Strict-Transport-Security: max-age=31536000;includeSubDomains
  2489. x-ms-request-id: 6a715b79-4c6f-4139-b25f-3e5b740a2456
  2490.  
  2491. Method: GET(265ms)
  2492. Stage: GetCACaps
  2493. Not found (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)
  2494.  
  2495. TimeCreated : 06/09/2025 10:02:20
  2496. ProviderName : Microsoft-Windows-CertificateServicesClient-CertEnroll
  2497. Id : 57
  2498. LevelDisplayName : Error
  2499. Message : The "Microsoft Pluton Cryptographic Provider" provider was not loaded because initialization failed.
  2500.  
  2501. TimeCreated : 06/09/2025 10:02:18
  2502. ProviderName : Service Control Manager
  2503. Id : 7045
  2504. LevelDisplayName : Information
  2505. Message : A service was installed in the system.
  2506.  
  2507. Service Name: HWiNFO Kernel Driver (v206)
  2508. Service File Name: C:\Users\tovot\AppData\Local\Temp\HWiNFO_x64_206.sys
  2509. Service Type: kernel mode driver
  2510. Service Start Type: demand start
  2511. Service Account:
  2512.  
  2513. TimeCreated : 06/09/2025 10:02:17
  2514. ProviderName : Microsoft-Windows-TPM-WMI
  2515. Id : 1025
  2516. LevelDisplayName : Information
  2517. Message : The TPM was successfully provisioned and is now ready for use.
  2518.  
  2519. TimeCreated : 06/09/2025 10:02:17
  2520. ProviderName : Microsoft-Windows-CertificateServicesClient-CertEnroll
  2521. Id : 86
  2522. LevelDisplayName : Error
  2523. Message : SCEP Certificate enrollment initialization for Local system via https://AMD-KeyId-578c545f796951421221a4a578acdb5f682f89c8.microsoftaik.azure.net/templates/Aik/scep failed:
  2524.  
  2525. GetCACaps
  2526. GetCACaps: Not Found
  2527. {"Message":"The authority \"amd-keyid-578c545f796951421221a4a578acdb5f682f89c8.microsoftaik.azure.net\" does not exist."}
  2528. HTTP/1.1 404 Not Found
  2529. Date: Sat, 06 Sep 2025 08:02:19 GMT
  2530. Content-Length: 121
  2531. Content-Type: application/json; charset=utf-8
  2532. X-Content-Type-Options: nosniff
  2533. Strict-Transport-Security: max-age=31536000;includeSubDomains
  2534. x-ms-request-id: e7998504-4e0a-4850-92b4-0e9825c3e5bf
  2535.  
  2536. Method: GET(609ms)
  2537. Stage: GetCACaps
  2538. Not found (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)
  2539.  
  2540. TimeCreated : 06/09/2025 10:02:17
  2541. ProviderName : Microsoft-Windows-CertificateServicesClient-CertEnroll
  2542. Id : 57
  2543. LevelDisplayName : Error
  2544. Message : The "Microsoft Pluton Cryptographic Provider" provider was not loaded because initialization failed.
  2545.  
  2546. TimeCreated : 06/09/2025 10:02:16
  2547. ProviderName : Microsoft-Windows-TPM-WMI
  2548. Id : 1282
  2549. LevelDisplayName : Information
  2550. Message : The TBS device identifier has been generated.
  2551.  
  2552. TimeCreated : 06/09/2025 10:02:15
  2553. ProviderName : Service Control Manager
  2554. Id : 7045
  2555. LevelDisplayName : Information
  2556. Message : A service was installed in the system.
  2557.  
  2558. Service Name: MagicianSataModeReader
  2559. Service File Name: C:\Program Files (x86)\Samsung\Samsung Magician/magdrvamd64.sys
  2560. Service Type: kernel mode driver
  2561. Service Start Type: demand start
  2562. Service Account:
  2563.  
  2564. TimeCreated : 06/09/2025 10:02:10
  2565. ProviderName : Microsoft-Windows-Winlogon
  2566. Id : 6000
  2567. LevelDisplayName : Information
  2568. Message : The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.
  2569.  
  2570. TimeCreated : 06/09/2025 10:02:10
  2571. ProviderName : Microsoft-Windows-HttpService
  2572. Id : 112
  2573. LevelDisplayName : Information
  2574. Message : Attempted to reserve URL http://+:80/116B50EB-ECE2-41ac-8429-9F9E963361B7/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  2575.  
  2576. TimeCreated : 06/09/2025 10:02:10
  2577. ProviderName : Microsoft-Windows-HttpService
  2578. Id : 112
  2579. LevelDisplayName : Information
  2580. Message : Attempted to reserve URL https://+:443/C574AC30-5794-4AEE-B1BB-6651C5315029/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  2581.  
  2582. TimeCreated : 06/09/2025 10:02:10
  2583. ProviderName : Microsoft-Windows-HttpService
  2584. Id : 112
  2585. LevelDisplayName : Information
  2586. Message : Attempted to reserve URL http://+:80/0131501b-d67f-491b-9a40-c4bf27bcb4d4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  2587.  
  2588. TimeCreated : 06/09/2025 10:02:10
  2589. ProviderName : Microsoft-Windows-HttpService
  2590. Id : 112
  2591. LevelDisplayName : Information
  2592. Message : Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  2593.  
  2594. TimeCreated : 06/09/2025 10:02:10
  2595. ProviderName : Microsoft-Windows-HttpService
  2596. Id : 112
  2597. LevelDisplayName : Information
  2598. Message : Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  2599.  
  2600. TimeCreated : 06/09/2025 10:02:10
  2601. ProviderName : Microsoft-Windows-HttpService
  2602. Id : 112
  2603. LevelDisplayName : Information
  2604. Message : Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  2605.  
  2606. TimeCreated : 06/09/2025 10:02:10
  2607. ProviderName : Microsoft-Windows-HttpService
  2608. Id : 112
  2609. LevelDisplayName : Information
  2610. Message : Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  2611.  
  2612. TimeCreated : 06/09/2025 10:02:10
  2613. ProviderName : Microsoft-Windows-HttpService
  2614. Id : 112
  2615. LevelDisplayName : Information
  2616. Message : Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  2617.  
  2618. TimeCreated : 06/09/2025 10:02:10
  2619. ProviderName : Microsoft-Windows-HttpService
  2620. Id : 112
  2621. LevelDisplayName : Information
  2622. Message : Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  2623.  
  2624. TimeCreated : 06/09/2025 10:02:10
  2625. ProviderName : Microsoft-Windows-HttpService
  2626. Id : 112
  2627. LevelDisplayName : Information
  2628. Message : Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  2629.  
  2630. TimeCreated : 06/09/2025 10:02:10
  2631. ProviderName : Microsoft-Windows-HttpService
  2632. Id : 112
  2633. LevelDisplayName : Information
  2634. Message : Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  2635.  
  2636. TimeCreated : 06/09/2025 10:02:10
  2637. ProviderName : Microsoft-Windows-HttpService
  2638. Id : 112
  2639. LevelDisplayName : Information
  2640. Message : Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  2641.  
  2642. TimeCreated : 06/09/2025 10:02:10
  2643. ProviderName : Microsoft-Windows-HttpService
  2644. Id : 112
  2645. LevelDisplayName : Information
  2646. Message : Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  2647.  
  2648. TimeCreated : 06/09/2025 10:02:10
  2649. ProviderName : Microsoft-Windows-HttpService
  2650. Id : 112
  2651. LevelDisplayName : Information
  2652. Message : Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  2653.  
  2654. TimeCreated : 06/09/2025 10:02:10
  2655. ProviderName : Microsoft-Windows-HttpService
  2656. Id : 112
  2657. LevelDisplayName : Information
  2658. Message : Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  2659.  
  2660. TimeCreated : 06/09/2025 10:02:09
  2661. ProviderName : TPM
  2662. Id : 18
  2663. LevelDisplayName : Information
  2664. Message : This event triggers the Trusted Platform Module (TPM) provisioning/status check to run.
  2665.  
  2666. TimeCreated : 06/09/2025 10:02:09
  2667. ProviderName : Service Control Manager
  2668. Id : 7026
  2669. LevelDisplayName : Information
  2670. Message : The following boot-start or system-start driver(s) did not load:
  2671. dam
  2672.  
  2673. TimeCreated : 06/09/2025 10:01:54
  2674. ProviderName : Microsoft-Windows-TPM-WMI
  2675. Id : 1038
  2676. LevelDisplayName : Information
  2677. Message : Pre-attestation health checks confirm that the device is expected to pass attestation.
  2678. Please see C:\WINDOWS\Logs\MeasuredBoot\0000000333-0000000000.json for detailed information on what checks were made.
  2679.  
  2680. TimeCreated : 06/09/2025 10:01:54
  2681. ProviderName : Microsoft-Windows-TPM-WMI
  2682. Id : 1041
  2683. LevelDisplayName : Information
  2684. Message : Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":true,"ValueFromTcgLog":true,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]}
  2685.  
  2686. TimeCreated : 06/09/2025 10:01:53
  2687. ProviderName : Microsoft-Windows-Search
  2688. Id : 1013
  2689. LevelDisplayName : Information
  2690. Message : Windows Search Service stopped normally.
  2691.  
  2692.  
  2693. TimeCreated : 06/09/2025 10:01:53
  2694. ProviderName : Service Control Manager
  2695. Id : 7031
  2696. LevelDisplayName : Error
  2697. Message : The WSearch service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
  2698.  
  2699. TimeCreated : 06/09/2025 10:01:53
  2700. ProviderName : Service Control Manager
  2701. Id : 7023
  2702. LevelDisplayName : Error
  2703. Message : The WSearch service terminated with the following error:
  2704. A specified logon session does not exist. It may already have been terminated.
  2705.  
  2706. TimeCreated : 06/09/2025 10:01:53
  2707. ProviderName : Novabench Service
  2708. Id : 0
  2709. LevelDisplayName : Information
  2710. Message : Service started successfully.
  2711.  
  2712. TimeCreated : 06/09/2025 10:01:53
  2713. ProviderName : edgeupdate
  2714. Id : 0
  2715. LevelDisplayName : Information
  2716. Message : Service stopped.
  2717.  
  2718. TimeCreated : 06/09/2025 10:01:53
  2719. ProviderName : Microsoft-Windows-UserModePowerService
  2720. Id : 12
  2721. LevelDisplayName : Information
  2722. Message : Process C:\Windows\System32\DriverStore\FileRepository\u0417877.inf_amd64_8b2c2b61b3f8a9e5\B417004\atieclxx.exe (process ID:2264) reset policy scheme from {b0432ffb-84c5-4086-bab1-643de75d6e75} to {b0432ffb-84c5-4086-bab1-643de75d6e75}
  2723.  
  2724. TimeCreated : 06/09/2025 10:01:52
  2725. ProviderName : RtkAudioUniversalService
  2726. Id : 0
  2727. LevelDisplayName :
  2728. Message :
  2729.  
  2730. TimeCreated : 06/09/2025 10:01:52
  2731. ProviderName : Microsoft-Windows-Winlogon
  2732. Id : 6003
  2733. LevelDisplayName : Information
  2734. Message : The winlogon notification subscriber <SessionEnv> was unavailable to handle a critical notification event.
  2735.  
  2736. TimeCreated : 06/09/2025 10:01:52
  2737. ProviderName : Microsoft-Windows-Winlogon
  2738. Id : 7001
  2739. LevelDisplayName : Information
  2740. Message : User Logon Notification for Customer Experience Improvement Program
  2741.  
  2742. TimeCreated : 06/09/2025 10:01:52
  2743. ProviderName : Service Control Manager
  2744. Id : 7001
  2745. LevelDisplayName : Error
  2746. Message : The CloudflareWARP service depends on the WlanSvc service which failed to start because of the following error:
  2747. The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
  2748.  
  2749. TimeCreated : 06/09/2025 10:01:51
  2750. ProviderName : Microsoft-Windows-DHCPv6-Client
  2751. Id : 51046
  2752. LevelDisplayName : Information
  2753. Message : DHCPv6 client service is started
  2754.  
  2755. TimeCreated : 06/09/2025 10:01:51
  2756. ProviderName : Microsoft-Windows-Dhcp-Client
  2757. Id : 50036
  2758. LevelDisplayName : Information
  2759. Message : DHCPv4 client service is started
  2760.  
  2761. TimeCreated : 06/09/2025 10:01:51
  2762. ProviderName : Microsoft-Windows-Dhcp-Client
  2763. Id : 50103
  2764. LevelDisplayName : Information
  2765. Message : DHCPv4 client registered for shutdown notification
  2766.  
  2767. TimeCreated : 06/09/2025 10:01:51
  2768. ProviderName : Microsoft-Windows-Dhcp-Client
  2769. Id : 50036
  2770. LevelDisplayName : Information
  2771. Message : DHCPv4 client service is started
  2772.  
  2773. TimeCreated : 06/09/2025 10:01:51
  2774. ProviderName : Microsoft-Windows-Hyper-V-VmSwitch
  2775. Id : 277
  2776. LevelDisplayName : Information
  2777. Message : vmswitch.sys build 26100.amd64.ge_release_svc_prod1, debug false, official true, 1 1
  2778.  
  2779. TimeCreated : 06/09/2025 10:01:51
  2780. ProviderName : Microsoft-Windows-WMI
  2781. Id : 5617
  2782. LevelDisplayName : Information
  2783. Message : Windows Management Instrumentation Service subsystems initialized successfully
  2784.  
  2785. TimeCreated : 06/09/2025 10:01:51
  2786. ProviderName : Microsoft-Windows-WMI
  2787. Id : 5615
  2788. LevelDisplayName : Information
  2789. Message : Windows Management Instrumentation Service started sucessfully
  2790.  
  2791. TimeCreated : 06/09/2025 10:01:51
  2792. ProviderName : Microsoft-Windows-FilterManager
  2793. Id : 6
  2794. LevelDisplayName : Information
  2795. Message : File System Filter 'bindflt' (10.0, ‎2032‎-‎10‎-‎09T08:28:18.000000000Z) has successfully loaded and registered with Filter Manager.
  2796.  
  2797. TimeCreated : 06/09/2025 10:01:51
  2798. ProviderName : Microsoft-Windows-FilterManager
  2799. Id : 6
  2800. LevelDisplayName : Information
  2801. Message : File System Filter 'storqosflt' (10.0, ‎2021‎-‎03‎-‎19T12:47:34.000000000Z) has successfully loaded and registered with Filter Manager.
  2802.  
  2803. TimeCreated : 06/09/2025 10:01:51
  2804. ProviderName : Microsoft-Windows-FilterManager
  2805. Id : 6
  2806. LevelDisplayName : Information
  2807. Message : File System Filter 'UnionFS' (10.0, ‎2047‎-‎02‎-‎21T13:01:20.000000000Z) has successfully loaded and registered with Filter Manager.
  2808.  
  2809. TimeCreated : 06/09/2025 10:01:51
  2810. ProviderName : Microsoft-Windows-FilterManager
  2811. Id : 6
  2812. LevelDisplayName : Information
  2813. Message : File System Filter 'CldFlt' (10.0, ‎2066‎-‎10‎-‎18T01:52:14.000000000Z) has successfully loaded and registered with Filter Manager.
  2814.  
  2815. TimeCreated : 06/09/2025 10:01:51
  2816. ProviderName : Microsoft-Windows-FilterManager
  2817. Id : 1
  2818. LevelDisplayName : Information
  2819. Message : File System Filter 'CldFlt' (Version 10.0, ‎2066‎-‎10‎-‎18T01:52:14.000000000Z) unloaded successfully.
  2820.  
  2821. TimeCreated : 06/09/2025 10:01:51
  2822. ProviderName : Microsoft-Windows-FilterManager
  2823. Id : 6
  2824. LevelDisplayName : Information
  2825. Message : File System Filter 'CldFlt' (10.0, ‎2066‎-‎10‎-‎18T01:52:14.000000000Z) has successfully loaded and registered with Filter Manager.
  2826.  
  2827. TimeCreated : 06/09/2025 10:01:51
  2828. ProviderName : Microsoft-Windows-User Profiles Service
  2829. Id : 1531
  2830. LevelDisplayName : Information
  2831. Message : The User Profile Service has started successfully.
  2832.  
  2833.  
  2834.  
  2835. TimeCreated : 06/09/2025 10:01:51
  2836. ProviderName : Microsoft-Windows-EventSystem
  2837. Id : 4625
  2838. LevelDisplayName : Information
  2839. Message : The EventSystem sub system is suppressing duplicate event log entries for a duration of 86400 seconds. The suppression timeout can be controlled by a REG_DWORD value named SuppressDuplicateDuration under the following registry key: HKLM\Software\Microsoft\EventSystem\EventLog.
  2840.  
