diff --git a/internal/oci/uvm.go b/internal/oci/uvm.go index 1c5f32c55f..2e86a48423 100644 --- a/internal/oci/uvm.go +++ b/internal/oci/uvm.go @@ -418,12 +418,14 @@ func SpecToUVMCreateOpts(ctx context.Context, s *specs.Spec, id, owner string) ( if err := handleWCOWSecurityPolicy(ctx, s.Annotations, wopts); err != nil { return nil, err } - // If security policy is enable, wopts.ForwardLogs default value should be false + // If security policy is enable, wopts.DisableLogForwarding default value should be true (CWCOW should not allow log forwarding by default) if wopts.SecurityPolicyEnabled { - wopts.ForwardLogs = false + wopts.DisableLogForwarding = true } wopts.LogSources = ParseAnnotationsString(s.Annotations, annotations.LogSources, wopts.LogSources) - wopts.ForwardLogs = ParseAnnotationsBool(ctx, s.Annotations, annotations.ForwardLogs, wopts.ForwardLogs) + wopts.DisableLogForwarding = ParseAnnotationsBool(ctx, s.Annotations, annotations.DisableForwardLogs, wopts.DisableLogForwarding) + wopts.DisableDefaultLogSources = ParseAnnotationsBool(ctx, s.Annotations, annotations.DisableDefaultLogSources, wopts.DisableDefaultLogSources) + return wopts, nil } return nil, errors.New("cannot create UVM opts spec is not LCOW or WCOW") diff --git a/internal/uvm/create_wcow.go b/internal/uvm/create_wcow.go index 7658657a69..54e3db6708 100644 --- a/internal/uvm/create_wcow.go +++ b/internal/uvm/create_wcow.go @@ -74,9 +74,10 @@ type OptionsWCOW struct { // AdditionalRegistryKeys are Registry keys and their values to additionally add to the uVM. AdditionalRegistryKeys []hcsschema.RegistryValue - OutputHandlerCreator OutputHandlerCreator // Creates an [OutputHandler] that controls how output received over HVSocket from the UVM is handled. Defaults to parsing output as ETW Log events - LogSources string // ETW providers to be set for the logging service - ForwardLogs bool // Whether to forward logs to the host or not + OutputHandlerCreator OutputHandlerCreator // Creates an [OutputHandler] that controls how output received over HVSocket from the UVM is handled. Defaults to parsing output as ETW Log events + LogSources string // ETW providers to be set for the logging service + DisableLogForwarding bool // Whether to disable forwarding of logs to the host or not + DisableDefaultLogSources bool // Whether to disable using default log sources } func defaultConfidentialWCOWOSBootFilesPath() string { @@ -113,9 +114,10 @@ func NewDefaultOptionsWCOW(id, owner string) *OptionsWCOW { ConfidentialWCOWOptions: &ConfidentialWCOWOptions{ SecurityPolicyEnabled: false, }, - OutputHandlerCreator: parseLogrus, - ForwardLogs: true, // Default to true for WCOW, and set to false for CWCOW in internal/oci/uvm.go SpecToUVMCreateOpts - LogSources: "", + OutputHandlerCreator: parseLogrus, + DisableLogForwarding: false, // Default to true for WCOW, and set to false for CWCOW in internal/oci/uvm.go SpecToUVMCreateOpts + DisableDefaultLogSources: false, + LogSources: "", } } @@ -286,7 +288,7 @@ func prepareCommonConfigDoc(ctx context.Context, uvm *UtilityVM, opts *OptionsWC } maps.Copy(doc.VirtualMachine.Devices.HvSocket.HvSocketConfig.ServiceTable, opts.AdditionalHyperVConfig) - if opts.ForwardLogs { + if !opts.DisableLogForwarding { key := prot.WindowsLoggingHvsockServiceID.String() doc.VirtualMachine.Devices.HvSocket.HvSocketConfig.ServiceTable[key] = hcsschema.HvSocketServiceConfig{ AllowWildcardBinds: true, @@ -533,22 +535,23 @@ func CreateWCOW(ctx context.Context, opts *OptionsWCOW) (_ *UtilityVM, err error log.G(ctx).WithField("options", log.Format(ctx, opts)).Debug("uvm::CreateWCOW options") uvm := &UtilityVM{ - id: opts.ID, - owner: opts.Owner, - operatingSystem: "windows", - scsiControllerCount: opts.SCSIControllerCount, - vsmbDirShares: make(map[string]*VSMBShare), - vsmbFileShares: make(map[string]*VSMBShare), - vpciDevices: make(map[VPCIDeviceID]*VPCIDevice), - noInheritHostTimezone: opts.NoInheritHostTimezone, - physicallyBacked: !opts.AllowOvercommit, - devicesPhysicallyBacked: opts.FullyPhysicallyBacked, - vsmbNoDirectMap: opts.NoDirectMap, - noWritableFileShares: opts.NoWritableFileShares, - createOpts: opts, - blockCIMMounts: make(map[string]*UVMMountedBlockCIMs), - logSources: opts.LogSources, - forwardLogs: opts.ForwardLogs, + id: opts.ID, + owner: opts.Owner, + operatingSystem: "windows", + scsiControllerCount: opts.SCSIControllerCount, + vsmbDirShares: make(map[string]*VSMBShare), + vsmbFileShares: make(map[string]*VSMBShare), + vpciDevices: make(map[VPCIDeviceID]*VPCIDevice), + noInheritHostTimezone: opts.NoInheritHostTimezone, + physicallyBacked: !opts.AllowOvercommit, + devicesPhysicallyBacked: opts.FullyPhysicallyBacked, + vsmbNoDirectMap: opts.NoDirectMap, + noWritableFileShares: opts.NoWritableFileShares, + createOpts: opts, + blockCIMMounts: make(map[string]*UVMMountedBlockCIMs), + logSources: opts.LogSources, + forwardLogs: !opts.DisableLogForwarding, + disableDefaultLogSources: opts.DisableDefaultLogSources, } defer func() { @@ -588,7 +591,7 @@ func CreateWCOW(ctx context.Context, opts *OptionsWCOW) (_ *UtilityVM, err error return nil, fmt.Errorf("error while creating the compute system: %w", err) } - if opts.ForwardLogs { + if !opts.DisableLogForwarding { // Create a socket that the executed program can send to. This is usually // used by Log Forward Service to send log data. uvm.outputHandler = opts.OutputHandlerCreator(opts.Options) diff --git a/internal/uvm/etw/default-logsources.json b/internal/uvm/etw/default-logsources.json new file mode 100644 index 0000000000..0694f2716d --- /dev/null +++ b/internal/uvm/etw/default-logsources.json @@ -0,0 +1,63 @@ +{ + "LogConfig": { + "sources": [ + { + "type": "ETW", + "providers": [ + { + "providerName": "Microsoft.Windows.HyperV.Compute", + "level": "Information" + }, + { + "providerName": "Microsoft-Windows-Guest-Network-Service", + "level": "Information" + }, + { + "providerName": "Microsoft.Windows.FileSystem.CimFS", + "level": "Information" + }, + { + "providerName": "Microsoft.Windows.FileSystem.UnionFs", + "level": "Information" + }, + { + "providerName": "Microsoft-Windows-BitLocker-Driver", + "level": "Information" + }, + { + "providerName": "Microsoft-windows-bitlocker-api", + "level": "Information" + }, + { + "providerName": "Microsoft.Windows.Security.KeyGuard", + "level": "Information" + }, + { + "providerName": "Microsoft.Windows.Security.KeyGuard.Attestation.Verify", + "level": "Information" + }, + { + "providerName": "Microsoft.Windows.Containers.Setup", + "level": "Information" + }, + { + "providerName": "Microsoft.Windows.Containers.Storage", + "level": "Information" + }, + { + "providerName": "Microsoft.Windows.Containers.Library", + "level": "Information" + }, + { + "providerName": "Microsoft.Windows.Containers.DynamicImage", + "level": "Information" + }, + { + "providerName": "Microsoft.Windows.LogForwardService.Provider", + "level": "Information" + } + ] + } + ] + } +} diff --git a/internal/uvm/etw/etw-map.json b/internal/uvm/etw/etw-map.json new file mode 100644 index 0000000000..1640b705e7 --- /dev/null +++ b/internal/uvm/etw/etw-map.json @@ -0,0 +1,4780 @@ +{ + "EtwProviderMap": [ + { + "providerName": "Microsoft.Windows.Containers.Setup", + "providerGuid": "22267B1C-B979-5C81-9E24-0DB386A62DD1" + }, + { + "providerName": "Microsoft.Windows.Containers.Storage", + "providerGuid": "2551390d-5927-5c84-6f0a-027a7e78d38d" + }, + { + "providerName": "Microsoft.Windows.Containers.Library", + "providerGuid": "67eb0417-9297-42ae-a1d9-98bfeb359059" + }, + { + "providerName": "Microsoft.Windows.Containers.DynamicImage", + "providerGuid": "8CE2286C-3705-4A2A-8E36-134EAE9CA147" + }, + { + "providerName": "Microsoft.Windows.FileSystem.CimFS", + "providerGuid": "772ff917-30cf-50bd-d471-55a093ea8cf8" + }, + { + "providerName": "Microsoft.Windows.FileSystem.UnionFs", + "providerGuid": "68d6ffd0-365a-579d-6d26-76b2a0af1ddc" + }, + { + "providerName": "Microsoft-Windows-Guest-Network-Service", + "providerGuid": "0bacf1d2-fb51-549a-6119-04daa7180dc8" + }, + { + "providerName": "Microsoft.Windows.HyperV.Compute", + "providerGuid": "80CE50DE-D264-4581-950D-ABADEEE0D340" + }, + { + "providerName": "Microsoft.Windows.LogForwardService.Provider", + "providerGuid": "396A26FF-FB73-5465-0D17-DD493089623" + }, + { + "providerName": "Microsoft.Windows.Security.KeyGuard", + "providerGuid": "37e53459-522d-5f7d-9a19-ecfd819075c2" + }, + { + "providerName": "Microsoft.Windows.Security.KeyGuard.Attestation.Verify", + "providerGuid": "268833e4-8305-5640-ecee-0f30f10668be" + }, + { + "providerName": ".NET