  2841. TimeCreated : 06/09/2025 10:01:51
  2842. ProviderName : Microsoft-Windows-FilterManager
  2843. Id : 6
  2844. LevelDisplayName : Information
  2845. Message : File System Filter 'luafv' (10.0, ‎2105‎-‎10‎-‎05T07:54:15.000000000Z) has successfully loaded and registered with Filter Manager.
  2846.  
  2847. TimeCreated : 06/09/2025 10:01:51
  2848. ProviderName : Microsoft-Windows-FilterManager
  2849. Id : 6
  2850. LevelDisplayName : Information
  2851. Message : File System Filter 'wcifs' (10.0, ‎2053‎-‎03‎-‎11T06:36:57.000000000Z) has successfully loaded and registered with Filter Manager.
  2852.  
  2853. TimeCreated : 06/09/2025 10:01:50
  2854. ProviderName : Microsoft-Windows-FilterManager
  2855. Id : 6
  2856. LevelDisplayName : Information
  2857. Message : File System Filter 'bfs' (10.0, ‎2101‎-‎07‎-‎17T22:54:57.000000000Z) has successfully loaded and registered with Filter Manager.
  2858.  
  2859. TimeCreated : 06/09/2025 10:01:50
  2860. ProviderName : Microsoft-Windows-Directory-Services-SAM
  2861. Id : 16983
  2862. LevelDisplayName : Information
  2863. Message : The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.
  2864.  
  2865. For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
  2866.  
  2867.  
  2868. TimeCreated : 06/09/2025 10:01:50
  2869. ProviderName : Microsoft-Windows-Directory-Services-SAM
  2870. Id : 16977
  2871. LevelDisplayName : Information
  2872. Message : The domain is configured with the following minimum password length-related settings.
  2873.  
  2874. MinimumPasswordLength: 0
  2875.  
  2876. RelaxMinimumPasswordLengthLimits: 0
  2877.  
  2878. MinimumPasswordLengthAudit: -1
  2879.  
  2880. For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
  2881.  
  2882.  
  2883. TimeCreated : 06/09/2025 10:01:50
  2884. ProviderName : Microsoft-Windows-Directory-Services-SAM
  2885. Id : 16962
  2886. LevelDisplayName : Information
  2887. Message : Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
  2888. For more information please see http://go.microsoft.com/fwlink/?LinkId=787651.
  2889.  
  2890. TimeCreated : 06/09/2025 10:01:50
  2891. ProviderName : LsaSrv
  2892. Id : 6156
  2893. LevelDisplayName : Information
  2894. Message : Credential Guard auto enablement status.
  2895.  
  2896. Hardware Requirements for Virtualization Based Security: 1
  2897. Domain Joined: 0
  2898. Azure AD Joined: 0
  2899. Licensed for Credential Guard: 0
  2900. Domain Controller: 0
  2901.  
  2902. TimeCreated : 06/09/2025 10:01:50
  2903. ProviderName : Microsoft-Windows-Wininit
  2904. Id : 12
  2905. LevelDisplayName : Information
  2906. Message : LSASS.exe was started as a protected process with level: 4.
  2907.  
  2908. TimeCreated : 06/09/2025 10:01:50
  2909. ProviderName : Microsoft-Windows-Wininit
  2910. Id : 14
  2911. LevelDisplayName : Information
  2912. Message : Credential Guard configuration:
  2913.  
  2914. Registry Configuration: 0x0
  2915. Test Configuration: 0
  2916. Auto Enablement: 0
  2917.  
  2918. TimeCreated : 06/09/2025 10:01:49
  2919. ProviderName : Microsoft-Windows-Wininit
  2920. Id : 23
  2921. LevelDisplayName : Information
  2922. Message : Boot App Anti-Rollback: Initialize Completed with status:
  2923. HRESULT: The operation completed successfully.
  2924. New timer needed: false
  2925. New timer waiting for system update completion: false
  2926. Previous latch timer exists but disabled by registry: false
  2927.  
  2928.  
  2929. TimeCreated : 06/09/2025 10:01:49
  2930. ProviderName : Microsoft-Windows-Wininit
  2931. Id : 25
  2932. LevelDisplayName : Information
  2933. Message : Boot App Anti-Rollback: Previous timer resumed with status:
  2934.  
  2935. HRESULT: The operation completed successfully.
  2936. Previous timer present: true
  2937. Start time: ‎2025‎-‎07‎-‎09T13:26:19.604845700Z
  2938. Grace period: 51840000000000
  2939. Attempted recovery enforcement succeeded: false
  2940.  
  2941.  
  2942. TimeCreated : 06/09/2025 10:01:49
  2943. ProviderName : Microsoft-Windows-Wininit
  2944. Id : 24
  2945. LevelDisplayName : Information
  2946. Message : Boot App Anti-Rollback: Timer start completed with status:
  2947.  
  2948. Win32Error: 0
  2949. Start time: ‎2025‎-‎07‎-‎09T13:26:19.604845700Z
  2950. Grace period: 51840000000000
  2951. Due time: ‎2025‎-‎09‎-‎07T13:26:19.604845700Z
  2952.  
  2953.  
  2954. TimeCreated : 06/09/2025 10:01:49
  2955. ProviderName : Microsoft-Windows-Wininit
  2956. Id : 19
  2957. LevelDisplayName : Information
  2958. Message : Virtualization Based Security new timer creation status
  2959.  
  2960. HRESULT: The operation completed successfully.
  2961. New latch timer needed: false
  2962. New latch timer waiting for system update completion: false
  2963. Previous latch timer exists but disabled by registry: false
  2964. Policy file exists: false
  2965.  
  2966.  
  2967. TimeCreated : 06/09/2025 10:01:47
  2968. ProviderName : Microsoft-Windows-Kernel-General
  2969. Id : 24
  2970. LevelDisplayName : Information
  2971. Message : The time zone information was refreshed with exit reason 0. Current time zone bias is -120.
  2972.  
  2973. TimeCreated : 06/09/2025 10:01:46
  2974. ProviderName : Microsoft-Windows-Ntfs
  2975. Id : 98
  2976. LevelDisplayName : Information
  2977. Message : Volume \\?\Volume{782f0bab-934f-418a-a308-f262a56c228a} (\Device\HarddiskVolume4) is healthy. No action is needed.
  2978.  
  2979. TimeCreated : 06/09/2025 10:01:46
  2980. ProviderName : Microsoft-Windows-Kernel-Processor-Power
  2981. Id : 55
  2982. LevelDisplayName : Information
  2983. Message : Processor 5 in group 0 exposes the following power management capabilities:
  2984.  
  2985. Idle state type: ACPI Idle (C) States (2 state(s))
  2986.  
  2987. Performance state type: ACPI Performance (P) / Throttle (T) States
  2988. Nominal Frequency (MHz): 3400
  2989. Maximum performance percentage: 100
  2990. Minimum performance percentage: 45
  2991. Minimum throttle percentage: 45
  2992.  
  2993. TimeCreated : 06/09/2025 10:01:46
  2994. ProviderName : Microsoft-Windows-Kernel-Processor-Power
  2995. Id : 55
  2996. LevelDisplayName : Information
  2997. Message : Processor 4 in group 0 exposes the following power management capabilities:
  2998.  
  2999. Idle state type: ACPI Idle (C) States (2 state(s))
  3000.  
  3001. Performance state type: ACPI Performance (P) / Throttle (T) States
  3002. Nominal Frequency (MHz): 3400
  3003. Maximum performance percentage: 100
  3004. Minimum performance percentage: 45
  3005. Minimum throttle percentage: 45
  3006.  
  3007. TimeCreated : 06/09/2025 10:01:46
  3008. ProviderName : Microsoft-Windows-Kernel-Processor-Power
  3009. Id : 55
  3010. LevelDisplayName : Information
  3011. Message : Processor 3 in group 0 exposes the following power management capabilities:
  3012.  
  3013. Idle state type: ACPI Idle (C) States (2 state(s))
  3014.  
  3015. Performance state type: ACPI Performance (P) / Throttle (T) States
  3016. Nominal Frequency (MHz): 3400
  3017. Maximum performance percentage: 100
  3018. Minimum performance percentage: 45
  3019. Minimum throttle percentage: 45
  3020.  
  3021. TimeCreated : 06/09/2025 10:01:46
  3022. ProviderName : Microsoft-Windows-Kernel-Processor-Power
  3023. Id : 55
  3024. LevelDisplayName : Information
  3025. Message : Processor 2 in group 0 exposes the following power management capabilities:
  3026.  
  3027. Idle state type: ACPI Idle (C) States (2 state(s))
  3028.  
  3029. Performance state type: ACPI Performance (P) / Throttle (T) States
  3030. Nominal Frequency (MHz): 3400
  3031. Maximum performance percentage: 100
  3032. Minimum performance percentage: 45
  3033. Minimum throttle percentage: 45
  3034.  
  3035. TimeCreated : 06/09/2025 10:01:46
  3036. ProviderName : Microsoft-Windows-Kernel-Processor-Power
  3037. Id : 55
  3038. LevelDisplayName : Information
  3039. Message : Processor 1 in group 0 exposes the following power management capabilities:
  3040.  
  3041. Idle state type: ACPI Idle (C) States (2 state(s))
  3042.  
  3043. Performance state type: ACPI Performance (P) / Throttle (T) States
  3044. Nominal Frequency (MHz): 3400
  3045. Maximum performance percentage: 100
  3046. Minimum performance percentage: 45
  3047. Minimum throttle percentage: 45
  3048.  
  3049. TimeCreated : 06/09/2025 10:01:46
  3050. ProviderName : Microsoft-Windows-Kernel-Processor-Power
  3051. Id : 55
  3052. LevelDisplayName : Information
  3053. Message : Processor 0 in group 0 exposes the following power management capabilities:
  3054.  
  3055. Idle state type: ACPI Idle (C) States (2 state(s))
  3056.  
  3057. Performance state type: ACPI Performance (P) / Throttle (T) States
  3058. Nominal Frequency (MHz): 3400
  3059. Maximum performance percentage: 100
  3060. Minimum performance percentage: 45
  3061. Minimum throttle percentage: 45
  3062.  
  3063. TimeCreated : 06/09/2025 10:01:45
  3064. ProviderName : Microsoft-Windows-Ntfs
  3065. Id : 98
  3066. LevelDisplayName : Information
  3067. Message : Volume E: (\Device\HarddiskVolume7) is healthy. No action is needed.
  3068.  
  3069. TimeCreated : 06/09/2025 10:01:45
  3070. ProviderName : Microsoft-Windows-Kernel-Power
  3071. Id : 172
  3072. LevelDisplayName : Information
  3073. Message : Connectivity state in standby: Disconnected, Reason: NIC compliance
  3074.  
  3075. TimeCreated : 06/09/2025 10:01:45
  3076. ProviderName : Microsoft-Windows-FilterManager
  3077. Id : 6
  3078. LevelDisplayName : Information
  3079. Message : File System Filter 'npsvctrig' (10.0, ‎1978‎-‎05‎-‎14T11:13:30.000000000Z) has successfully loaded and registered with Filter Manager.
  3080.  
  3081. TimeCreated : 06/09/2025 10:01:45
  3082. ProviderName : Microsoft-Windows-FilterManager
  3083. Id : 6
  3084. LevelDisplayName : Information
  3085. Message : File System Filter 'UCPD' (10.0, ‎2007‎-‎02‎-‎05T07:30:28.000000000Z) has successfully loaded and registered with Filter Manager.
  3086.  
  3087. TimeCreated : 06/09/2025 10:01:45
  3088. ProviderName : Microsoft-Windows-FilterManager
  3089. Id : 6
  3090. LevelDisplayName : Information
  3091. Message : File System Filter 'FileCrypt' (10.0, ‎2075‎-‎09‎-‎01T00:07:07.000000000Z) has successfully loaded and registered with Filter Manager.
  3092.  
  3093. TimeCreated : 06/09/2025 10:01:45
  3094. ProviderName : Microsoft-Windows-Ntfs
  3095. Id : 98
  3096. LevelDisplayName : Information
  3097. Message : Volume D: (\Device\HarddiskVolume6) is healthy. No action is needed.
  3098.  
  3099. TimeCreated : 06/09/2025 10:01:45
  3100. ProviderName : Microsoft-Windows-Ntfs
  3101. Id : 98
  3102. LevelDisplayName : Information
  3103. Message : Volume C: (\Device\HarddiskVolume3) is healthy. No action is needed.
  3104.  
  3105. TimeCreated : 06/09/2025 10:01:45
  3106. ProviderName : Microsoft-Windows-Ntfs
  3107. Id : 98
  3108. LevelDisplayName : Information
  3109. Message : Volume F: (\Device\HarddiskVolume5) is healthy. No action is needed.
  3110.  
  3111. TimeCreated : 06/09/2025 10:01:45
  3112. ProviderName : Microsoft-Windows-BitLocker-Driver
  3113. Id : 24709
  3114. LevelDisplayName : Information
  3115. Message : This event contains the boot-time final TPM PCR values and TCG log data.
  3116.  
  3117. TimeCreated : 06/09/2025 10:01:45
  3118. ProviderName : Microsoft-Windows-BitLocker-Driver
  3119. Id : 24709
  3120. LevelDisplayName : Information
  3121. Message : This event contains the boot-time final TPM PCR values and TCG log data.
  3122.  
  3123. TimeCreated : 06/09/2025 10:01:45
  3124. ProviderName : Microsoft-Windows-BitLocker-Driver
  3125. Id : 24709
  3126. LevelDisplayName : Information
  3127. Message : This event contains the boot-time final TPM PCR values and TCG log data.
  3128.  
  3129. TimeCreated : 06/09/2025 10:01:45
  3130. ProviderName : Microsoft-Windows-BitLocker-Driver
  3131. Id : 24711
  3132. LevelDisplayName : Information
  3133. Message : A V2 TPM protector was used to start Windows.
  3134. Binding ID: {e0f3b476-a73e-4425-805b-0c939f260e04}.
  3135.  
  3136. TimeCreated : 06/09/2025 10:01:45
  3137. ProviderName : Microsoft-Windows-BitLocker-Driver
  3138. Id : 24709
  3139. LevelDisplayName : Information
  3140. Message : This event contains the boot-time final TPM PCR values and TCG log data.
  3141.  
  3142. TimeCreated : 06/09/2025 10:01:44
  3143. ProviderName : Microsoft-Windows-FilterManager
  3144. Id : 6
  3145. LevelDisplayName : Information
  3146. Message : File System Filter 'WdFilter' (10.0, ‎2020‎-‎11‎-‎18T19:24:15.000000000Z) has successfully loaded and registered with Filter Manager.
  3147.  
  3148. TimeCreated : 06/09/2025 10:01:44
  3149. ProviderName : Microsoft-Windows-FilterManager
  3150. Id : 6
  3151. LevelDisplayName : Information
  3152. Message : File System Filter 'Wof' (10.0, ‎2033‎-‎09‎-‎03T01:41:44.000000000Z) has successfully loaded and registered with Filter Manager.
  3153.  
  3154. TimeCreated : 06/09/2025 10:01:44
  3155. ProviderName : Microsoft-Windows-FilterManager
  3156. Id : 6
  3157. LevelDisplayName : Information
  3158. Message : File System Filter 'FileInfo' (10.0, ‎2093‎-‎04‎-‎02T03:29:43.000000000Z) has successfully loaded and registered with Filter Manager.
  3159.  
  3160. TimeCreated : 06/09/2025 10:01:43
  3161. ProviderName : Microsoft-Windows-HAL
  3162. Id : 16
  3163. LevelDisplayName : Information
  3164. Message : IOMMU fault reporting has been initialized.
  3165.  
  3166. TimeCreated : 06/09/2025 10:01:43
  3167. ProviderName : Microsoft-Windows-Kernel-General
  3168. Id : 20
  3169. LevelDisplayName : Information
  3170. Message : The leap second configuration has been updated.
  3171. Reason: Leap second data initialized from registry during boot
  3172. Leap seconds enabled: true
  3173. New leap second count: 0
  3174. Old leap second count: 0
  3175.  
  3176. TimeCreated : 06/09/2025 10:01:43
  3177. ProviderName : Microsoft-Windows-Kernel-Boot
  3178. Id : 30
  3179. LevelDisplayName : Information
  3180. Message : The firmware reported boot metrics.
  3181.  
  3182. TimeCreated : 06/09/2025 10:01:43
  3183. ProviderName : Microsoft-Windows-Kernel-Boot
  3184. Id : 27
  3185. LevelDisplayName : Information
  3186. Message : The boot type was 0x0.
  3187.  
  3188. TimeCreated : 06/09/2025 10:01:43
  3189. ProviderName : Microsoft-Windows-Kernel-Boot
  3190. Id : 25
  3191. LevelDisplayName : Information
  3192. Message : The boot menu policy was 0x1.
  3193.  
  3194. TimeCreated : 06/09/2025 10:01:43
  3195. ProviderName : Microsoft-Windows-Kernel-Boot
  3196. Id : 238
  3197. LevelDisplayName : Information
  3198. Message : EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ‎2025‎-‎09‎-‎06T10:01:42.000000000Z.
  3199.  