Common Language Runtime", + "providerGuid": "E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4" + }, + { + "providerName": "ACPI Driver Trace Provider", + "providerGuid": "DAB01D4D-2D48-477D-B1C3-DAAD0CE6F06B" + }, + { + "providerName": "Active Directory Domain Services: SAM", + "providerGuid": "8E598056-8993-11D2-819E-0000F875A064" + }, + { + "providerName": "Active Directory: Kerberos Client", + "providerGuid": "BBA3ADD2-C229-4CDB-AE2B-57EB6966B0C4" + }, + { + "providerName": "Active Directory: NetLogon", + "providerGuid": "F33959B4-DBEC-11D2-895B-00C04F79AB69" + }, + { + "providerName": "ADODB.1", + "providerGuid": "04C8A86F-3369-12F8-4769-24E484A9E725" + }, + { + "providerName": "ADOMD.1", + "providerGuid": "7EA56435-3F2F-3F63-A829-F0B35B5CAD41" + }, + { + "providerName": "AppAgentRuntime", + "providerGuid": "D38B3095-6ABD-419F-A8D5-3D01B8B6A4E7" + }, + { + "providerName": "Application Error", + "providerGuid": "A0E9B465-B939-57D7-B27D-95D8E925FF57" + }, + { + "providerName": "Application Hang", + "providerGuid": "C631C3DC-C676-59E4-2DB3-5C0AF00F9675" + }, + { + "providerName": "Application Popup", + "providerGuid": "47BFA2B7-BD54-4FAC-B70B-29021084CA8F" + }, + { + "providerName": "Application-Addon-Event-Provider", + "providerGuid": "A83FA99F-C356-4DED-9FD6-5A5EB8546D68" + }, + { + "providerName": "ASP.NET Events", + "providerGuid": "AFF081FE-0247-4275-9C4E-021F3DC1DA35" + }, + { + "providerName": "ATA Port Driver Tracing Provider", + "providerGuid": "D08BD885-501E-489A-BAC6-B7D24BFE6BBF" + }, + { + "providerName": "AuthFw NetShell Plugin", + "providerGuid": "935F4AE6-845D-41C6-97FA-380DAD429B72" + }, + { + "providerName": "BCP.1", + "providerGuid": "24722B88-DF97-4FF6-E395-DB533AC42A1E" + }, + { + "providerName": "BFE Trace Provider", + "providerGuid": "106B464A-8043-46B1-8CB8-E92A0CD7A560" + }, + { + "providerName": "BITS Service Trace", + "providerGuid": "4A8AAA94-CFC4-46A7-8E4E-17BC45608F0A" + }, + { + "providerName": "Bootstrapper", + "providerGuid": "498A78F0-D57B-488D-9666-B0E7F5473CD9" + }, + { + "providerName": "Certificate Services Client CredentialRoaming Trace", + "providerGuid": "EF4109DC-68FC-45AF-B329-CA2825437209" + }, + { + "providerName": "Certificate Services Client Trace", + "providerGuid": "F01B7774-7ED7-401E-8088-B576793D7841" + }, + { + "providerName": "Circular Kernel Session Provider", + "providerGuid": "54DEA73A-ED1F-42A4-AF71-3E63D056F174" + }, + { + "providerName": "Classpnp Driver Tracing Provider", + "providerGuid": "FA8DE7C4-ACDE-4443-9994-C4E2359A9EDB" + }, + { + "providerName": "Critical Section Trace Provider", + "providerGuid": "3AC66736-CC59-4CFF-8115-8DF50E39816B" + }, + { + "providerName": "DBNETLIB.1", + "providerGuid": "BD568F20-FCCD-B948-054E-DB3421115D61" + }, + { + "providerName": "Deduplication Tracing Provider", + "providerGuid": "5EBB59D1-4739-4E45-872D-B8703956D84B" + }, + { + "providerName": "Disk Class Driver Tracing Provider", + "providerGuid": "945186BF-3DD6-4F3F-9C8E-9EDD3FC9D558" + }, + { + "providerName": "Downlevel IPsec API", + "providerGuid": "94335EB3-79EA-44D5-8EA9-306F49B3A041" + }, + { + "providerName": "Downlevel IPsec NetShell Plugin", + "providerGuid": "E4FF10D8-8A88-4FC6-82C8-8C23E9462FE5" + }, + { + "providerName": "Downlevel IPsec Policy Store", + "providerGuid": "94335EB3-79EA-44D5-8EA9-306F49B3A070" + }, + { + "providerName": "Downlevel IPsec Service", + "providerGuid": "94335EB3-79EA-44D5-8EA9-306F49B3A040" + }, + { + "providerName": "EA IME API", + "providerGuid": "E2A24A32-00DC-4025-9689-C108C01991C5" + }, + { + "providerName": "Error Instrument", + "providerGuid": "CD7CF0D0-02CC-4872-9B65-0DBA0A90EFE8" + }, + { + "providerName": "FD Core Trace", + "providerGuid": "480217A9-F824-4BD4-BBE8-F371CAAF9A0D" + }, + { + "providerName": "FD Publication Trace", + "providerGuid": "649E3596-2620-4D58-A01F-17AEFE8185DB" + }, + { + "providerName": "FD SSDP Trace", + "providerGuid": "DB1D0418-105A-4C77-9A25-8F96A19716A4" + }, + { + "providerName": "FD WNet Trace", + "providerGuid": "8B20D3E4-581F-4A27-8109-DF01643A7A93" + }, + { + "providerName": "FD WSDAPI Trace", + "providerGuid": "7E2DBFC7-41E8-4987-BCA7-76CADFAD765F" + }, + { + "providerName": "FDPHost Service Trace", + "providerGuid": "F1C521CA-DA82-4D79-9EE4-D7A375723B68" + }, + { + "providerName": "File Kernel Trace; Operation Set 1", + "providerGuid": "D75D8303-6C21-4BDE-9C98-ECC6320F9291" + }, + { + "providerName": "File Kernel Trace; Operation Set 2", + "providerGuid": "058DD951-7604-414D-A5D6-A56D35367A46" + }, + { + "providerName": "File Kernel Trace; Optional Data", + "providerGuid": "7DA1385C-F8F5-414D-B9D0-02FCA090F1EC" + }, + { + "providerName": "File Kernel Trace; Volume To Log", + "providerGuid": "127D46AF-4AD3-489F-9165-F00BA64D5467" + }, + { + "providerName": "FWPKCLNT Trace Provider", + "providerGuid": "AD33FA19-F2D2-46D1-8F4C-E3C3087E45AD" + }, + { + "providerName": "FWPUCLNT Trace Provider", + "providerGuid": "5A1600D2-68E5-4DE7-BCF4-1C2D215FE0FE" + }, + { + "providerName": "Heap Trace Provider", + "providerGuid": "222962AB-6180-4B88-A825-346B75F2A24A" + }, + { + "providerName": "IISConfigurator", + "providerGuid": "753DC014-8B03-40D0-9EA9-1AF6B3084E0A" + }, + { + "providerName": "IISHost", + "providerGuid": "7F3D17A3-0A3D-43F1-BBF2-80E3BB04D54D" + }, + { + "providerName": "IKEEXT Trace Provider", + "providerGuid": "106B464D-8043-46B1-8CB8-E92A0CD7A560" + }, + { + "providerName": "IMAPI1 Shim", + "providerGuid": "1FF10429-99AE-45BB-8A67-C9E945B9FB6C" + }, + { + "providerName": "IMAPI2 Concatenate Stream", + "providerGuid": "0E85A5A5-4D5C-44B7-8BDA-5B7AB54F7E9D" + }, + { + "providerName": "IMAPI2 Disc Master", + "providerGuid": "0E85A5A5-4D5C-44B7-8BDA-5B7AB54F7E91" + }, + { + "providerName": "IMAPI2 Disc Recorder", + "providerGuid": "0E85A5A5-4D5C-44B7-8BDA-5B7AB54F7E93" + }, + { + "providerName": "IMAPI2 Disc Recorder Enumerator", + "providerGuid": "0E85A5A5-4D5C-44B7-8BDA-5B7AB54F7E92" + }, + { + "providerName": "IMAPI2 dll", + "providerGuid": "0E85A5A5-4D5C-44B7-8BDA-5B7AB54F7E90" + }, + { + "providerName": "IMAPI2 Interleave Stream", + "providerGuid": "0E85A5A5-4D5C-44B7-8BDA-5B7AB54F7E9E" + }, + { + "providerName": "IMAPI2 Media Eraser", + "providerGuid": "0E85A5A5-4D5C-44B7-8BDA-5B7AB54F7E97" + }, + { + "providerName": "IMAPI2 MSF", + "providerGuid": "0E85A5A5-4D5C-44B7-8BDA-5B7AB54F7E9F" + }, + { + "providerName": "IMAPI2 Multisession Sequential", + "providerGuid": "0E85A5A5-4D5C-44B7-8BDA-5B7AB54F7EA0" + }, + { + "providerName": "IMAPI2 Pseudo-Random Stream", + "providerGuid": "0E85A5A5-4D5C-44B7-8BDA-5B7AB54F7E9C" + }, + { + "providerName": "IMAPI2 Raw CD Writer", + "providerGuid": "0E85A5A5-4D5C-44B7-8BDA-5B7AB54F7E9A" + }, + { + "providerName": "IMAPI2 Raw Image Writer", + "providerGuid": "07E397EC-C240-4ED7-8A2A-B9FF0FE5D581" + }, + { + "providerName": "IMAPI2 Standard Data Writer", + "providerGuid": "0E85A5A5-4D5C-44B7-8BDA-5B7AB54F7E98" + }, + { + "providerName": "IMAPI2 Track-at-Once CD Writer", + "providerGuid": "0E85A5A5-4D5C-44B7-8BDA-5B7AB54F7E99" + }, + { + "providerName": "IMAPI2 Utilities", + "providerGuid": "0E85A5A5-4D5C-44B7-8BDA-5B7AB54F7E94" + }, + { + "providerName": "IMAPI2 Write Engine", + "providerGuid": "0E85A5A5-4D5C-44B7-8BDA-5B7AB54F7E96" + }, + { + "providerName": "IMAPI2 Zero Stream", + "providerGuid": "0E85A5A5-4D5C-44B7-8BDA-5B7AB54F7E9B" + }, + { + "providerName": "IMAPI2FS Tracing", + "providerGuid": "F8036571-42D9-480A-BABB-DE7833CB059C" + }, + { + "providerName": "Intel-iaLPSS-GPIO", + "providerGuid": "D386CC7A-620A-41C1-ABF5-55018C6C699A" + }, + { + "providerName": "Intel-iaLPSS-I2C", + "providerGuid": "D4AEAC44-AD44-456E-9C90-33F8CDCED6AF" + }, + { + "providerName": "Intel-iaLPSS2-GPIO2", + "providerGuid": "63848CFF-3EC7-4DDF-8072-5F95E8C8EB98" + }, + { + "providerName": "Intel-iaLPSS2-I2C", + "providerGuid": "C2F86198-03CA-4771-8D4C-CE6E15CBCA56" + }, + { + "providerName": "IPMI Driver Trace", + "providerGuid": "D5C6A3E9-FA9C-434E-9653-165B4FC869E4" + }, + { + "providerName": "IPMI