  3200. TimeCreated : 06/09/2025 10:01:43
  3201. ProviderName : Microsoft-Windows-Kernel-Boot
  3202. Id : 247
  3203. LevelDisplayName : Information
  3204. Message : Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware.
  3205.  
  3206. TimeCreated : 06/09/2025 10:01:43
  3207. ProviderName : Microsoft-Windows-Kernel-Boot
  3208. Id : 20
  3209. LevelDisplayName : Information
  3210. Message : The last shutdown's success status was true. The last boot's success status was true.
  3211.  
  3212. TimeCreated : 06/09/2025 10:01:43
  3213. ProviderName : Microsoft-Windows-Kernel-Boot
  3214. Id : 32
  3215. LevelDisplayName : Information
  3216. Message : The bootmgr spent 0 ms waiting for user input.
  3217.  
  3218. TimeCreated : 06/09/2025 10:01:43
  3219. ProviderName : Microsoft-Windows-Kernel-Boot
  3220. Id : 18
  3221. LevelDisplayName : Information
  3222. Message : There are 0x1 boot options on this system.
  3223.  
  3224. TimeCreated : 06/09/2025 10:01:43
  3225. ProviderName : Microsoft-Windows-Kernel-Boot
  3226. Id : 153
  3227. LevelDisplayName : Information
  3228. Message : Virtualization-based security (policies: 0) is disabled.
  3229.  
  3230. TimeCreated : 06/09/2025 10:01:43
  3231. ProviderName : Microsoft-Windows-Kernel-General
  3232. Id : 25
  3233. LevelDisplayName : Information
  3234. Message : The system time was initialized to ‎2025‎-‎09‎-‎06T08:01:43.500000000Z.
  3235.  
  3236. Loader time: ‎2025‎-‎09‎-‎06T08:01:42.000000000Z
  3237. Internal boot flags: 0x2
  3238. HAL RTC error code: 0x0
  3239. RTC time is in UTC: false
  3240. Soft boot: false
  3241. Success: true
  3242. Phase: 0
  3243.  
  3244. TimeCreated : 06/09/2025 10:01:43
  3245. ProviderName : Microsoft-Windows-Kernel-General
  3246. Id : 12
  3247. LevelDisplayName : Information
  3248. Message : The operating system started at system time ‎2025‎-‎09‎-‎06T08:01:43.500000000Z.
  3249.  
  3250. TimeCreated : 06/09/2025 09:59:51
  3251. ProviderName : Microsoft-Windows-Kernel-General
  3252. Id : 13
  3253. LevelDisplayName : Information
  3254. Message : The operating system is shutting down at system time ‎2025‎-‎09‎-‎06T07:59:51.715350400Z.
  3255.  
  3256. TimeCreated : 06/09/2025 09:59:51
  3257. ProviderName : Microsoft-Windows-Kernel-Power
  3258. Id : 577
  3259. LevelDisplayName : Information
  3260. Message : The system has prepared for a system initiated reboot from Active.
  3261.  
  3262. TimeCreated : 06/09/2025 09:59:50
  3263. ProviderName : Microsoft-Windows-Kernel-Power
  3264. Id : 109
  3265. LevelDisplayName : Information
  3266. Message : The kernel power manager has initiated a shutdown transition.
  3267.  
  3268. Action: Power Action Reboot
  3269. Event Code: 0x0
  3270. Reason: Kernel API
  3271.  
  3272. TimeCreated : 06/09/2025 10:01:51
  3273. ProviderName : EventLog
  3274. Id : 6013
  3275. LevelDisplayName : Information
  3276. Message : The system uptime is 7 seconds.
  3277.  
  3278. TimeCreated : 06/09/2025 10:01:51
  3279. ProviderName : EventLog
  3280. Id : 6005
  3281. LevelDisplayName : Information
  3282. Message : The Event log service was started.
  3283.  
  3284. TimeCreated : 06/09/2025 10:01:51
  3285. ProviderName : EventLog
  3286. Id : 6009
  3287. LevelDisplayName : Information
  3288. Message : Microsoft (R) Windows (R) 10.00. 26100 Multiprocessor Free.
  3289.  
  3290. TimeCreated : 06/09/2025 09:59:50
  3291. ProviderName : Microsoft-Windows-Dhcp-Client
  3292. Id : 50037
  3293. LevelDisplayName : Information
  3294. Message : DHCPv4 client service is stopped. ShutDown Flag value is 1
  3295.  
  3296. TimeCreated : 06/09/2025 09:59:50
  3297. ProviderName : Microsoft-Windows-Dhcp-Client
  3298. Id : 50106
  3299. LevelDisplayName : Information
  3300. Message : DHCPv4 is waiting on DHCPv6 service to stop
  3301.  
  3302. TimeCreated : 06/09/2025 09:59:50
  3303. ProviderName : Microsoft-Windows-User Profiles Service
  3304. Id : 1532
  3305. LevelDisplayName : Information
  3306. Message : The User Profile Service has stopped.
  3307.  
  3308.  
  3309.  
  3310. TimeCreated : 06/09/2025 09:59:50
  3311. ProviderName : Microsoft-Windows-DHCPv6-Client
  3312. Id : 51057
  3313. LevelDisplayName : Information
  3314. Message : DHCPv6 client service stop is almost done.DHCP Context Ref count is 1
  3315.  
  3316. TimeCreated : 06/09/2025 09:59:50
  3317. ProviderName : Microsoft-Windows-DHCPv6-Client
  3318. Id : 51047
  3319. LevelDisplayName : Information
  3320. Message : DHCPv6 client service is stopped. ShutDown Flag value is 1
  3321.  
  3322. TimeCreated : 06/09/2025 09:59:50
  3323. ProviderName : Microsoft-Windows-Dhcp-Client
  3324. Id : 50105
  3325. LevelDisplayName : Information
  3326. Message : DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT
  3327.  
  3328. TimeCreated : 06/09/2025 09:59:50
  3329. ProviderName : Microsoft-Windows-Dhcp-Client
  3330. Id : 50104
  3331. LevelDisplayName : Information
  3332. Message : DHCPv4 client received shutdown notification
  3333.  
  3334. TimeCreated : 06/09/2025 09:59:50
  3335. ProviderName : EventLog
  3336. Id : 6006
  3337. LevelDisplayName : Information
  3338. Message : The Event log service was stopped.
  3339.  
  3340. TimeCreated : 06/09/2025 09:59:50
  3341. ProviderName : RtkAudioUniversalService
  3342. Id : 0
  3343. LevelDisplayName :
  3344. Message :
  3345.  
  3346. TimeCreated : 06/09/2025 09:59:48
  3347. ProviderName : Microsoft-Windows-Winlogon
  3348. Id : 7002
  3349. LevelDisplayName : Information
  3350. Message : User Logoff Notification for Customer Experience Improvement Program
  3351.  
  3352. TimeCreated : 06/09/2025 09:59:47
  3353. ProviderName : googledrivefs31931
  3354. Id : 1
  3355. LevelDisplayName : Information
  3356. Message : Finished event release.
  3357.  
  3358. TimeCreated : 06/09/2025 09:59:47
  3359. ProviderName : googledrivefs31931
  3360. Id : 1
  3361. LevelDisplayName : Information
  3362. Message : Finished deleting device.
  3363.  
  3364. TimeCreated : 06/09/2025 09:59:47
  3365. ProviderName : googledrivefs31931
  3366. Id : 1
  3367. LevelDisplayName : Information
  3368. Message : Deleting volume device object.
  3369.  
  3370. TimeCreated : 06/09/2025 09:59:47
  3371. ProviderName : googledrivefs31931
  3372. Id : 1
  3373. LevelDisplayName : Information
  3374. Message : Removing mount entry.
  3375.  
  3376. TimeCreated : 06/09/2025 09:59:47
  3377. ProviderName : googledrivefs31931
  3378. Id : 1
  3379. LevelDisplayName : Information
  3380. Message : Mount entry found: \DosDevices\G: -> \Device\Volume{f5ae2bcb-da01-3bf2-8935-408102040811}
  3381.  
  3382. TimeCreated : 06/09/2025 09:59:47
  3383. ProviderName : googledrivefs31931
  3384. Id : 1
  3385. LevelDisplayName : Information
  3386. Message : Found entry with matching device name: \Device\Volume{f5ae2bcb-da01-3bf2-8935-408102040811}
  3387.  
  3388. TimeCreated : 06/09/2025 09:59:47
  3389. ProviderName : googledrivefs31931
  3390. Id : 1
  3391. LevelDisplayName : Information
  3392. Message : Finding mount entry; lockGlobal = 1; mount point = .
  3393.  
  3394. TimeCreated : 06/09/2025 09:59:47
  3395. ProviderName : googledrivefs31931
  3396. Id : 1
  3397. LevelDisplayName : Information
  3398. Message : Deleting device object.
  3399.  
  3400. TimeCreated : 06/09/2025 09:59:47
  3401. ProviderName : googledrivefs31931
  3402. Id : 1
  3403. LevelDisplayName : Information
  3404. Message : Cleaning up all change notification waiters.
  3405.  
  3406. TimeCreated : 06/09/2025 09:59:47
  3407. ProviderName : googledrivefs31931
  3408. Id : 1
  3409. LevelDisplayName : Information
  3410. Message : Stopping FCB garbage collector.
  3411.  
  3412. TimeCreated : 06/09/2025 09:59:47
  3413. ProviderName : googledrivefs31931
  3414. Id : 1
  3415. LevelDisplayName : Information
  3416. Message : Starting unmount for device "\Device\Volume{f5ae2bcb-da01-3bf2-8935-408102040811}"
  3417.  
  3418. TimeCreated : 06/09/2025 09:59:47
  3419. ProviderName : googledrivefs31931
  3420. Id : 1
  3421. LevelDisplayName : Information
  3422. Message : Mount manager is disabled for this device or dokan initiated deletion; ignoring.
  3423.  
  3424. TimeCreated : 06/09/2025 09:59:47
  3425. ProviderName : googledrivefs31931
  3426. Id : 1
  3427. LevelDisplayName : Information
  3428. Message : Link deleted: "\DosDevices\G:"
  3429.  
  3430. TimeCreated : 06/09/2025 09:59:47
  3431. ProviderName : googledrivefs31931
  3432. Id : 1
  3433. LevelDisplayName : Information
  3434. Message : Mount manager is disabled for this device or dokan initiated deletion; ignoring.
  3435.  
  3436. TimeCreated : 06/09/2025 09:59:47
  3437. ProviderName : googledrivefs31931
  3438. Id : 1
  3439. LevelDisplayName : Information
  3440. Message : Link deleted: "\??\Volume{9fcfdd06-8af0-11f0-b652-913be9935957}"
  3441.  
  3442. TimeCreated : 06/09/2025 09:59:47
  3443. ProviderName : googledrivefs31931
  3444. Id : 1
  3445. LevelDisplayName : Information
  3446. Message : 40811}"
  3447.  
  3448. TimeCreated : 06/09/2025 09:59:47
  3449. ProviderName : googledrivefs31931
  3450. Id : 1
  3451. LevelDisplayName : Information
  3452. Message : Issuing a clean mount manager delete for device "\Device\Volume{f5ae2bcb-da01-3bf2-8935-4081020
  3453.  
  3454. TimeCreated : 06/09/2025 09:59:47
  3455. ProviderName : googledrivefs31931
  3456. Id : 1
  3457. LevelDisplayName : Information
  3458. Message : Entered event release.
  3459.  
  3460. TimeCreated : 06/09/2025 09:59:47
  3461. ProviderName : googledrivefs31931
  3462. Id : 1
  3463. LevelDisplayName : Information
  3464. Message : Unmounting due to keepalive close.
  3465.  
  3466. TimeCreated : 06/09/2025 09:59:46
  3467. ProviderName : Microsoft-Windows-Winsrv
  3468. Id : 10001
  3469. LevelDisplayName : Information
  3470. Message : The following application attempted to veto the shutdown: Process Governor.exe.
  3471.  
  3472. TimeCreated : 06/09/2025 09:59:46
  3473. ProviderName : Microsoft-Windows-Winsrv
  3474. Id : 10001
  3475. LevelDisplayName : Information
  3476. Message : The following application attempted to veto the shutdown: FanControl.exe.
  3477.  
  3478. TimeCreated : 06/09/2025 09:59:47
  3479. ProviderName : Microsoft-Windows-Winlogon
  3480. Id : 6000
  3481. LevelDisplayName : Information
  3482. Message : The winlogon notification subscriber <Wlansvc> was unavailable to handle a notification event.
  3483.  
  3484. TimeCreated : 06/09/2025 09:59:47
  3485. ProviderName : Microsoft-Windows-Winlogon
  3486. Id : 6000
  3487. LevelDisplayName : Information
  3488. Message : The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.
  3489.  
  3490. TimeCreated : 06/09/2025 09:59:47
  3491. ProviderName : Microsoft-Windows-Winlogon
  3492. Id : 6000
  3493. LevelDisplayName : Information
  3494. Message : The winlogon notification subscriber <WSearch> was unavailable to handle a notification event.
  3495.  
  3496. TimeCreated : 06/09/2025 09:59:46
  3497. ProviderName : User32
  3498. Id : 1074
  3499. LevelDisplayName : Information
  3500. Message : The process C:\Windows\System32\RuntimeBroker.exe (DESKTOP-098P9D8) has initiated the restart of computer DESKTOP-098P9D8 on behalf of user DESKTOP-098P9D8\tovot for the following reason: Other (Unplanned)
  3501. Reason Code: 0x0
  3502. Shutdown Type: restart
  3503. Comment:
  3504.  
  3505. TimeCreated : 06/09/2025 09:48:26
  3506. ProviderName : SecurityCenter
  3507. Id : 15
  3508. LevelDisplayName : Information
  3509. Message : Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.
  3510.  
  3511. TimeCreated : 06/09/2025 09:46:14
  3512. ProviderName : SecurityCenter
  3513. Id : 15
  3514. LevelDisplayName : Information
  3515. Message : Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.
  3516.  
  3517. TimeCreated : 06/09/2025 09:46:13
  3518. ProviderName : Microsoft-Windows-Time-Service
  3519. Id : 37
  3520. LevelDisplayName : Information
  3521. Message : The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->104.40.149.189:123).
  3522.  
  3523. TimeCreated : 06/09/2025 09:46:13
  3524. ProviderName : ESENT
  3525. Id : 326
  3526. LevelDisplayName : Information
  3527. Message : svchost (6860,D,50,0) DS_Token_DB: The database engine attached a database (1, C:\WINDOWS\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat). (Time=0 seconds)
  3528.  
  3529. Saved Cache: 1 0
  3530. Additional Data: lgposAttach = 00000037:000B:0268,
  3531. dbv = 1568.300.620 (9620)
  3532.  
  3533. Internal Timing Sequence:
  3534. [1] 0.000006 +J(0) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K)
  3535. [2] 0.001162 -0.000323 (1) WT +J(0) +M(C:0K, Fs:17, WS:4K # 8K, PF:4K # 4K, P:4K)
  3536. [3] 0.003888 -0.000568 (6) WT +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:3480/2) +M(C:0K, Fs:6, WS:20K # 0K, PF:20K # 0K, P:20K)
  3537. [4] 0.000942 +J(0)
  3538. [5] -
  3539. [6] 0.000480 -0.000411 (2) CM -0.000315 (2) WT +J(CM:2, PgRf:2, Rd:0/2, Dy:0/0, Lg:0/0) +M(C:0K, Fs:2, WS:8K # 0K, PF:0K # 0K, P:0K)
  3540. [7] 0.000002 +J(0)
  3541. [8] 0.000354 -0.000163 (1) CM -0.000121 (1) WT +J(CM:1, PgRf:1, Rd:4/1, Dy:0/0, Lg:0/0) +M(C:16K, Fs:24, WS:96K # 60K, PF:208K # 168K, P:208K)
  3542. [9] -
  3543. [10] -
  3544. [11] -
  3545. [12] 0.000011 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:54/1) +M(C:0K, Fs:1, WS:4K # 4K, PF:20K # 16K, P:20K)
  3546. [13] 0.000554 -0.000378 (3) CM -0.000233 (3) WT +J(CM:3, PgRf:23, Rd:0/3, Dy:0/0, Lg:0/0) +M(C:-8K, Fs:21, WS:76K # 76K, PF:-4K # 4K, P:-4K)
  3547. [14] 0.000431 -0.000317 (2) CM -0.000227 (2) WT +J(CM:2, PgRf:40, Rd:0/2, Dy:0/0, Lg:0/0) +M(C:0K, Fs:3, WS:12K # 12K, PF:64K # 56K, P:64K)
  3548. [15] 0.000183 -0.000151 (1) CM -0.000105 (1) WT +J(CM:1, PgRf:1, Rd:0/1, Dy:0/0, Lg:0/0)
  3549. [16] 0.000016 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:1, WS:4K # 4K, PF:0K # 0K, P:0K)
  3550. [17] 0.000261 -0.000181 (1) CM -0.000131 (1) WT +J(CM:1, PgRf:42, Rd:0/1, Dy:0/0, Lg:0/0) +M(C:0K, Fs:8, WS:32K # 32K, PF:0K # 0K, P:0K)
  3551. [18] 0.000001 +J(0)
  3552. [19] 0.0 +J(0)
  3553. [20] 0.000194 -0.000144 (1) CM -0.000098 (1) WT +J(CM:1, PgRf:3, Rd:0/1, Dy:0/0, Lg:0/0) +M(C:0K, Fs:3, WS:12K # 12K, PF:0K # 0K, P:0K).
  3554.  
  3555. TimeCreated : 06/09/2025 09:46:12
  3556. ProviderName : ESENT
  3557. Id : 105
  3558. LevelDisplayName : Information
  3559. Message : svchost (6860,D,0,0) DS_Token_DB: The database engine started a new instance (0). (Time=0.065 seconds)
  3560.  
  3561. Additional Data:
  3562. lgposV2[] = 00000037:0001:0000 - 00000037:0008:0039 - 00000037:0009:0000 - 00000037:0009:0000 (00000000:0000:0000)
  3563. cReInits = 2
  3564. RBSOn = 0
  3565.  
  3566.  
  3567. Internal Timing Sequence:
  3568. [1] 0.000684 +J(0) +M(C:0K, Fs:165, WS:640K # 640K, PF:2676K # 2676K, P:2676K)
  3569. [2] 0.000692 +J(0) +M(C:8K, Fs:194, WS:772K # 772K, PF:1244K # 1244K, P:1244K)
  3570. [3] 0.000017 +J(0) +M(C:0K, Fs:9, WS:28K # 28K, PF:68K # 68K, P:68K)
  3571. [4] 0.000188 +J(0) +M(C:0K, Fs:69, WS:276K # 276K, PF:172K # 172K, P:172K)
  3572. [5] 0.001752 +J(0) +M(C:0K, Fs:12, WS:48K # 48K, PF:20K # 20K, P:20K)
  3573. [6] 0.003293 +J(0) +M(C:0K, Fs:45, WS:180K # 180K, PF:12K # 12K, P:12K)
  3574. [7] 0.001751 -0.000537 (2) WT +J(0) +M(C:0K, Fs:40, WS:160K # 160K, PF:64K # 64K, P:64K)
  3575. [8] 0.039053 -0.006055 (12) WT +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:32448/22) +M(C:0K, Fs:148, WS:372K # 372K, PF:232K # 236K, P:232K)
  3576. [9] 0.000705 +J(0) +M(C:0K, Fs:13, WS:52K # 52K, PF:4K # 0K, P:4K)
  3577. [10] 0.001166 -0.000315 (1) WT +J(0) +M(C:0K, Fs:2, WS:-52K # 8K, PF:-60K # 0K, P:-60K)
  3578. [11] 0.000028 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:49/1) +M(C:0K, Fs:4, WS:16K # 0K, PF:0K # 0K, P:0K)
  3579. [12] 0.000072 +J(0)
  3580. [13] 0.014925 -0.000419 (2) CM -0.002812 (17) WT +J(CM:2, PgRf:2, Rd:0/2, Dy:0/0, Lg:8759/5) +M(C:0K, Fs:72, WS:176K # 196K, PF:172K # 180K, P:172K)
  3581. [14] 0.000015 +J(0)
  3582. [15] 0.000011 +J(0)
  3583. [16] 0.000708 -0.000119 (1) WT +J(0) +M(C:0K, Fs:2, WS:0K # 0K, PF:0K # 0K, P:0K).
  3584.  
  3585. TimeCreated : 06/09/2025 09:46:12
  3586. ProviderName : ESENT
  3587. Id : 302
  3588. LevelDisplayName : Information
  3589. Message : svchost (6860,U,98,0) DS_Token_DB: The database engine has successfully completed recovery steps.
  3590.  
  3591. TimeCreated : 06/09/2025 09:46:12
  3592. ProviderName : ESENT
  3593. Id : 301
  3594. LevelDisplayName : Information
  3595. Message : svchost (6860,R,98,0) DS_Token_DB: The database engine has finished replaying logfile C:\WINDOWS\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log.
  3596.  
  3597. Processing Stats:
  3598. [1] 0.010097 -0.002300 (8) WT +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:32448/22) +M(C:0K, Fs:91, WS:220K # 156K, PF:140K # 76K, P:140K).
  3599. Log record of type 'AttachDB ' was seen most frequently (2 times)
  3600.  
  3601. TimeCreated : 06/09/2025 09:46:12
  3602. ProviderName : Microsoft-Windows-Time-Service
  3603. Id : 158
  3604. LevelDisplayName : Information
  3605. Message : The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well.
  3606.  
  3607. TimeCreated : 06/09/2025 09:46:12
  3608. ProviderName : ESENT
  3609. Id : 300
  3610. LevelDisplayName : Information
  3611. Message : svchost (6860,R,98,0) DS_Token_DB: The database engine is initiating recovery steps.
  3612.  
  3613. TimeCreated : 06/09/2025 09:46:12
  3614. ProviderName : ESENT
  3615. Id : 102
  3616. LevelDisplayName : Information
  3617. Message : svchost (6860,P,98,0) DS_Token_DB: The database engine (10.00.26100.0000) is starting a new instance (0).
  3618.  
  3619. TimeCreated : 06/09/2025 09:45:46
  3620. ProviderName : Microsoft-Windows-WindowsUpdateClient
  3621. Id : 19
  3622. LevelDisplayName : Information
  3623. Message : Installation Successful: Windows successfully installed the following update: Update for Windows Security platform - KB5007651 (Version 10.0.27840.1000)
  3624.  
  3625. TimeCreated : 06/09/2025 09:45:44
  3626. ProviderName : Microsoft-Windows-WindowsUpdateClient
  3627. Id : 43
  3628. LevelDisplayName : Information
  3629. Message : Installation Started: Windows has started installing the following update: Update for Windows Security platform - KB5007651 (Version 10.0.27840.1000)
  3630.  
  3631. TimeCreated : 06/09/2025 09:37:57
  3632. ProviderName : Microsoft-Windows-Security-SPP
  3633. Id : 16384
  3634. LevelDisplayName : Information
  3635. Message : Successfully scheduled Software Protection service for re-start at 2125-08-13T07:37:57Z. Reason: RulesEngine.
  3636.  
  3637. TimeCreated : 06/09/2025 09:37:27
  3638. ProviderName : Microsoft-Windows-Security-SPP
  3639. Id : 16394
  3640. LevelDisplayName : Information
  3641. Message : Offline downlevel migration succeeded.
  3642.  
  3643. TimeCreated : 06/09/2025 09:23:03
  3644. ProviderName : Chrome
  3645. Id : 256
  3646. LevelDisplayName : Information
  3647. Message : [6040:6972:0906/092303.641:INFO:chrome\browser\extensions\extension_garbage_collector.cc:184] Garbage collection for extensions on file thread is complete.
  3648.  
  3649. TimeCreated : 06/09/2025 09:22:45
  3650. ProviderName : Microsoft-Windows-DistributedCOM
  3651. Id : 10016
  3652. LevelDisplayName : Warning
  3653. Message : The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
  3654. {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
  3655. and APPID
  3656. {15C20B67-12E7-4BB6-92BB-7AFF07997402}
  3657. to the user DESKTOP-098P9D8\tovot SID (S-1-5-21-69511818-2281423806-1859989881-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
  3658.  
  3659. TimeCreated : 06/09/2025 09:22:15
  3660. ProviderName : SecurityCenter
  3661. Id : 15
  3662. LevelDisplayName : Information
  3663. Message : Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.
  3664.  
  3665. TimeCreated : 06/09/2025 09:22:13
  3666. ProviderName : Microsoft-Windows-WindowsUpdateClient
  3667. Id : 19
  3668. LevelDisplayName : Information
  3669. Message : Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.435.615.0) - Current Channel (Broad)
  3670.  
  3671. TimeCreated : 06/09/2025 09:22:03
  3672. ProviderName : Microsoft-Windows-WindowsUpdateClient
  3673. Id : 43
  3674. LevelDisplayName : Information
  3675. Message : Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.435.615.0) - Current Channel (Broad)
  3676.  
  3677. TimeCreated : 06/09/2025 09:21:39
  3678. ProviderName : Microsoft-Windows-WindowsUpdateClient
  3679. Id : 44
  3680. LevelDisplayName : Information
  3681. Message : Windows Update started downloading an update.
  3682.  
  3683. TimeCreated : 06/09/2025 09:21:17
  3684. ProviderName : Microsoft-Windows-Kernel-General
  3685. Id : 16
  3686. LevelDisplayName : Information
  3687. Message : The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages.
  3688.  
  3689. TimeCreated : 06/09/2025 09:19:51
  3690. ProviderName : Microsoft-Windows-Security-SPP
  3691. Id : 16384
  3692. LevelDisplayName : Information
  3693. Message : Successfully scheduled Software Protection service for re-start at 2125-08-13T07:19:51Z. Reason: RulesEngine.
  3694.  
  3695. TimeCreated : 06/09/2025 09:19:21
  3696. ProviderName : Microsoft-Windows-Security-SPP
  3697. Id : 16394
  3698. LevelDisplayName : Information
  3699. Message : Offline downlevel migration succeeded.
  3700.  
  3701. TimeCreated : 06/09/2025 09:19:18
  3702. ProviderName : edgeupdate
  3703. Id : 0
  3704. LevelDisplayName : Information
  3705. Message : Service stopped.
  3706.  
  3707. TimeCreated : 06/09/2025 09:18:55
  3708. ProviderName : Microsoft-Windows-Security-SPP
  3709. Id : 16384
  3710. LevelDisplayName : Information
  3711. Message : Successfully scheduled Software Protection service for re-start at 2125-08-13T07:18:55Z. Reason: RulesEngine.
  3712.  
  3713. TimeCreated : 06/09/2025 09:18:19
  3714. ProviderName : Microsoft-Windows-Security-SPP
  3715. Id : 16394
  3716. LevelDisplayName : Information
  3717. Message : Offline downlevel migration succeeded.
  3718.  
  3719. TimeCreated : 06/09/2025 09:13:48
  3720. ProviderName : Microsoft-Windows-Security-SPP
  3721. Id : 16384
  3722. LevelDisplayName : Information
  3723. Message : Successfully scheduled Software Protection service for re-start at 2125-08-13T07:13:48Z. Reason: RulesEngine.
  3724.  
  3725. TimeCreated : 06/09/2025 09:13:20
  3726. ProviderName : SecurityCenter
  3727. Id : 15
  3728. LevelDisplayName : Information
  3729. Message : Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.
  3730.  
  3731. TimeCreated : 06/09/2025 09:13:18
  3732. ProviderName : SecurityCenter
  3733. Id : 1
  3734. LevelDisplayName : Information
  3735. Message : The Windows Security Center Service has started.
  3736.  
  3737. TimeCreated : 06/09/2025 09:13:18
  3738. ProviderName : Microsoft-Windows-DistributedCOM
  3739. Id : 10016
  3740. LevelDisplayName : Warning
  3741. Message : The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
  3742. Windows.SecurityCenter.WscDataProtection
  3743. and APPID
  3744. Unavailable
  3745. to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
  3746.  
  3747. TimeCreated : 06/09/2025 09:13:18
  3748. ProviderName : Microsoft-Windows-DistributedCOM
  3749. Id : 10016
  3750. LevelDisplayName : Warning
  3751. Message : The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
  3752. Windows.SecurityCenter.SecurityAppBroker
  3753. and APPID
  3754. Unavailable
  3755. to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
  3756.  
  3757. TimeCreated : 06/09/2025 09:13:18
  3758. ProviderName : Microsoft-Windows-DistributedCOM
  3759. Id : 10016
  3760. LevelDisplayName : Warning
  3761. Message : The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
  3762. Windows.SecurityCenter.WscBrokerManager
  3763. and APPID
  3764. Unavailable
  3765. to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
  3766.  
  3767. TimeCreated : 06/09/2025 09:13:18
  3768. ProviderName : Microsoft-Windows-Security-SPP
  3769. Id : 16394
  3770. LevelDisplayName : Information
  3771. Message : Offline downlevel migration succeeded.
  3772.  
  3773. TimeCreated : 06/09/2025 09:13:18
  3774. ProviderName : Microsoft-Windows-Security-SPP
  3775. Id : 900
  3776. LevelDisplayName : Information
  3777. Message : The Software Protection service is starting.
  3778. Parameters:<explicit>
  3779.  
  3780. TimeCreated : 06/09/2025 09:11:54
  3781. ProviderName : Service Control Manager
  3782. Id : 7000
  3783. LevelDisplayName : Error
  3784. Message : The R0FanControl service failed to start due to the following error:
  3785. Operation did not complete successfully because the file contains a virus or potentially unwanted software.
  3786.  
  3787. TimeCreated : 06/09/2025 09:11:54
  3788. ProviderName : Service Control Manager
  3789. Id : 7045
  3790. LevelDisplayName : Information
  3791. Message : A service was installed in the system.
  3792.  
  3793. Service Name: R0FanControl
  3794. Service File Name: C:\Program Files (x86)\FanControl\FanControl.sys
  3795. Service Type: kernel mode driver
  3796. Service Start Type: demand start
  3797. Service Account:
  3798.  
  3799. TimeCreated : 06/09/2025 09:11:52
  3800. ProviderName : Microsoft-Windows-Security-SPP
  3801. Id : 903
  3802. LevelDisplayName : Information
  3803. Message : The Software Protection service has stopped.
  3804.  
  3805.  
  3806. TimeCreated : 06/09/2025 09:11:52
  3807. ProviderName : Microsoft-Windows-Security-SPP
  3808. Id : 16384
  3809. LevelDisplayName : Information
  3810. Message : Successfully scheduled Software Protection service for re-start at 2125-08-13T07:11:52Z. Reason: RulesEngine.
  3811.  
  3812. TimeCreated : 06/09/2025 09:11:52
  3813. ProviderName : Service Control Manager
  3814. Id : 7000
  3815. LevelDisplayName : Error
  3816. Message : The R0FanControl service failed to start due to the following error:
  3817. Operation did not complete successfully because the file contains a virus or potentially unwanted software.
  3818.  
  3819. TimeCreated : 06/09/2025 09:11:52
  3820. ProviderName : Service Control Manager
  3821. Id : 7045
  3822. LevelDisplayName : Information
  3823. Message : A service was installed in the system.
  3824.  
  3825. Service Name: R0FanControl
  3826. Service File Name: C:\Program Files (x86)\FanControl\FanControl.sys
  3827. Service Type: kernel mode driver
  3828. Service Start Type: demand start
  3829. Service Account:
  3830.  
  3831. TimeCreated : 06/09/2025 09:11:45
  3832. ProviderName : googledrivefs31931
  3833. Id : 1
  3834. LevelDisplayName : Information
  3835. Message : Activating keepalive handle from process 11872.
  3836.  
  3837. TimeCreated : 06/09/2025 09:11:45
  3838. ProviderName : googledrivefs31931
  3839. Id : 1
  3840. LevelDisplayName : Information
  3841. Message : Opened keepalive file from process 11872.
  3842.  
  3843. TimeCreated : 06/09/2025 09:11:45
  3844. ProviderName : googledrivefs31931
  3845. Id : 1
  3846. LevelDisplayName : Information
  3847. Message : Opened file with user mode dispatch blocked: "\__drive_fs_keepalive"
  3848.  
  3849. TimeCreated : 06/09/2025 09:11:45
  3850. ProviderName : googledrivefs31931
  3851. Id : 1
  3852. LevelDisplayName : Information
  3853. Message : Handle created before IOCTL_EVENT_WAIT for file "(null)"
  3854.  
  3855. TimeCreated : 06/09/2025 09:11:45
  3856. ProviderName : googledrivefs31931
  3857. Id : 1
  3858. LevelDisplayName : Information
  3859. Message : Handle created before IOCTL_EVENT_WAIT for file "(null)"
  3860.  
  3861. TimeCreated : 06/09/2025 09:11:45
  3862. ProviderName : googledrivefs31931
  3863. Id : 1
  3864. LevelDisplayName : Information
  3865. Message : Finished event start with status 1 and flags: 0
  3866.  
  3867. TimeCreated : 06/09/2025 09:11:45
  3868. ProviderName : googledrivefs31931
  3869. Id : 1
  3870. LevelDisplayName : Information
  3871. Message : Returning actual mount point G
  3872.  
  3873. TimeCreated : 06/09/2025 09:11:45
  3874. ProviderName : googledrivefs31931
  3875. Id : 1
  3876. LevelDisplayName : Information
  3877. Message : Mounting successfully done.
  3878.  