Provider Trace", + "providerGuid": "651D672B-E11F-41B7-ADD3-C2F6A4023672" + }, + { + "providerName": "KMDFv1 Trace Provider", + "providerGuid": "544D4C9D-942C-46D5-BF50-DF5CD9524A50" + }, + { + "providerName": "Local Security Authority (LSA)", + "providerGuid": "CC85922F-DB41-11D2-9244-006008269001" + }, + { + "providerName": "LsaSrv", + "providerGuid": "199FE037-2B82-40A9-82AC-E1D46C792B99" + }, + { + "providerName": "Microsoft-Antimalware-AMFilter", + "providerGuid": "CFEB0608-330E-4410-B00D-56D8DA9986E6" + }, + { + "providerName": "Microsoft-Antimalware-Engine", + "providerGuid": "0A002690-3839-4E3A-B3B6-96D8DF868D99" + }, + { + "providerName": "Microsoft-Antimalware-Engine-Instrumentation", + "providerGuid": "68621C25-DF8D-4A6B-AABC-19A22E296A7C" + }, + { + "providerName": "Microsoft-Antimalware-NIS", + "providerGuid": "102AAB0A-9D9C-4887-A860-55DE33B96595" + }, + { + "providerName": "Microsoft-Antimalware-Protection", + "providerGuid": "E4B70372-261F-4C54-8FA6-A5A7914D73DA" + }, + { + "providerName": "Microsoft-Antimalware-RTP", + "providerGuid": "8E92DEEF-5E17-413B-B927-59B2F06A3CFC" + }, + { + "providerName": "Microsoft-Antimalware-Scan-Interface", + "providerGuid": "2A576B87-09A7-520E-C21A-4942F0271D67" + }, + { + "providerName": "Microsoft-Antimalware-Service", + "providerGuid": "751EF305-6C6E-4FED-B847-02EF79D26AEF" + }, + { + "providerName": "Microsoft-Antimalware-UacScan", + "providerGuid": "D37E7910-79C8-57C4-DA77-52BB646364CD" + }, + { + "providerName": "Microsoft-AppV-Client", + "providerGuid": "E4F68870-5AE8-4E5B-9CE7-CA9ED75B0245" + }, + { + "providerName": "Microsoft-AppV-Client-StreamingUX", + "providerGuid": "28CB46C7-4003-4E50-8BD9-442086762D12" + }, + { + "providerName": "Microsoft-AppV-ServiceLog", + "providerGuid": "9CC69D1C-7917-4ACD-8066-6BF8B63E551B" + }, + { + "providerName": "Microsoft-AppV-SharedPerformance", + "providerGuid": "FB4A19EE-EB5A-47A4-BC52-E71AAC6D0859" + }, + { + "providerName": "Microsoft-Autopilot-BootstrapperAgent", + "providerGuid": "CB1FF6D6-3248-4484-B96E-0973F64838C4" + }, + { + "providerName": "Microsoft-Client-License-Flexible-Platform", + "providerGuid": "6E0DF32C-7F11-54F7-E8EE-5AD4032727CE" + }, + { + "providerName": "Microsoft-Client-Licensing-Platform", + "providerGuid": "B6CC0D55-9ECC-49A8-B929-2B9022426F2A" + }, + { + "providerName": "Microsoft-ConfigMgr", + "providerGuid": "FD6007DE-16D4-4D5B-A6D7-19AAD3211528" + }, + { + "providerName": "Microsoft-Epm-Events", + "providerGuid": "56B809B5-D9E6-4F21-A807-2A1E3ED4159E" + }, + { + "providerName": "Microsoft-Gaming-Services", + "providerGuid": "BC1BDB57-71A2-581A-147B-E0B49474A2D4" + }, + { + "providerName": "Microsoft-IE", + "providerGuid": "9E3B3947-CA5D-4614-91A2-7B624E0E7244" + }, + { + "providerName": "Microsoft-IE-JSDumpHeap", + "providerGuid": "7F8E35CA-68E8-41B9-86FE-D6ADC5B327E7" + }, + { + "providerName": "Microsoft-IEFRAME", + "providerGuid": "5C8BB950-959E-4309-8908-67961A1205D5" + }, + { + "providerName": "Microsoft-Intune-ControlConfig-Client-Telemetry", + "providerGuid": "9D7ADB63-2E58-4503-B3CE-9017D7C88537" + }, + { + "providerName": "Microsoft-Intune-Epm-Client-Telemetry", + "providerGuid": "8AD61205-8E7E-4BE4-8D30-E2480500B39A" + }, + { + "providerName": "Microsoft-Intune-Sidecar-Client-Telemetry", + "providerGuid": "E20927AF-32D7-4D5D-9F73-82F077A1C891" + }, + { + "providerName": "Microsoft-Inventory-Events", + "providerGuid": "5E6AC3D4-6A7E-4FDC-98F8-7017E4F177BF" + }, + { + "providerName": "Microsoft-JScript", + "providerGuid": "57277741-3638-4A4B-BDBA-0AC6E45DA56C" + }, + { + "providerName": "Microsoft-Office-Events", + "providerGuid": "8736922D-E8B2-47EB-8564-23E77E728CF3" + }, + { + "providerName": "Microsoft-Office-Word", + "providerGuid": "DAF0B914-9C1C-450A-81B2-FEA7244F6FFA" + }, + { + "providerName": "Microsoft-Office-Word2", + "providerGuid": "BB00E856-A12F-4AB7-B2C8-4E80CAEA5B07" + }, + { + "providerName": "Microsoft-Office-Word3", + "providerGuid": "A1B69D49-2195-4F59-9D33-BDF30C0FE473" + }, + { + "providerName": "Microsoft-OneCore-OnlineSetup", + "providerGuid": "41862974-DA3B-4F0B-97D5-BB29FBB9B71E" + }, + { + "providerName": "Microsoft-PerfTrack-IEFRAME", + "providerGuid": "B2A40F1F-A05A-4DFD-886A-4C4F18C4334C" + }, + { + "providerName": "Microsoft-PerfTrack-MSHTML", + "providerGuid": "FFDB9886-80F3-4540-AA8B-B85192217DDF" + }, + { + "providerName": "Microsoft-Quic", + "providerGuid": "FF15E657-4F26-570E-88AB-0796B258D11C" + }, + { + "providerName": "Microsoft-ServiceBus-Client", + "providerGuid": "A307C7A2-A4CD-4D22-8093-94DB72934152" + }, + { + "providerName": "Microsoft-System-Diagnostics-DiagnosticInvoker", + "providerGuid": "9068A924-F97E-5506-C3A3-5C020C00E8E0" + }, + { + "providerName": "Microsoft-User