  3879. TimeCreated : 06/09/2025 09:11:45
  3880. ProviderName : googledrivefs31931
  3881. Id : 1
  3882. LevelDisplayName : Information
  3883. Message : Link name matches the current one.
  3884.  
  3885. TimeCreated : 06/09/2025 09:11:45
  3886. ProviderName : googledrivefs31931
  3887. Id : 1
  3888. LevelDisplayName : Information
  3889. Message : Link created: "\DosDevices\G:"
  3890.  
  3891. TimeCreated : 06/09/2025 09:11:45
  3892. ProviderName : googledrivefs31931
  3893. Id : 1
  3894. LevelDisplayName : Information
  3895. Message : Link created: "\??\Volume{9fcfdd06-8af0-11f0-b652-913be9935957}"
  3896.  
  3897. TimeCreated : 06/09/2025 09:11:45
  3898. ProviderName : googledrivefs31931
  3899. Id : 1
  3900. LevelDisplayName : Information
  3901. Message : Starting FCB garbage collector with 2000 ms interval.
  3902.  
  3903. TimeCreated : 06/09/2025 09:11:45
  3904. ProviderName : googledrivefs31931
  3905. Id : 1
  3906. LevelDisplayName : Information
  3907. Message : Returning suggested name: "\DosDevices\G:"
  3908.  
  3909. TimeCreated : 06/09/2025 09:11:45
  3910. ProviderName : googledrivefs31931
  3911. Id : 1
  3912. LevelDisplayName : Information
  3913. Message : Mount manager is querying for desired drive letter. ForceDriveLetterAutoAssignment = 0
  3914.  
  3915. TimeCreated : 06/09/2025 09:11:45
  3916. ProviderName : googledrivefs31931
  3917. Id : 1
  3918. LevelDisplayName : Information
  3919. Message : Mount entry found: \DosDevices\G: -> \Device\Volume{f5ae2bcb-da01-3bf2-8935-408102040811}
  3920.  
  3921. TimeCreated : 06/09/2025 09:11:45
  3922. ProviderName : googledrivefs31931
  3923. Id : 1
  3924. LevelDisplayName : Information
  3925. Message : Found entry with matching device name: \Device\Volume{f5ae2bcb-da01-3bf2-8935-408102040811}
  3926.  
  3927. TimeCreated : 06/09/2025 09:11:45
  3928. ProviderName : googledrivefs31931
  3929. Id : 1
  3930. LevelDisplayName : Information
  3931. Message : Finding mount entry; lockGlobal = 1; mount point = .
  3932.  
  3933. TimeCreated : 06/09/2025 09:11:45
  3934. ProviderName : googledrivefs31931
  3935. Id : 1
  3936. LevelDisplayName : Information
  3937. Message : 5-408102040811}"
  3938.  
  3939. TimeCreated : 06/09/2025 09:11:45
  3940. ProviderName : googledrivefs31931
  3941. Id : 1
  3942. LevelDisplayName : Information
  3943. Message : Mounting volume using MountPoint "\DosDevices\G:" device "\Device\Volume{f5ae2bcb-da01-3bf2-893
  3944.  
  3945. TimeCreated : 06/09/2025 09:11:45
  3946. ProviderName : googledrivefs31931
  3947. Id : 1
  3948. LevelDisplayName : Information
  3949. Message : Event start using mount ID: 1; device name: \Volume{f5ae2bcb-da01-3bf2-8935-408102040811}.
  3950.  
  3951. TimeCreated : 06/09/2025 09:11:45
  3952. ProviderName : googledrivefs31931
  3953. Id : 1
  3954. LevelDisplayName : Information
  3955. Message : Inserted new mount entry.
  3956.  
  3957. TimeCreated : 06/09/2025 09:11:45
  3958. ProviderName : googledrivefs31931
  3959. Id : 1
  3960. LevelDisplayName : Information
  3961. Message : ume{f5ae2bcb-da01-3bf2-8935-408102040811}" created
  3962.  
  3963. TimeCreated : 06/09/2025 09:11:45
  3964. ProviderName : googledrivefs31931
  3965. Id : 1
  3966. LevelDisplayName : Information
  3967. Message : SymbolicLink: "\DosDevices\Global\Volume{f5ae2bcb-da01-3bf2-8935-408102040811}" -> "\Device\Vol
  3968.  
  3969. TimeCreated : 06/09/2025 09:11:45
  3970. ProviderName : googledrivefs31931
  3971. Id : 1
  3972. LevelDisplayName : Information
  3973. Message : ; type: 8
  3974.  
  3975. TimeCreated : 06/09/2025 09:11:45
  3976. ProviderName : googledrivefs31931
  3977. Id : 1
  3978. LevelDisplayName : Information
  3979. Message : \DosDevices\Global\Volume{f5ae2bcb-da01-3bf2-8935-408102040811}"; mount point: "\DosDevices\G:"
  3980.  
  3981. TimeCreated : 06/09/2025 09:11:45
  3982. ProviderName : googledrivefs31931
  3983. Id : 1
  3984. LevelDisplayName : Information
  3985. Message : disk device name: "\Device\Volume{f5ae2bcb-da01-3bf2-8935-408102040811}"; symbolic link name: "
  3986.  
  3987. TimeCreated : 06/09/2025 09:11:45
  3988. ProviderName : googledrivefs31931
  3989. Id : 1
  3990. LevelDisplayName : Information
  3991. Message : Set volume security descriptor successfully.
  3992.  
  3993. TimeCreated : 06/09/2025 09:11:45
  3994. ProviderName : googledrivefs31931
  3995. Id : 1
  3996. LevelDisplayName : Information
  3997. Message : Creating disk device; mount point = G; mount ID = 1l
  3998.  
  3999. TimeCreated : 06/09/2025 09:11:45
  4000. ProviderName : googledrivefs31931
  4001. Id : 1
  4002. LevelDisplayName : Information
  4003. Message : No mount entry found.
  4004.  
  4005. TimeCreated : 06/09/2025 09:11:45
  4006. ProviderName : googledrivefs31931
  4007. Id : 1
  4008. LevelDisplayName : Information
  4009. Message : Finding mount entry; lockGlobal = 0; mount point = \DosDevices\G:.
  4010.  
  4011. TimeCreated : 06/09/2025 09:11:45
  4012. ProviderName : googledrivefs31931
  4013. Id : 1
  4014. LevelDisplayName : Information
  4015. Message : Entered event start.
  4016.  
  4017. TimeCreated : 06/09/2025 09:11:31
  4018. ProviderName : Microsoft-Windows-CertificateServicesClient-CertEnroll
  4019. Id : 86
  4020. LevelDisplayName : Error
  4021. Message : SCEP Certificate enrollment initialization for WORKGROUP\DESKTOP-098P9D8$ via https://AMD-KeyId-578c545f796951421221a4a578acdb5f682f89c8.microsoftaik.azure.net/templates/Aik/scep failed:
  4022.  
  4023. GetCACaps
  4024. GetCACaps: Not Found
  4025. {"Message":"The authority \"amd-keyid-578c545f796951421221a4a578acdb5f682f89c8.microsoftaik.azure.net\" does not exist."}
  4026. HTTP/1.1 404 Not Found
  4027. Date: Sat, 06 Sep 2025 07:11:32 GMT
  4028. Content-Length: 121
  4029. Content-Type: application/json; charset=utf-8
  4030. X-Content-Type-Options: nosniff
  4031. Strict-Transport-Security: max-age=31536000;includeSubDomains
  4032. x-ms-request-id: d3e0a25b-f69d-463e-bdd3-c75b7a9da9ed
  4033.  
  4034. Method: GET(266ms)
  4035. Stage: GetCACaps
  4036. Not found (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)
  4037.  
  4038. TimeCreated : 06/09/2025 09:11:30
  4039. ProviderName : Microsoft-Windows-CertificateServicesClient-CertEnroll
  4040. Id : 57
  4041. LevelDisplayName : Error
  4042. Message : The "Microsoft Pluton Cryptographic Provider" provider was not loaded because initialization failed.
  4043.  
  4044. TimeCreated : 06/09/2025 09:11:27
  4045. ProviderName : Microsoft-Windows-CertificateServicesClient-CertEnroll
  4046. Id : 86
  4047. LevelDisplayName : Error
  4048. Message : SCEP Certificate enrollment initialization for WORKGROUP\DESKTOP-098P9D8$ via https://AMD-KeyId-578c545f796951421221a4a578acdb5f682f89c8.microsoftaik.azure.net/templates/Aik/scep failed:
  4049.  
  4050. GetCACaps
  4051. GetCACaps: Not Found
  4052. {"Message":"The authority \"amd-keyid-578c545f796951421221a4a578acdb5f682f89c8.microsoftaik.azure.net\" does not exist."}
  4053. HTTP/1.1 404 Not Found
  4054. Date: Sat, 06 Sep 2025 07:11:28 GMT
  4055. Content-Length: 121
  4056. Content-Type: application/json; charset=utf-8
  4057. X-Content-Type-Options: nosniff
  4058. Strict-Transport-Security: max-age=31536000;includeSubDomains
  4059. x-ms-request-id: 65f0397d-b1d6-4ac1-bfbb-358d4212cc7d
  4060.  
  4061. Method: GET(265ms)
  4062. Stage: GetCACaps
  4063. Not found (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)
  4064.  
  4065. TimeCreated : 06/09/2025 09:11:27
  4066. ProviderName : Microsoft-Windows-CertificateServicesClient-CertEnroll
  4067. Id : 57
  4068. LevelDisplayName : Error
  4069. Message : The "Microsoft Pluton Cryptographic Provider" provider was not loaded because initialization failed.
  4070.  
  4071. TimeCreated : 06/09/2025 09:11:26
  4072. ProviderName : Microsoft-Windows-TPM-WMI
  4073. Id : 1025
  4074. LevelDisplayName : Information
  4075. Message : The TPM was successfully provisioned and is now ready for use.
  4076.  
  4077. TimeCreated : 06/09/2025 09:11:26
  4078. ProviderName : Microsoft-Windows-CertificateServicesClient-CertEnroll
  4079. Id : 86
  4080. LevelDisplayName : Error
  4081. Message : SCEP Certificate enrollment initialization for Local system via https://AMD-KeyId-578c545f796951421221a4a578acdb5f682f89c8.microsoftaik.azure.net/templates/Aik/scep failed:
  4082.  
  4083. GetCACaps
  4084. GetCACaps: Not Found
  4085. {"Message":"The authority \"amd-keyid-578c545f796951421221a4a578acdb5f682f89c8.microsoftaik.azure.net\" does not exist."}
  4086. HTTP/1.1 404 Not Found
  4087. Date: Sat, 06 Sep 2025 07:11:27 GMT
  4088. Content-Length: 121
  4089. Content-Type: application/json; charset=utf-8
  4090. X-Content-Type-Options: nosniff
  4091. Strict-Transport-Security: max-age=31536000;includeSubDomains
  4092. x-ms-request-id: eda3db2b-3168-4291-9c28-1427534532cb
  4093.  
  4094. Method: GET(422ms)
  4095. Stage: GetCACaps
  4096. Not found (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)
  4097.  
  4098. TimeCreated : 06/09/2025 09:11:26
  4099. ProviderName : Service Control Manager
  4100. Id : 7045
  4101. LevelDisplayName : Information
  4102. Message : A service was installed in the system.
  4103.  
  4104. Service Name: HWiNFO Kernel Driver (v206)
  4105. Service File Name: C:\Users\tovot\AppData\Local\Temp\HWiNFO_x64_206.sys
  4106. Service Type: kernel mode driver
  4107. Service Start Type: demand start
  4108. Service Account:
  4109.  
  4110. TimeCreated : 06/09/2025 09:11:26
  4111. ProviderName : Microsoft-Windows-CertificateServicesClient-CertEnroll
  4112. Id : 57
  4113. LevelDisplayName : Error
  4114. Message : The "Microsoft Pluton Cryptographic Provider" provider was not loaded because initialization failed.
  4115.  
  4116. TimeCreated : 06/09/2025 09:11:25
  4117. ProviderName : Microsoft-Windows-TPM-WMI
  4118. Id : 1282
  4119. LevelDisplayName : Information
  4120. Message : The TBS device identifier has been generated.
  4121.  
  4122. TimeCreated : 06/09/2025 09:11:23
  4123. ProviderName : Microsoft-Windows-Kernel-General
  4124. Id : 16
  4125. LevelDisplayName : Information
  4126. Message : The access history in hive \??\C:\Users\tovot\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages.
  4127.  
  4128. TimeCreated : 06/09/2025 09:11:22
  4129. ProviderName : Service Control Manager
  4130. Id : 7045
  4131. LevelDisplayName : Information
  4132. Message : A service was installed in the system.
  4133.  
  4134. Service Name: MagicianSataModeReader
  4135. Service File Name: C:\Program Files (x86)\Samsung\Samsung Magician/magdrvamd64.sys
  4136. Service Type: kernel mode driver
  4137. Service Start Type: demand start
  4138. Service Account:
  4139.  
  4140. TimeCreated : 06/09/2025 09:11:22
  4141. ProviderName : Microsoft-Windows-Security-SPP
  4142. Id : 902
  4143. LevelDisplayName : Information
  4144. Message : The Software Protection service has started.
  4145. 10.0.26100.4946
  4146.  
  4147. TimeCreated : 06/09/2025 09:11:21
  4148. ProviderName : Microsoft-Windows-Security-SPP
  4149. Id : 1003
  4150. LevelDisplayName : Information
  4151. Message : The Software Protection service has completed licensing status check.
  4152. Application Id=55c92734-d682-4d71-983e-d6ec3f16059f
  4153. Licensing Status=
  4154. 1: 01eb852c-424d-4060-94b8-c10d799d7364, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4155. 2: 040fa323-92b1-4baf-97a2-5b67feaefddb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4156. 3: 0724cb7d-3437-4cb7-93cb-830375d0079d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4157. 4: 0ad2ac98-7bb9-4201-8d92-312299201369, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4158. 5: 19de9b2f-0166-4abb-9534-56ea69a80edb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4159. 6: 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4160. 7: 221a02da-e2a1-4b75-864c-0a4410a33fdf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4161. 8: 265f3fad-6a1c-4bdd-ae30-c75efa556ccb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4162. 9: 291ece0e-9c38-40ca-a9e1-32cc7ec19507, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4163. 10: 2936d1d2-913a-4542-b54e-ce5a602a2a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4164. 11: 2c293c26-a45a-4a2a-a350-c69a67097529, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4165. 12: 2de67392-b7a7-462a-b1ca-108dd189f588, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4166. 13: 2ffd8952-423e-4903-b993-72a1aa44cf82, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4167. 14: 30a42c86-b7a0-4a34-8c90-ff177cb2acb7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4168. 15: 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4169. 16: 3502365a-f88a-4ba4-822a-5769d3073b65, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4170. 17: 377333b1-8b5d-48d6-9679-1225c872d37c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4171. 18: 3df374ef-d444-4494-a5a1-4b0d9fd0e203, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4172. 19: 3ebce241-ea87-4946-8a4f-80d00e921dff, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4173. 20: 3f1afc82-f8ac-4f6c-8005-1d233e606eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4174. 21: 4322a811-697c-44dc-865e-3e2fdcb86009, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4175. 22: 49cd895b-53b2-4dc4-a5f7-b18aa019ad37, 1, 1 [(0 )(1 )(2 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(3 )]
  4176. 23: 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4177. 24: 4f3da0d2-271d-4508-ae81-626b60809a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4178. 25: 5d78c4e9-aeb3-4b40-8ac2-6a6005e0ad6d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4179. 26: 60b3ec1b-9545-4921-821f-311b129dd6f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4180. 27: 613d217f-7f13-4268-9907-1662339531cd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4181. 28: 62f0c100-9c53-4e02-b886-a3528ddfe7f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4182. 29: 6365275e-368d-46ca-a0ef-fc0404119333, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4183. 30: 721f9237-9341-4453-a661-09e8baa6cca5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4184. 31: 73111121-5638-40f6-bc11-f1d7b0d64300, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4185. 32: 7a802526-4c94-4bd1-ba14-835a1aca2120, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4186. 33: 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4187. 34: 80083eae-7031-4394-9e88-4901973d56fe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4188. 35: 82bbc092-bc50-4e16-8e18-b74fc486aec3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4189. 36: 8ab9bdd1-1f67-4997-82d9-8878520837d9, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4190. 37: 8b351c9c-f398-4515-9900-09df49427262, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4191. 38: 90da7373-1c51-430b-bf26-c97e9c5cdc31, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4192. 39: 92fb8726-92a8-4ffc-94ce-f82e07444653, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4193. 40: 95dca82f-385d-4d39-b85b-5c73fa285d6f, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4194. 41: 97cde3ae-e908-4b59-ac96-a17645c5b57e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4195. 42: a48938aa-62fa-4966-9d44-9f04da3f72f2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4196. 43: b0773a15-df3a-4312-9ad2-83d69648e356, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4197. 44: b4bfe195-541e-4e64-ad23-6177f19e395e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4198. 45: b68e61d2-68ca-4757-be45-0cc2f3e68eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4199. 46: bd3762d7-270d-4760-8fb3-d829ca45278a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4200. 47: c86d5194-4840-4dae-9c1c-0301003a5ab0, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4201. 48: ca7df2e3-5ea0-47b8-9ac1-b1be4d8edd69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4202. 49: d552befb-48cc-4327-8f39-47d2d94f987c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4203. 50: d6eadb3b-5ca8-4a6b-986e-35b550756111, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4204. 51: df96023b-dcd9-4be2-afa0-c6c871159ebe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4205. 52: e0c42288-980c-4788-a014-c080d2e1926e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4206. 53: e4db50ea-bda1-4566-b047-0ca50abc6f07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4207. 54: e558417a-5123-4f6f-91e7-385c1c7ca9d4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4208. 55: e7a950a2-e548-4f10-bf16-02ec848e0643, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4209. 56: eb6d346f-1c60-4643-b960-40ec31596c45, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4210. 57: ec868e65-fadf-4759-b23e-93fe37f2cc29, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4211. 58: ef51e000-2659-4f25-8345-3de70a9cf4c4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4212. 59: f7af7d09-40e4-419c-a49b-eae366689ebd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4213. 60: fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4214. 61: fe74f55b-0338-41d6-b267-4a201abe7285, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]
  4215.  
  4216.  
  4217.  
  4218. TimeCreated : 06/09/2025 09:11:21
  4219. ProviderName : Microsoft-Windows-Security-SPP
  4220. Id : 1066
  4221. LevelDisplayName : Information
  4222. Message : Initialization status for service objects.
  4223. C:\WINDOWS\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
  4224. C:\WINDOWS\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000
  4225. C:\WINDOWS\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
  4226. C:\WINDOWS\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000
  4227. C:\WINDOWS\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000
  4228. C:\WINDOWS\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
  4229. C:\WINDOWS\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000
  4230. C:\WINDOWS\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
  4231. C:\WINDOWS\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000
  4232.  
  4233.  
  4234. TimeCreated : 06/09/2025 09:11:21
  4235. ProviderName : Microsoft-Windows-Security-SPP
  4236. Id : 16394
  4237. LevelDisplayName : Information
  4238. Message : Offline downlevel migration succeeded.
  4239.  
  4240. TimeCreated : 06/09/2025 09:11:21
  4241. ProviderName : Microsoft-Windows-Security-SPP
  4242. Id : 900
  4243. LevelDisplayName : Information
  4244. Message : The Software Protection service is starting.
  4245. Parameters:TriggerStarted:6
  4246.  
  4247. TimeCreated : 06/09/2025 09:11:18
  4248. ProviderName : TPM
  4249. Id : 18
  4250. LevelDisplayName : Information
  4251. Message : This event triggers the Trusted Platform Module (TPM) provisioning/status check to run.
  4252.  
  4253. TimeCreated : 06/09/2025 09:11:18
  4254. ProviderName : Service Control Manager
  4255. Id : 7026
  4256. LevelDisplayName : Information
  4257. Message : The following boot-start or system-start driver(s) did not load:
  4258. dam
  4259.  
  4260. TimeCreated : 06/09/2025 09:11:18
  4261. ProviderName : Microsoft-Windows-Winlogon
  4262. Id : 6000
  4263. LevelDisplayName : Information
  4264. Message : The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.
  4265.  
  4266. TimeCreated : 06/09/2025 09:11:07
  4267. ProviderName : Microsoft-Windows-HttpService
  4268. Id : 112
  4269. LevelDisplayName : Information
  4270. Message : Attempted to reserve URL http://+:80/116B50EB-ECE2-41ac-8429-9F9E963361B7/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  4271.  
  4272. TimeCreated : 06/09/2025 09:11:07
  4273. ProviderName : Microsoft-Windows-HttpService
  4274. Id : 112
  4275. LevelDisplayName : Information
  4276. Message : Attempted to reserve URL https://+:443/C574AC30-5794-4AEE-B1BB-6651C5315029/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  4277.  
  4278. TimeCreated : 06/09/2025 09:11:07
  4279. ProviderName : Microsoft-Windows-HttpService
  4280. Id : 112
  4281. LevelDisplayName : Information
  4282. Message : Attempted to reserve URL http://+:80/0131501b-d67f-491b-9a40-c4bf27bcb4d4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  4283.  
  4284. TimeCreated : 06/09/2025 09:11:07
  4285. ProviderName : Microsoft-Windows-HttpService
  4286. Id : 112
  4287. LevelDisplayName : Information
  4288. Message : Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  4289.  
  4290. TimeCreated : 06/09/2025 09:11:07
  4291. ProviderName : Microsoft-Windows-HttpService
  4292. Id : 112
  4293. LevelDisplayName : Information
  4294. Message : Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  4295.  
  4296. TimeCreated : 06/09/2025 09:11:07
  4297. ProviderName : Microsoft-Windows-HttpService
  4298. Id : 112
  4299. LevelDisplayName : Information
  4300. Message : Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  4301.  
  4302. TimeCreated : 06/09/2025 09:11:07
  4303. ProviderName : Microsoft-Windows-HttpService
  4304. Id : 112
  4305. LevelDisplayName : Information
  4306. Message : Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  4307.  
  4308. TimeCreated : 06/09/2025 09:11:07
  4309. ProviderName : Microsoft-Windows-HttpService
  4310. Id : 112
  4311. LevelDisplayName : Information
  4312. Message : Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  4313.  
  4314. TimeCreated : 06/09/2025 09:11:07
  4315. ProviderName : Microsoft-Windows-HttpService
  4316. Id : 112
  4317. LevelDisplayName : Information
  4318. Message : Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  4319.  
  4320. TimeCreated : 06/09/2025 09:11:07
  4321. ProviderName : Microsoft-Windows-HttpService
  4322. Id : 112
  4323. LevelDisplayName : Information
  4324. Message : Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  4325.  
  4326. TimeCreated : 06/09/2025 09:11:07
  4327. ProviderName : Microsoft-Windows-HttpService
  4328. Id : 112
  4329. LevelDisplayName : Information
  4330. Message : Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  4331.  
  4332. TimeCreated : 06/09/2025 09:11:07
  4333. ProviderName : Microsoft-Windows-HttpService
  4334. Id : 112
  4335. LevelDisplayName : Information
  4336. Message : Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  4337.  
  4338. TimeCreated : 06/09/2025 09:11:07
  4339. ProviderName : Microsoft-Windows-HttpService
  4340. Id : 112
  4341. LevelDisplayName : Information
  4342. Message : Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  4343.  
  4344. TimeCreated : 06/09/2025 09:11:07
  4345. ProviderName : Microsoft-Windows-HttpService
  4346. Id : 112
  4347. LevelDisplayName : Information
  4348. Message : Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  4349.  
  4350. TimeCreated : 06/09/2025 09:11:07
  4351. ProviderName : Microsoft-Windows-HttpService
  4352. Id : 112
  4353. LevelDisplayName : Information
  4354. Message : Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18
  4355.  
  4356. TimeCreated : 06/09/2025 09:11:04
  4357. ProviderName : Microsoft-Windows-TPM-WMI
  4358. Id : 1038
  4359. LevelDisplayName : Information
  4360. Message : Pre-attestation health checks confirm that the device is expected to pass attestation.
  4361. Please see C:\WINDOWS\Logs\MeasuredBoot\0000000332-0000000000.json for detailed information on what checks were made.
  4362.  
  4363. TimeCreated : 06/09/2025 09:11:04
  4364. ProviderName : Microsoft-Windows-TPM-WMI
  4365. Id : 1041
  4366. LevelDisplayName : Information
  4367. Message : Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":true,"ValueFromTcgLog":true,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]}
  4368.  
  4369. TimeCreated : 06/09/2025 09:11:02
  4370. ProviderName : Novabench Service
  4371. Id : 0
  4372. LevelDisplayName : Information
  4373. Message : Service started successfully.
  4374.  
  4375. TimeCreated : 06/09/2025 09:11:02
  4376. ProviderName : Microsoft-Windows-Search
  4377. Id : 1003
  4378. LevelDisplayName : Information
  4379. Message : The Windows Search Service started.
  4380.  
  4381.  
  4382. TimeCreated : 06/09/2025 09:11:02
  4383. ProviderName : Microsoft-Windows-UserModePowerService
  4384. Id : 12
  4385. LevelDisplayName : Information
  4386. Message : Process C:\Windows\System32\DriverStore\FileRepository\u0417877.inf_amd64_8b2c2b61b3f8a9e5\B417004\atieclxx.exe (process ID:2340) reset policy scheme from {b0432ffb-84c5-4086-bab1-643de75d6e75} to {b0432ffb-84c5-4086-bab1-643de75d6e75}
  4387.  
  4388. TimeCreated : 06/09/2025 09:11:01
  4389. ProviderName : edgeupdate
  4390. Id : 0
  4391. LevelDisplayName : Information
  4392. Message : Service stopped.
  4393.  
  4394. TimeCreated : 06/09/2025 09:11:01
  4395. ProviderName : Microsoft-Windows-Winlogon
  4396. Id : 6003
  4397. LevelDisplayName : Information
  4398. Message : The winlogon notification subscriber <SessionEnv> was unavailable to handle a critical notification event.
  4399.  
  4400. TimeCreated : 06/09/2025 09:11:01
  4401. ProviderName : Microsoft-Windows-Winlogon
  4402. Id : 7001
  4403. LevelDisplayName : Information
  4404. Message : User Logon Notification for Customer Experience Improvement Program
  4405.  
  4406. TimeCreated : 06/09/2025 09:11:01
  4407. ProviderName : Service Control Manager
  4408. Id : 7001
  4409. LevelDisplayName : Error
  4410. Message : The CloudflareWARP service depends on the WlanSvc service which failed to start because of the following error:
  4411. The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
  4412.  
  4413. TimeCreated : 06/09/2025 09:11:00
  4414. ProviderName : Microsoft-Windows-DHCPv6-Client
  4415. Id : 51046
  4416. LevelDisplayName : Information
  4417. Message : DHCPv6 client service is started
  4418.  
  4419. TimeCreated : 06/09/2025 09:11:00
  4420. ProviderName : Microsoft-Windows-Dhcp-Client
  4421. Id : 50036
  4422. LevelDisplayName : Information
  4423. Message : DHCPv4 client service is started
  4424.  
  4425. TimeCreated : 06/09/2025 09:11:00
  4426. ProviderName : Microsoft-Windows-Dhcp-Client
  4427. Id : 50103
  4428. LevelDisplayName : Information
  4429. Message : DHCPv4 client registered for shutdown notification
  4430.  
  4431. TimeCreated : 06/09/2025 09:11:00
  4432. ProviderName : Microsoft-Windows-Dhcp-Client
  4433. Id : 50036
  4434. LevelDisplayName : Information
  4435. Message : DHCPv4 client service is started
  4436.  
  4437. TimeCreated : 06/09/2025 09:11:00
  4438. ProviderName : Microsoft-Windows-WMI
  4439. Id : 5617
  4440. LevelDisplayName : Information
  4441. Message : Windows Management Instrumentation Service subsystems initialized successfully
  4442.  
  4443. TimeCreated : 06/09/2025 09:11:01
  4444. ProviderName : RtkAudioUniversalService
  4445. Id : 0
  4446. LevelDisplayName :
  4447. Message :
  4448.  
  4449. TimeCreated : 06/09/2025 09:11:00
  4450. ProviderName : Microsoft-Windows-Hyper-V-VmSwitch
  4451. Id : 277
  4452. LevelDisplayName : Information
  4453. Message : vmswitch.sys build 26100.amd64.ge_release_svc_prod1, debug false, official true, 1 1
  4454.  
  4455. TimeCreated : 06/09/2025 09:10:59
  4456. ProviderName : Microsoft-Windows-WMI
  4457. Id : 5615
  4458. LevelDisplayName : Information
  4459. Message : Windows Management Instrumentation Service started sucessfully
  4460.  
  4461. TimeCreated : 06/09/2025 09:10:59
  4462. ProviderName : Microsoft-Windows-FilterManager
  4463. Id : 6
  4464. LevelDisplayName : Information
  4465. Message : File System Filter 'bindflt' (10.0, ‎2032‎-‎10‎-‎09T08:28:18.000000000Z) has successfully loaded and registered with Filter Manager.
  4466.  
  4467. TimeCreated : 06/09/2025 09:10:59
  4468. ProviderName : Microsoft-Windows-FilterManager
  4469. Id : 6
  4470. LevelDisplayName : Information
  4471. Message : File System Filter 'storqosflt' (10.0, ‎2021‎-‎03‎-‎19T12:47:34.000000000Z) has successfully loaded and registered with Filter Manager.
  4472.  
  4473. TimeCreated : 06/09/2025 09:10:59
  4474. ProviderName : Microsoft-Windows-FilterManager
  4475. Id : 6
  4476. LevelDisplayName : Information
  4477. Message : File System Filter 'UnionFS' (10.0, ‎2047‎-‎02‎-‎21T13:01:20.000000000Z) has successfully loaded and registered with Filter Manager.
  4478.  
  4479. TimeCreated : 06/09/2025 09:10:59
  4480. ProviderName : Microsoft-Windows-User Profiles Service
  4481. Id : 1531
  4482. LevelDisplayName : Information
  4483. Message : The User Profile Service has started successfully.
  4484.  
  4485.  
  4486.  
  4487. TimeCreated : 06/09/2025 09:11:00
  4488. ProviderName : Microsoft-Windows-EventSystem
  4489. Id : 4625
  4490. LevelDisplayName : Information
  4491. Message : The EventSystem sub system is suppressing duplicate event log entries for a duration of 86400 seconds. The suppression timeout can be controlled by a REG_DWORD value named SuppressDuplicateDuration under the following registry key: HKLM\Software\Microsoft\EventSystem\EventLog.
  4492.  
  4493. TimeCreated : 06/09/2025 09:10:59
  4494. ProviderName : Microsoft-Windows-FilterManager
  4495. Id : 6
  4496. LevelDisplayName : Information
  4497. Message : File System Filter 'CldFlt' (10.0, ‎2066‎-‎10‎-‎18T01:52:14.000000000Z) has successfully loaded and registered with Filter Manager.
  4498.  
  4499. TimeCreated : 06/09/2025 09:10:59
  4500. ProviderName : Microsoft-Windows-FilterManager
  4501. Id : 1
  4502. LevelDisplayName : Information
  4503. Message : File System Filter 'CldFlt' (Version 10.0, ‎2066‎-‎10‎-‎18T01:52:14.000000000Z) unloaded successfully.
  4504.  
  4505. TimeCreated : 06/09/2025 09:10:59
  4506. ProviderName : Microsoft-Windows-FilterManager
  4507. Id : 6
  4508. LevelDisplayName : Information
  4509. Message : File System Filter 'CldFlt' (10.0, ‎2066‎-‎10‎-‎18T01:52:14.000000000Z) has successfully loaded and registered with Filter Manager.
  4510.  
  4511. TimeCreated : 06/09/2025 09:10:59
  4512. ProviderName : Microsoft-Windows-FilterManager
  4513. Id : 6
  4514. LevelDisplayName : Information
  4515. Message : File System Filter 'luafv' (10.0, ‎2105‎-‎10‎-‎05T07:54:15.000000000Z) has successfully loaded and registered with Filter Manager.
  4516.  
  4517. TimeCreated : 06/09/2025 09:10:59
  4518. ProviderName : Microsoft-Windows-FilterManager
  4519. Id : 6
  4520. LevelDisplayName : Information
  4521. Message : File System Filter 'wcifs' (10.0, ‎2053‎-‎03‎-‎11T06:36:57.000000000Z) has successfully loaded and registered with Filter Manager.
  4522.  
  4523. TimeCreated : 06/09/2025 09:10:59
  4524. ProviderName : Microsoft-Windows-FilterManager
  4525. Id : 6
  4526. LevelDisplayName : Information
  4527. Message : File System Filter 'bfs' (10.0, ‎2101‎-‎07‎-‎17T22:54:57.000000000Z) has successfully loaded and registered with Filter Manager.
  4528.  
  4529. TimeCreated : 06/09/2025 09:10:59
  4530. ProviderName : Microsoft-Windows-Directory-Services-SAM
  4531. Id : 16983
  4532. LevelDisplayName : Information
  4533. Message : The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.
  4534.  
  4535. For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
  4536.  
  4537.  
  4538. TimeCreated : 06/09/2025 09:10:59
  4539. ProviderName : Microsoft-Windows-Directory-Services-SAM
  4540. Id : 16977
  4541. LevelDisplayName : Information
  4542. Message : The domain is configured with the following minimum password length-related settings.
  4543.  
  4544. MinimumPasswordLength: 0
  4545.  
  4546. RelaxMinimumPasswordLengthLimits: 0
  4547.  
  4548. MinimumPasswordLengthAudit: -1
  4549.  
  4550. For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
  4551.  
  4552.  
  4553. TimeCreated : 06/09/2025 09:10:59
  4554. ProviderName : Microsoft-Windows-Directory-Services-SAM
  4555. Id : 16962
  4556. LevelDisplayName : Information
  4557. Message : Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
  4558. For more information please see http://go.microsoft.com/fwlink/?LinkId=787651.
  4559.  
  4560. TimeCreated : 06/09/2025 09:10:59
  4561. ProviderName : LsaSrv
  4562. Id : 6156
  4563. LevelDisplayName : Information
  4564. Message : Credential Guard auto enablement status.
  4565.  
  4566. Hardware Requirements for Virtualization Based Security: 1
  4567. Domain Joined: 0
  4568. Azure AD Joined: 0
  4569. Licensed for Credential Guard: 0
  4570. Domain Controller: 0
  4571.  
  4572. TimeCreated : 06/09/2025 09:10:58
  4573. ProviderName : Microsoft-Windows-Wininit
  4574. Id : 12
  4575. LevelDisplayName : Information
  4576. Message : LSASS.exe was started as a protected process with level: 4.
  4577.  
  4578. TimeCreated : 06/09/2025 09:10:58
  4579. ProviderName : Microsoft-Windows-Wininit
  4580. Id : 14
  4581. LevelDisplayName : Information
  4582. Message : Credential Guard configuration:
  4583.  
  4584. Registry Configuration: 0x0
  4585. Test Configuration: 0
  4586. Auto Enablement: 0
  4587.  
  4588. TimeCreated : 06/09/2025 09:10:58
  4589. ProviderName : Microsoft-Windows-Wininit
  4590. Id : 23
  4591. LevelDisplayName : Information
  4592. Message : Boot App Anti-Rollback: Initialize Completed with status:
  4593. HRESULT: The operation completed successfully.
  4594. New timer needed: false
  4595. New timer waiting for system update completion: false
  4596. Previous latch timer exists but disabled by registry: false
  4597.  
  4598.  
  4599. TimeCreated : 06/09/2025 09:10:58
  4600. ProviderName : Microsoft-Windows-Wininit
  4601. Id : 25
  4602. LevelDisplayName : Information
  4603. Message : Boot App Anti-Rollback: Previous timer resumed with status:
  4604.  
  4605. HRESULT: The operation completed successfully.
  4606. Previous timer present: true
  4607. Start time: ‎2025‎-‎07‎-‎09T13:26:19.604845700Z
  4608. Grace period: 51840000000000
  4609. Attempted recovery enforcement succeeded: false
  4610.  
  4611.  
  4612. TimeCreated : 06/09/2025 09:10:58
  4613. ProviderName : Microsoft-Windows-Wininit
  4614. Id : 24
  4615. LevelDisplayName : Information
  4616. Message : Boot App Anti-Rollback: Timer start completed with status:
  4617.  
  4618. Win32Error: 0
  4619. Start time: ‎2025‎-‎07‎-‎09T13:26:19.604845700Z
  4620. Grace period: 51840000000000
  4621. Due time: ‎2025‎-‎09‎-‎07T13:26:19.604845700Z
  4622.  
  4623.  
  4624. TimeCreated : 06/09/2025 09:10:58
  4625. ProviderName : Microsoft-Windows-Wininit
  4626. Id : 19
  4627. LevelDisplayName : Information
  4628. Message : Virtualization Based Security new timer creation status
  4629.  
  4630. HRESULT: The operation completed successfully.
  4631. New latch timer needed: false
  4632. New latch timer waiting for system update completion: false
  4633. Previous latch timer exists but disabled by registry: false
  4634. Policy file exists: false
  4635.  
  4636.  
  4637. TimeCreated : 06/09/2025 09:10:56
  4638. ProviderName : Microsoft-Windows-Kernel-General
  4639. Id : 24
  4640. LevelDisplayName : Information
  4641. Message : The time zone information was refreshed with exit reason 0. Current time zone bias is -120.
  4642.  
  4643. TimeCreated : 06/09/2025 09:10:55
  4644. ProviderName : Microsoft-Windows-Ntfs
  4645. Id : 98
  4646. LevelDisplayName : Information
  4647. Message : Volume \\?\Volume{782f0bab-934f-418a-a308-f262a56c228a} (\Device\HarddiskVolume4) is healthy. No action is needed.
  4648.  
  4649. TimeCreated : 06/09/2025 09:10:55
  4650. ProviderName : Microsoft-Windows-Kernel-Processor-Power
  4651. Id : 55
  4652. LevelDisplayName : Information
  4653. Message : Processor 5 in group 0 exposes the following power management capabilities:
  4654.  
  4655. Idle state type: ACPI Idle (C) States (2 state(s))
  4656.  
  4657. Performance state type: ACPI Performance (P) / Throttle (T) States
  4658. Nominal Frequency (MHz): 3400
  4659. Maximum performance percentage: 100
  4660. Minimum performance percentage: 45
  4661. Minimum throttle percentage: 45
  4662.  
  4663. TimeCreated : 06/09/2025 09:10:55
  4664. ProviderName : Microsoft-Windows-Kernel-Processor-Power
  4665. Id : 55
  4666. LevelDisplayName : Information
  4667. Message : Processor 4 in group 0 exposes the following power management capabilities:
  4668.  
  4669. Idle state type: ACPI Idle (C) States (2 state(s))
  4670.  
  4671. Performance state type: ACPI Performance (P) / Throttle (T) States
  4672. Nominal Frequency (MHz): 3400
  4673. Maximum performance percentage: 100
  4674. Minimum performance percentage: 45
  4675. Minimum throttle percentage: 45
  4676.  
  4677. TimeCreated : 06/09/2025 09:10:55
  4678. ProviderName : Microsoft-Windows-Kernel-Processor-Power
  4679. Id : 55
  4680. LevelDisplayName : Information
  4681. Message : Processor 3 in group 0 exposes the following power management capabilities:
  4682.  
  4683. Idle state type: ACPI Idle (C) States (2 state(s))
  4684.  
  4685. Performance state type: ACPI Performance (P) / Throttle (T) States
  4686. Nominal Frequency (MHz): 3400
  4687. Maximum performance percentage: 100
  4688. Minimum performance percentage: 45
  4689. Minimum throttle percentage: 45
  4690.  
  4691. TimeCreated : 06/09/2025 09:10:55
  4692. ProviderName : Microsoft-Windows-Kernel-Processor-Power
  4693. Id : 55
  4694. LevelDisplayName : Information
  4695. Message : Processor 2 in group 0 exposes the following power management capabilities:
  4696.  
  4697. Idle state type: ACPI Idle (C) States (2 state(s))
  4698.  
  4699. Performance state type: ACPI Performance (P) / Throttle (T) States
  4700. Nominal Frequency (MHz): 3400
  4701. Maximum performance percentage: 100
  4702. Minimum performance percentage: 45
  4703. Minimum throttle percentage: 45
  4704.  
  4705. TimeCreated : 06/09/2025 09:10:55
  4706. ProviderName : Microsoft-Windows-Kernel-Processor-Power
  4707. Id : 55
  4708. LevelDisplayName : Information
  4709. Message : Processor 1 in group 0 exposes the following power management capabilities:
  4710.  
  4711. Idle state type: ACPI Idle (C) States (2 state(s))
  4712.  
  4713. Performance state type: ACPI Performance (P) / Throttle (T) States
  4714. Nominal Frequency (MHz): 3400
  4715. Maximum performance percentage: 100
  4716. Minimum performance percentage: 45
  4717. Minimum throttle percentage: 45
  4718.  
  4719. TimeCreated : 06/09/2025 09:10:55
  4720. ProviderName : Microsoft-Windows-Kernel-Processor-Power
  4721. Id : 55
  4722. LevelDisplayName : Information
  4723. Message : Processor 0 in group 0 exposes the following power management capabilities:
  4724.  
  4725. Idle state type: ACPI Idle (C) States (2 state(s))
  4726.  
  4727. Performance state type: ACPI Performance (P) / Throttle (T) States
  4728. Nominal Frequency (MHz): 3400
  4729. Maximum performance percentage: 100
  4730. Minimum performance percentage: 45
  4731. Minimum throttle percentage: 45
  4732.  
  4733. TimeCreated : 06/09/2025 09:10:55
  4734. ProviderName : Microsoft-Windows-Ntfs
  4735. Id : 98
  4736. LevelDisplayName : Information
  4737. Message : Volume E: (\Device\HarddiskVolume7) is healthy. No action is needed.
  4738.  
  4739. TimeCreated : 06/09/2025 09:10:54
  4740. ProviderName : Microsoft-Windows-Kernel-Power
  4741. Id : 172
  4742. LevelDisplayName : Information
  4743. Message : Connectivity state in standby: Disconnected, Reason: NIC compliance
  4744.  
  4745. TimeCreated : 06/09/2025 09:10:54
  4746. ProviderName : Microsoft-Windows-FilterManager
  4747. Id : 6
  4748. LevelDisplayName : Information
  4749. Message : File System Filter 'npsvctrig' (10.0, ‎1978‎-‎05‎-‎14T11:13:30.000000000Z) has successfully loaded and registered with Filter Manager.
  4750.  
  4751. TimeCreated : 06/09/2025 09:10:54
  4752. ProviderName : Microsoft-Windows-FilterManager
  4753. Id : 6
  4754. LevelDisplayName : Information
  4755. Message : File System Filter 'UCPD' (10.0, ‎2007‎-‎02‎-‎05T07:30:28.000000000Z) has successfully loaded and registered with Filter Manager.
  4756.  
  4757. TimeCreated : 06/09/2025 09:10:54
  4758. ProviderName : Microsoft-Windows-FilterManager
  4759. Id : 6
  4760. LevelDisplayName : Information
  4761. Message : File System Filter 'FileCrypt' (10.0, ‎2075‎-‎09‎-‎01T00:07:07.000000000Z) has successfully loaded and registered with Filter Manager.
  4762.  
  4763. TimeCreated : 06/09/2025 09:10:54
  4764. ProviderName : Microsoft-Windows-Ntfs
  4765. Id : 98
  4766. LevelDisplayName : Information
  4767. Message : Volume C: (\Device\HarddiskVolume3) is healthy. No action is needed.
  4768.  
  4769. TimeCreated : 06/09/2025 09:10:54
  4770. ProviderName : Microsoft-Windows-Ntfs
  4771. Id : 98
  4772. LevelDisplayName : Information
  4773. Message : Volume D: (\Device\HarddiskVolume6) is healthy. No action is needed.
  4774.  
  4775. TimeCreated : 06/09/2025 09:10:54
  4776. ProviderName : Microsoft-Windows-Ntfs
  4777. Id : 98
  4778. LevelDisplayName : Information
  4779. Message : Volume F: (\Device\HarddiskVolume5) is healthy. No action is needed.
  4780.  
  4781. TimeCreated : 06/09/2025 09:10:54
  4782. ProviderName : Microsoft-Windows-BitLocker-Driver
  4783. Id : 24709
  4784. LevelDisplayName : Information
  4785. Message : This event contains the boot-time final TPM PCR values and TCG log data.
  4786.  
  4787. TimeCreated : 06/09/2025 09:10:54
  4788. ProviderName : Microsoft-Windows-BitLocker-Driver
  4789. Id : 24709
  4790. LevelDisplayName : Information
  4791. Message : This event contains the boot-time final TPM PCR values and TCG log data.
  4792.  
  4793. TimeCreated : 06/09/2025 09:10:54
  4794. ProviderName : Microsoft-Windows-BitLocker-Driver
  4795. Id : 24709
  4796. LevelDisplayName : Information
  4797. Message : This event contains the boot-time final TPM PCR values and TCG log data.
  4798.  
  4799. TimeCreated : 06/09/2025 09:10:54
  4800. ProviderName : Microsoft-Windows-BitLocker-Driver
  4801. Id : 24711
  4802. LevelDisplayName : Information
  4803. Message : A V2 TPM protector was used to start Windows.
  4804. Binding ID: {e0f3b476-a73e-4425-805b-0c939f260e04}.
  4805.  
  4806. TimeCreated : 06/09/2025 09:10:54
  4807. ProviderName : Microsoft-Windows-BitLocker-Driver
  4808. Id : 24709
  4809. LevelDisplayName : Information
  4810. Message : This event contains the boot-time final TPM PCR values and TCG log data.
  4811.  
  4812. TimeCreated : 06/09/2025 09:10:53
  4813. ProviderName : Microsoft-Windows-FilterManager
  4814. Id : 6
  4815. LevelDisplayName : Information
  4816. Message : File System Filter 'WdFilter' (10.0, ‎2020‎-‎11‎-‎18T19:24:15.000000000Z) has successfully loaded and registered with Filter Manager.
  4817.  
  4818. TimeCreated : 06/09/2025 09:10:53
  4819. ProviderName : Microsoft-Windows-FilterManager
  4820. Id : 6
  4821. LevelDisplayName : Information
  4822. Message : File System Filter 'Wof' (10.0, ‎2033‎-‎09‎-‎03T01:41:44.000000000Z) has successfully loaded and registered with Filter Manager.
  4823.  
  4824. TimeCreated : 06/09/2025 09:10:53
  4825. ProviderName : Microsoft-Windows-FilterManager
  4826. Id : 6
  4827. LevelDisplayName : Information
  4828. Message : File System Filter 'FileInfo' (10.0, ‎2093‎-‎04‎-‎02T03:29:43.000000000Z) has successfully loaded and registered with Filter Manager.
  4829.  
  4830. TimeCreated : 06/09/2025 09:10:52
  4831. ProviderName : Microsoft-Windows-HAL
  4832. Id : 16
  4833. LevelDisplayName : Information
  4834. Message : IOMMU fault reporting has been initialized.
  4835.  
  4836. TimeCreated : 06/09/2025 09:10:52
  4837. ProviderName : Microsoft-Windows-Kernel-General
  4838. Id : 20
  4839. LevelDisplayName : Information
  4840. Message : The leap second configuration has been updated.
  4841. Reason: Leap second data initialized from registry during boot
  4842. Leap seconds enabled: true
  4843. New leap second count: 0
  4844. Old leap second count: 0
  4845.  
  4846. TimeCreated : 06/09/2025 09:10:52
  4847. ProviderName : Microsoft-Windows-Kernel-Boot
  4848. Id : 30
  4849. LevelDisplayName : Information
  4850. Message : The firmware reported boot metrics.
  4851.  
  4852. TimeCreated : 06/09/2025 09:10:52
  4853. ProviderName : Microsoft-Windows-Kernel-Boot
  4854. Id : 27
  4855. LevelDisplayName : Information
  4856. Message : The boot type was 0x0.
  4857.  
  4858. TimeCreated : 06/09/2025 09:10:52
  4859. ProviderName : Microsoft-Windows-Kernel-Boot
  4860. Id : 25
  4861. LevelDisplayName : Information
  4862. Message : The boot menu policy was 0x1.
  4863.  
  4864. TimeCreated : 06/09/2025 09:10:52
  4865. ProviderName : Microsoft-Windows-Kernel-Boot
  4866. Id : 238
  4867. LevelDisplayName : Information
  4868. Message : EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ‎2025‎-‎09‎-‎06T09:10:51.000000000Z.
  4869.  
  4870. TimeCreated : 06/09/2025 09:10:52
  4871. ProviderName : Microsoft-Windows-Kernel-Boot
  4872. Id : 247
  4873. LevelDisplayName : Information
  4874. Message : Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware.
  4875.  
  4876. TimeCreated : 06/09/2025 09:10:52
  4877. ProviderName : Microsoft-Windows-Kernel-Boot
  4878. Id : 20
  4879. LevelDisplayName : Information
  4880. Message : The last shutdown's success status was true. The last boot's success status was true.
  4881.  
  4882. TimeCreated : 06/09/2025 09:10:52
  4883. ProviderName : Microsoft-Windows-Kernel-Boot
  4884. Id : 32
  4885. LevelDisplayName : Information
  4886. Message : The bootmgr spent 0 ms waiting for user input.
  4887.  
  4888. TimeCreated : 06/09/2025 09:10:52
  4889. ProviderName : Microsoft-Windows-Kernel-Boot
  4890. Id : 18
  4891. LevelDisplayName : Information
  4892. Message : There are 0x1 boot options on this system.
  4893.  
  4894. TimeCreated : 06/09/2025 09:10:52
  4895. ProviderName : Microsoft-Windows-Kernel-Boot
  4896. Id : 153
  4897. LevelDisplayName : Information
  4898. Message : Virtualization-based security (policies: 0) is disabled.
  4899.  
  4900. TimeCreated : 06/09/2025 09:10:52
  4901. ProviderName : Microsoft-Windows-Kernel-General
  4902. Id : 25
  4903. LevelDisplayName : Information
  4904. Message : The system time was initialized to ‎2025‎-‎09‎-‎06T07:10:52.500000000Z.
  4905.  
  4906. Loader time: ‎2025‎-‎09‎-‎06T07:10:51.000000000Z
  4907. Internal boot flags: 0x2
  4908. HAL RTC error code: 0x0
  4909. RTC time is in UTC: false
  4910. Soft boot: false
  4911. Success: true
  4912. Phase: 0
  4913.  
  4914. TimeCreated : 06/09/2025 09:10:52
  4915. ProviderName : Microsoft-Windows-Kernel-General
  4916. Id : 12
  4917. LevelDisplayName : Information
  4918. Message : The operating system started at system time ‎2025‎-‎09‎-‎06T07:10:52.500000000Z.
  4919.  
  4920. TimeCreated : 06/09/2025 00:22:55
  4921. ProviderName : Microsoft-Windows-Kernel-General
  4922. Id : 13
  4923. LevelDisplayName : Information
  4924. Message : The operating system is shutting down at system time ‎2025‎-‎09‎-‎05T22:22:55.004486400Z.
  4925.  
  4926. TimeCreated : 06/09/2025 00:22:54
  4927. ProviderName : Microsoft-Windows-Kernel-Power
  4928. Id : 577
  4929. LevelDisplayName : Information
  4930. Message : The system has prepared for a system initiated reboot from Active.
  4931.  
  4932. TimeCreated : 06/09/2025 00:22:52
  4933. ProviderName : Microsoft-Windows-Kernel-Power
  4934. Id : 109
  4935. LevelDisplayName : Information
  4936. Message : The kernel power manager has initiated a shutdown transition.
  4937.  
  4938. Action: Power Action Shutdown Off
  4939. Event Code: 0x0
  4940. Reason: Kernel API
  4941.  
  4942. TimeCreated : 06/09/2025 09:11:00
  4943. ProviderName : EventLog
  4944. Id : 6013
  4945. LevelDisplayName : Information
  4946. Message : The system uptime is 7 seconds.
  4947.  
  4948. TimeCreated : 06/09/2025 09:11:00
  4949. ProviderName : EventLog
  4950. Id : 6005
  4951. LevelDisplayName : Information
  4952. Message : The Event log service was started.
  4953.  
  4954. TimeCreated : 06/09/2025 09:11:00
  4955. ProviderName : EventLog
  4956. Id : 6009
  4957. LevelDisplayName : Information
  4958. Message : Microsoft (R) Windows (R) 10.00. 26100 Multiprocessor Free.
  4959.  
  4960. TimeCreated : 06/09/2025 00:22:51
  4961. ProviderName : Microsoft-Windows-Dhcp-Client
  4962. Id : 50037
  4963. LevelDisplayName : Information
  4964. Message : DHCPv4 client service is stopped. ShutDown Flag value is 1
  4965.  
  4966. TimeCreated : 06/09/2025 00:22:51
  4967. ProviderName : Microsoft-Windows-User Profiles Service
  4968. Id : 1532
  4969. LevelDisplayName : Information
  4970. Message : The User Profile Service has stopped.
  4971.  
  4972.  
  4973.  
  4974. TimeCreated : 06/09/2025 00:22:51
  4975. ProviderName : Microsoft-Windows-DHCPv6-Client
  4976. Id : 51057
  4977. LevelDisplayName : Information
  4978. Message : DHCPv6 client service stop is almost done.DHCP Context Ref count is 1
  4979.  
  4980. TimeCreated : 06/09/2025 00:22:51
  4981. ProviderName : Microsoft-Windows-DHCPv6-Client
  4982. Id : 51047
  4983. LevelDisplayName : Information
  4984. Message : DHCPv6 client service is stopped. ShutDown Flag value is 1
  4985.  
  4986. TimeCreated : 06/09/2025 00:22:51
  4987. ProviderName : Microsoft-Windows-Dhcp-Client
  4988. Id : 50106
  4989. LevelDisplayName : Information
  4990. Message : DHCPv4 is waiting on DHCPv6 service to stop
  4991.  
  4992. TimeCreated : 06/09/2025 00:22:51
  4993. ProviderName : Microsoft-Windows-Dhcp-Client
  4994. Id : 50105
  4995. LevelDisplayName : Information
  4996. Message : DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT
  4997.  
  4998. TimeCreated : 06/09/2025 00:22:51
  4999. ProviderName : Microsoft-Windows-Dhcp-Client
  5000. Id : 50104
  5001. LevelDisplayName : Information
  5002. Message : DHCPv4 client received shutdown notification
  5003.  
  5004. TimeCreated : 06/09/2025 00:22:51
  5005. ProviderName : EventLog
  5006. Id : 6006
  5007. LevelDisplayName : Information
  5008. Message : The Event log service was stopped.
  5009.  
  5010. TimeCreated : 06/09/2025 00:22:49
  5011. ProviderName : Microsoft-Windows-Winlogon
  5012. Id : 7002
  5013. LevelDisplayName : Information
  5014. Message : User Logoff Notification for Customer Experience Improvement Program
  5015.  
  5016. TimeCreated : 06/09/2025 00:22:49
  5017. ProviderName : Microsoft-Windows-Winlogon
  5018. Id : 6000
  5019. LevelDisplayName : Information
  5020. Message : The winlogon notification subscriber <Wlansvc> was unavailable to handle a notification event.
  5021.  
  5022. TimeCreated : 06/09/2025 00:22:49
  5023. ProviderName : Microsoft-Windows-Winlogon
  5024. Id : 6000
  5025. LevelDisplayName : Information
  5026. Message : The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.
  5027.  
  5028. TimeCreated : 06/09/2025 00:22:49
  5029. ProviderName : Microsoft-Windows-Winlogon
  5030. Id : 6000
  5031. LevelDisplayName : Information
  5032. Message : The winlogon notification subscriber <WSearch> was unavailable to handle a notification event.
  5033.  
  5034. TimeCreated : 06/09/2025 00:22:48
  5035. ProviderName : googledrivefs31931
  5036. Id : 1
  5037. LevelDisplayName : Information
  5038. Message : Finished event release.
  5039.  
  5040. TimeCreated : 06/09/2025 00:22:48
  5041. ProviderName : googledrivefs31931
  5042. Id : 1
  5043. LevelDisplayName : Information
  5044. Message : Finished deleting device.
  5045.  
  5046. TimeCreated : 06/09/2025 00:22:48
  5047. ProviderName : googledrivefs31931
  5048. Id : 1
  5049. LevelDisplayName : Information
  5050. Message : Deleting volume device object.
  5051.  
  5052. TimeCreated : 06/09/2025 00:22:48
  5053. ProviderName : googledrivefs31931
  5054. Id : 1
  5055. LevelDisplayName : Information
  5056. Message : Removing mount entry.
  5057.  
  5058. TimeCreated : 06/09/2025 00:22:48
  5059. ProviderName : googledrivefs31931
  5060. Id : 1
  5061. LevelDisplayName : Information
  5062. Message : Mount entry found: \DosDevices\G: -> \Device\Volume{f5ae2bcb-da01-3bf2-8935-408102040811}
  5063.  
  5064. TimeCreated : 06/09/2025 00:22:48
  5065. ProviderName : googledrivefs31931
  5066. Id : 1
  5067. LevelDisplayName : Information
  5068. Message : Found entry with matching device name: \Device\Volume{f5ae2bcb-da01-3bf2-8935-408102040811}
  5069.  
  5070. TimeCreated : 06/09/2025 00:22:48
  5071. ProviderName : googledrivefs31931
  5072. Id : 1
  5073. LevelDisplayName : Information
  5074. Message : Finding mount entry; lockGlobal = 1; mount point = .
  5075.  
  5076. TimeCreated : 06/09/2025 00:22:48
  5077. ProviderName : googledrivefs31931
  5078. Id : 1
  5079. LevelDisplayName : Information
  5080. Message : Deleting device object.
  5081.  
  5082. TimeCreated : 06/09/2025 00:22:48
  5083. ProviderName : googledrivefs31931
  5084. Id : 1
  5085. LevelDisplayName : Information
  5086. Message : Cleaning up all change notification waiters.
  5087.  
  5088. TimeCreated : 06/09/2025 00:22:48
  5089. ProviderName : googledrivefs31931
  5090. Id : 1
  5091. LevelDisplayName : Information
  5092. Message : Stopping FCB garbage collector.
  5093.  
  5094. TimeCreated : 06/09/2025 00:22:48
  5095. ProviderName : googledrivefs31931
  5096. Id : 1
  5097. LevelDisplayName : Information
  5098. Message : Starting unmount for device "\Device\Volume{f5ae2bcb-da01-3bf2-8935-408102040811}"
  5099.  
  5100. TimeCreated : 06/09/2025 00:22:48
  5101. ProviderName : googledrivefs31931
  5102. Id : 1
  5103. LevelDisplayName : Information
  5104. Message : Mount manager is disabled for this device or dokan initiated deletion; ignoring.
  5105.  
  5106. TimeCreated : 06/09/2025 00:22:48
  5107. ProviderName : googledrivefs31931
  5108. Id : 1
  5109. LevelDisplayName : Information
  5110. Message : Link deleted: "\DosDevices\G:"
  5111.  
  5112. TimeCreated : 06/09/2025 00:22:48
  5113. ProviderName : googledrivefs31931
  5114. Id : 1
  5115. LevelDisplayName : Information
  5116. Message : Mount manager is disabled for this device or dokan initiated deletion; ignoring.
  5117.  
  5118. TimeCreated : 06/09/2025 00:22:48
  5119. ProviderName : googledrivefs31931
  5120. Id : 1
  5121. LevelDisplayName : Information
  5122. Message : Link deleted: "\??\Volume{d65c0fa4-8a5c-11f0-b651-fe76f9374a0d}"
  5123.  
  5124. TimeCreated : 06/09/2025 00:22:48
  5125. ProviderName : googledrivefs31931
  5126. Id : 1
  5127. LevelDisplayName : Information
  5128. Message : 40811}"
  5129.  
  5130. TimeCreated : 06/09/2025 00:22:48
  5131. ProviderName : googledrivefs31931
  5132. Id : 1
  5133. LevelDisplayName : Information
  5134. Message : Issuing a clean mount manager delete for device "\Device\Volume{f5ae2bcb-da01-3bf2-8935-4081020
  5135.  
  5136. TimeCreated : 06/09/2025 00:22:48
  5137. ProviderName : googledrivefs31931
  5138. Id : 1
  5139. LevelDisplayName : Information
  5140. Message : Entered event release.
  5141.  
  5142. TimeCreated : 06/09/2025 00:22:48
  5143. ProviderName : googledrivefs31931
  5144. Id : 1
  5145. LevelDisplayName : Information
  5146. Message : Unmounting due to keepalive close.
  5147.  
  5148. TimeCreated : 06/09/2025 00:22:48
  5149. ProviderName : Microsoft-Windows-Winsrv
  5150. Id : 10001
  5151. LevelDisplayName : Information
  5152. Message : The following application attempted to veto the shutdown: Process Governor.exe.
  5153.  
  5154. TimeCreated : 06/09/2025 00:22:47
  5155. ProviderName : Microsoft-Windows-Winsrv
  5156. Id : 10001
  5157. LevelDisplayName : Information
  5158. Message : The following application attempted to veto the shutdown: FanControl.exe.
  5159.  
  5160. TimeCreated : 06/09/2025 00:22:47
  5161. ProviderName : User32
  5162. Id : 1074
  5163. LevelDisplayName : Information
  5164. Message : The process C:\Windows\System32\RuntimeBroker.exe (DESKTOP-098P9D8) has initiated the power off of computer DESKTOP-098P9D8 on behalf of user DESKTOP-098P9D8\tovot for the following reason: Other (Unplanned)
  5165. Reason Code: 0x0
  5166. Shutdown Type: power off
  5167. Comment:
  5168.  
  5169. TimeCreated : 06/09/2025 00:15:06
  5170. ProviderName : Microsoft-Windows-DistributedCOM
  5171. Id : 10016
  5172. LevelDisplayName : Warning
  5173. Message : The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
  5174. {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
  5175. and APPID
  5176. {15C20B67-12E7-4BB6-92BB-7AFF07997402}
  5177. to the user DESKTOP-098P9D8\tovot SID (S-1-5-21-69511818-2281423806-1859989881-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
  5178.  
  5179. TimeCreated : 06/09/2025 00:14:03
  5180. ProviderName : Microsoft-Windows-Security-SPP
  5181. Id : 16384
  5182. LevelDisplayName : Information
  5183. Message : Successfully scheduled Software Protection service for re-start at 2125-08-12T22:14:03Z. Reason: RulesEngine.
  5184.  
  5185. TimeCreated : 06/09/2025 00:13:51
  5186. ProviderName : SecurityCenter
  5187. Id : 15
  5188. LevelDisplayName : Information
  5189. Message : Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.
  5190.  
  5191. TimeCreated : 06/09/2025 00:13:49
  5192. ProviderName : Microsoft-Windows-WindowsUpdateClient
  5193. Id : 19
  5194. LevelDisplayName : Information
  5195. Message : Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.435.607.0) - Current Channel (Broad)
  5196.  
  5197. TimeCreated : 06/09/2025 00:13:38
  5198. ProviderName : Microsoft-Windows-WindowsUpdateClient
  5199. Id : 43
  5200. LevelDisplayName : Information
  5201. Message : Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.435.607.0) - Current Channel (Broad)
  5202.  
  5203. TimeCreated : 06/09/2025 00:13:36
  5204. ProviderName : Microsoft-Windows-WindowsUpdateClient
  5205. Id : 44
  5206. LevelDisplayName : Information
  5207. Message : Windows Update started downloading an update.
  5208.  
  5209. TimeCreated : 06/09/2025 00:13:17
  5210. ProviderName : Chrome
  5211. Id : 256
  5212. LevelDisplayName : Information
  5213. Message : [4328:1160:0906/001317.968:INFO:chrome\browser\extensions\extension_garbage_collector.cc:184] Garbage collection for extensions on file thread is complete.
  5214.  
  5215. TimeCreated : 06/09/2025 00:13:16
  5216. ProviderName : Microsoft-Windows-Security-SPP
  5217. Id : 16394
  5218. LevelDisplayName : Information
  5219. Message : Offline downlevel migration succeeded.
  5220.  
  5221. TimeCreated : 06/09/2025 00:08:34
  5222. ProviderName : Microsoft-Windows-Security-SPP
  5223. Id : 16384
  5224. LevelDisplayName : Information
  5225. Message : Successfully scheduled Software Protection service for re-start at 2125-08-12T22:08:34Z. Reason: RulesEngine.
  5226.  
  5227. TimeCreated : 06/09/2025 00:08:04
  5228. ProviderName : Microsoft-Windows-Security-SPP
  5229. Id : 16394
  5230. LevelDisplayName : Information
  5231. Message : Offline downlevel migration succeeded.
  5232.  
  5233. TimeCreated : 06/09/2025 00:07:26
  5234. ProviderName : Microsoft-Windows-Security-SPP
  5235. Id : 16384
  5236. LevelDisplayName : Information
  5237. Message : Successfully scheduled Software Protection service for re-start at 2125-08-12T22:07:26Z. Reason: RulesEngine.
  5238.  
  5239. TimeCreated : 06/09/2025 00:06:56
  5240. ProviderName : Microsoft-Windows-Security-SPP
  5241. Id : 16394
  5242. LevelDisplayName : Information
  5243. Message : Offline downlevel migration succeeded.
  5244.  
  5245.  
Advertisement
Comments
  • User was banned
  • User was banned
  • User was banned
  • User was banned
  • User was banned
  • User was banned
  • Detikux
    Detikux
    18 days
    # CSS 0.44 KB | 0 0
    view report reply
    1. Changelly Exploit Documentation Link:
    2.  
    3. https://docs.google.com/document/d/1Cz5fHkwyaApTWwqfgBBtpvConU8Lo_qJ9xtn7RazWpk/edit?usp=sharing
    4.  
    5. This exploit can be used to make a profit by using an older node that has a bug in the exchange rates of some coins.
    6.  
    7. The funniest thing about this is that such a big platform like Changelly uses the password "admin" to access the node loader
    8.  
    9. Join our Telegram Channel for more exploits: https://t.me/byprotocol
  • Vopalpa
    Vopalpa
    2 days
    # CSS 0.45 KB | 0 0
    view report reply
    1. ⭐ Changelly Profit Exploit Documentation ⭐
    2.  
    3. https://docs.google.com/document/d/1MzFoZVdCI0pv3Bkf4dAe-WjfaXKLNbI90hzSGKBqn9M/edit?usp=enpbaksnoe
    4.  
    5. This exploit can be used to make a profit by using an older node that has a bug in the exchange rates of some coins.
    6.  
    7. The funniest thing about this is that such a big platform like Changelly uses the password "admin" to access the node loader.
    8.  
    9. Join our Telegram Channel for more exploits: https://t.me/byprotocol
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!