Experience Virtualization-Admin", + "providerGuid": "61BC445E-7A8D-420E-AB36-9C7143881B98" + }, + { + "providerName": "Microsoft-User Experience Virtualization-Agent Driver", + "providerGuid": "DE29CF61-5EE6-43FF-9AAC-959C4E13CC6C" + }, + { + "providerName": "Microsoft-User Experience Virtualization-App Agent", + "providerGuid": "1ED6976A-4171-4764-B415-7EA08BC46C51" + }, + { + "providerName": "Microsoft-User Experience Virtualization-IPC", + "providerGuid": "21D79DB0-8E03-41CD-9589-F3EF7001A92A" + }, + { + "providerName": "Microsoft-User Experience Virtualization-SQM Uploader", + "providerGuid": "57003E21-269B-4BDC-8434-B3BF8D57D2D5" + }, + { + "providerName": "Microsoft-Windows Networking VPN Plugin Platform", + "providerGuid": "E5FC4A0F-7198-492F-9B0F-88FDCBFDED48" + }, + { + "providerName": "Microsoft-Windows-AAD", + "providerGuid": "4DE9BC9C-B27A-43C9-8994-0915F1A5E24F" + }, + { + "providerName": "Microsoft-Windows-AADRT", + "providerGuid": "2DCA52AC-167D-4D59-A491-C237BB978D83" + }, + { + "providerName": "Microsoft-Windows-AccelLib-AccelCx", + "providerGuid": "9C4CF201-DD11-5E35-9DE5-2C2146832011" + }, + { + "providerName": "Microsoft-Windows-ACL-UI", + "providerGuid": "EA4CC8B8-A150-47A3-AFB9-C8D194B19452" + }, + { + "providerName": "Microsoft-Windows-ActionQueue", + "providerGuid": "0DD4D48E-2BBF-452F-A7EC-BA3DBA8407AE" + }, + { + "providerName": "Microsoft-Windows-ADSI", + "providerGuid": "7288C9F8-D63C-4932-A345-89D6B060174D" + }, + { + "providerName": "Microsoft-Windows-AIT", + "providerGuid": "6ADDABF4-8C54-4EAB-BF4F-FBEF61B62EB0" + }, + { + "providerName": "Microsoft-Windows-All-User-Install-Agent", + "providerGuid": "D2E990DA-8504-4702-A5E5-367FC2F823BF" + }, + { + "providerName": "Microsoft-Windows-AppHost", + "providerGuid": "98E0765D-8C42-44A3-A57B-760D7F93225A" + }, + { + "providerName": "Microsoft-Windows-AppID", + "providerGuid": "3CB2A168-FE19-4A4E-BDAD-DCF422F13473" + }, + { + "providerName": "Microsoft-Windows-AppIDServiceTrigger", + "providerGuid": "D02A9C27-79B8-40D6-9B97-CF3F8B7B5D60" + }, + { + "providerName": "Microsoft-Windows-ApplicabilityEngine", + "providerGuid": "10A208DD-A372-421C-9D99-4FAD6DB68B62" + }, + { + "providerName": "Microsoft-Windows-Application Server-Applications", + "providerGuid": "C651F5F6-1C0D-492E-8AE1-B4EFD7C9D503" + }, + { + "providerName": "Microsoft-Windows-Application-Experience", + "providerGuid": "EEF54E71-0661-422D-9A98-82FD4940B820" + }, + { + "providerName": "Microsoft-Windows-ApplicationExperience-Cache", + "providerGuid": "6D8A3A60-40AF-445A-98CA-99359E500146" + }, + { + "providerName": "Microsoft-Windows-ApplicationExperience-LookupServiceTrigger", + "providerGuid": "18F4A5FD-FD3B-40A5-8FC2-E5D261C5D02E" + }, + { + "providerName": "Microsoft-Windows-ApplicationExperience-SwitchBack", + "providerGuid": "17D6E590-F5FE-11DC-95FF-0800200C9A66" + }, + { + "providerName": "Microsoft-Windows-ApplicationExperienceInfrastructure", + "providerGuid": "5EC13D8E-4B3F-422E-A7E7-3121A1D90C7A" + }, + { + "providerName": "Microsoft-Windows-AppLocker", + "providerGuid": "CBDA4DBF-8D5D-4F69-9578-BE14AA540D22" + }, + { + "providerName": "Microsoft-Windows-AppModel-Exec", + "providerGuid": "EB65A492-86C0-406A-BACE-9912D595BD69" + }, + { + "providerName": "Microsoft-Windows-AppModel-MessagingDataModel", + "providerGuid": "1E2462BE-B025-48DA-8C1F-7B60B8CCAE53" + }, + { + "providerName": "Microsoft-Windows-AppModel-Runtime", + "providerGuid": "F1EF270A-0D32-4352-BA52-DBAB41E1D859" + }, + { + "providerName": "Microsoft-Windows-AppModel-State", + "providerGuid": "BFF15E13-81BF-45EE-8B16-7CFEAD00DA86" + }, + { + "providerName": "Microsoft-Windows-AppReadiness", + "providerGuid": "F0BE35F8-237B-4814-86B5-ADE51192E503" + }, + { + "providerName": "Microsoft-Windows-AppSruProv", + "providerGuid": "0CC157B3-CF07-4FC2-91EE-31AC92E05FE1" + }, + { + "providerName": "Microsoft-Windows-AppXDeployment", + "providerGuid": "8127F6D4-59F9-4ABF-8952-3E3A02073D5F" + }, + { + "providerName": "Microsoft-Windows-AppXDeployment-Server", + "providerGuid": "3F471139-ACB7-4A01-B7A7-FF5DA4BA2D43" + }, + { + "providerName": "Microsoft-Windows-AppXDeployment-Server-UndockedDeh", + "providerGuid": "43833E12-078D-4D7D-8AAF-AE8C8520F18C" + }, + { + "providerName": "Microsoft-Windows-AppxPackagingOM", + "providerGuid": "BA723D81-0D0C-4F1E-80C8-54740F508DDF" + }, + { + "providerName": "Microsoft-Windows-ASN1", + "providerGuid": "D92EF8AC-99DD-4AB8-B91D-C6EBA85F3755" + }, + { + "providerName": "Microsoft-Windows-AssignedAccess", + "providerGuid": "8530DB6E-51C0-43D6-9D02-A8C2088526CD" + }, + { + "providerName": "Microsoft-Windows-AssignedAccessBroker", + "providerGuid": "F2311B48-32BE-4902-A22A-7240371DBB2C" + }, + { + "providerName": "Microsoft-Windows-AsynchronousCausality", + "providerGuid": "19A4C69A-28EB-4D4B-8D94-5F19055A1B5C" + }, + { + "providerName": "Microsoft-Windows-ATAPort", + "providerGuid": "CB587AD1-CC35-4EF1-AD93-36CC82A2D319" + }, + { + "providerName": "Microsoft-Windows-Audio", + "providerGuid": "AE4BD3BE-F36F-45B6-8D21-BDD6FB832853" + }, + { + "providerName": "Microsoft-Windows-Audit", + "providerGuid": "75EBC33E-0936-4A55-9D26-5F298F3180BF" + }, + { + "providerName": "Microsoft-Windows-Audit-CVE", + "providerGuid": "85A62A0D-7E17-485F-9D4F-749A287193A6" + }, + { + "providerName": "Microsoft-Windows-AuthenticationProvider", + "providerGuid": "DDDC1D91-51A1-4A8D-95B5-350C4EE3D809" + }, + { + "providerName": "Microsoft-Windows-AxInstallService", + "providerGuid": "DAB3B18C-3C0F-43E8-80B1-E44BC0DAD901" + }, + { + "providerName": "Microsoft-Windows-BackgroundTransfer-ContentPrefetcher", + "providerGuid": "648A0644-7D62-4FD3-8841-440064762F95" + }, + { + "providerName": "Microsoft-Windows-Base-Filtering-Engine-Connections", + "providerGuid": "121D3DA8-BAF1-4DCB-929F-2D4C9A47F7AB" + }, + { + "providerName": "Microsoft-Windows-Base-Filtering-Engine-Resource-Flows", + "providerGuid": "92765247-03A9-4AE3-A575-B42264616E78" + }, + { + "providerName": "Microsoft-Windows-Battery", + "providerGuid": "59819D0A-ADAF-46B2-8D7C-990BC39C7C15" + }, + { + "providerName": "Microsoft-Windows-BfeTriggerProvider", + "providerGuid": "54732EE5-61CA-4727-9DA1-10BE5A4F773D" + }, + { + "providerName": "Microsoft-Windows-Biometrics", + "providerGuid": "A0E3D8EA-C34F-4419-A1DB-90435B8B21D0" + }, + { + "providerName": "Microsoft-Windows-BitLocker-API", + "providerGuid": "5D674230-CA9F-11DA-A94D-0800200C9A66" + }, + { + "providerName": "Microsoft-Windows-BitLocker-DrivePreparationTool", + "providerGuid": "632F767E-0EC3-47B9-BA1C-A0E62A74728A" + }, + { + "providerName": "Microsoft-Windows-BitLocker-Driver", + "providerGuid": "651DF93B-5053-4D1E-94C5-F6E6D25908D0" + }, + { + "providerName": "Microsoft-Windows-BitLocker-Driver-Performance", + "providerGuid": "1DE130E1-C026-4CBF-BA0F-AB608E40AEEA" + }, + { + "providerName": "Microsoft-Windows-Bits-Client", + "providerGuid": "EF1CC15B-46C1-414E-BB95-E76B077BD51E" + }, + { + "providerName": "Microsoft-Windows-Bluetooth-BthLEPrepairing", + "providerGuid": "4AF188AC-E9C4-4C11-B07B-1FABC07DFEB2" + }, + { + "providerName": "Microsoft-Windows-Bluetooth-Bthmini", + "providerGuid": "DB25B328-A6F6-444F-9D97-A50E20217D16" + }, + { + "providerName": "Microsoft-Windows-Bluetooth-MTPEnum", + "providerGuid": "04268430-D489-424D-B914-0CFF741D6684" + }, + { + "providerName": "Microsoft-Windows-Bluetooth-Policy", + "providerGuid": "0602ECEF-6381-4BC0-AEDA-EB9BB919B276" + }, + { + "providerName": "Microsoft-Windows-BootUX", + "providerGuid": "67D781BD-CBD2-4BD2-AD1F-6152FB891246" + }, + { + "providerName": "Microsoft-Windows-BranchCache", + "providerGuid": "7EAFCF79-06A7-460B-8A55-BD0A0C9248AA" + }, + { + "providerName": "Microsoft-Windows-BranchCacheClientEventProvider", + "providerGuid": "E837619C-A2A8-4689-833F-47B48EBD2442" + }, + { + "providerName": "Microsoft-Windows-BranchCacheEventProvider", + "providerGuid": "DD85457F-4E2D-44A5-A7A7-6253362E34DC" + }, + { + "providerName": "Microsoft-Windows-BranchCacheMonitoring", + "providerGuid": "A2F55524-8EBC-45FD-88E4-A1B39F169E08" + }, + { + "providerName": "Microsoft-Windows-BranchCacheSMB", + "providerGuid": "4A933674-FB3D-4E8D-B01D-17EE14E91A3E" + }, + { + "providerName": "Microsoft-Windows-BrokerInfrastructure", + "providerGuid": "E6835967-E0D2-41FB-BCEC-58387404E25A" + }, + { + "providerName": "Microsoft-Windows-BTH-BTHPORT", + "providerGuid": "8A1F9517-3A8C-4A9E-A018-4F17A200F277" + }, + { + "providerName": "Microsoft-Windows-BTH-BTHUSB", + "providerGuid": "33693E1D-246A-471B-83BE-3E75F47A832D" + }, + { + "providerName": "Microsoft-Windows-Build-RegDll", + "providerGuid": "D39B6336-CFCB-483B-8C76-7C3E7D02BCB8" + }, + { + "providerName": "Microsoft-Windows-CAPI2", + "providerGuid": "5BBCA4A8-B209-48DC-A8C7-B23D3E5216FB" + }, + { + "providerName": "Microsoft-Windows-CDROM", + "providerGuid": "9B6123DC-9AF6-4430-80D7-7D36F054FB9F" + }, + { + "providerName": "Microsoft-Windows-CertificateServicesClient", + "providerGuid": "73370BD6-85E5-430B-B60A-FEA1285808A7" + }, + { + "providerName": "Microsoft-Windows-CertificateServicesClient-AutoEnrollment", + "providerGuid": "F0DB7EF8-B6F3-4005-9937-FEB77B9E1B43" + }, + { + "providerName": "Microsoft-Windows-CertificateServicesClient-CertEnroll", + "providerGuid": "54164045-7C50-4905-963F-E5BC1EEF0CCA" + }, + { + "providerName": "Microsoft-Windows-CertificateServicesClient-CredentialRoaming", + "providerGuid": "89A2278B-C662-4AFF-A06C-46AD3F220BCA" + }, + { + "providerName": "Microsoft-Windows-CertificateServicesClient-Lifecycle-System", + "providerGuid": "BC0669E1-A10D-4A78-834E-1CA3C806C93B" + }, + { + "providerName": "Microsoft-Windows-CertificateServicesClient-Lifecycle-User", + "providerGuid": "BEA18B89-126F-4155-9EE4-D36038B02680" + }, + { + "providerName": "Microsoft-Windows-CertificationAuthorityClient-CertCli", + "providerGuid": "98BF1CD3-583E-4926-95EE-A61BF3F46470" + }, + { + "providerName": "Microsoft-Windows-CertPolEng", + "providerGuid": "AF9CC194-E9A8-42BD-B0D1-834E9CFAB799" + }, + { + "providerName": "Microsoft-Windows-Cleanmgr", + "providerGuid": "9AE87B12-A014-5288-92DF-E3030981EBAB" + }, + { + "providerName": "Microsoft-Windows-ClearTypeTextTuner", + "providerGuid": "0A88862D-20A3-4C1F-B76F-162C55ADBF93" + }, + { + "providerName": "Microsoft-Windows-CloudFiles-Filter", + "providerGuid": "4580BB06-BAED-5B62-A4D5-92FA7156E7DB" + }, + { + "providerName": "Microsoft-Windows-CloudRestoreLauncher", + "providerGuid": "DC327E90-7748-58ED-F39C-8A8987CFAC58" + }, + { + "providerName": "Microsoft-Windows-CloudStore", + "providerGuid": "741BB90C-A7A3-49D6-BD82-1E6B858403F7" + }, + { + "providerName": "Microsoft-Windows-CmiSetup", + "providerGuid": "75EBC33E-0CC6-49DA-8CD9-8903A5222AA0" + }, + { + "providerName": "Microsoft-Windows-CodeIntegrity", + "providerGuid": "4EE76BD8-3CF4-44A0-A0AC-3937643E37A3" + }, + { + "providerName": "Microsoft-Windows-COM", + "providerGuid": "D4263C98-310C-4D97-BA39-B55354F08584" + }, + { + "providerName": "Microsoft-Windows-COM-Perf", + "providerGuid": "B8D6861B-D20F-4EEC-BBAE-87E0DD80602B" + }, + { + "providerName": "Microsoft-Windows-COM-RundownInstrumentation", + "providerGuid": "2957313D-FCAA-5D4A-2F69-32CE5F0AC44E" + }, + { + "providerName": "Microsoft-Windows-ComDlg32", + "providerGuid": "7F912B92-21AD-496E-B97A-88622A72BC42" + }, + { + "providerName": "Microsoft-Windows-Compat-Appraiser", + "providerGuid": "442C11C5-304B-45A4-AE73-DC2194C4E876" + }, + { + "providerName": "Microsoft-Windows-Complus", + "providerGuid": "0F177893-4A9C-4709-B921-F432D67F43D5" + }, + { + "providerName": "Microsoft-Windows-COMRuntime", + "providerGuid": "BF406804-6AFA-46E7-8A48-6C357E1D6D61" + }, + { + "providerName": "Microsoft-Windows-Configuration-Change-Monitor", + "providerGuid": "A148CF02-BE6D-5F08-94E3-B68DE60D8422" + }, + { + "providerName": "Microsoft-Windows-Containers-BindFlt", + "providerGuid": "FC4E8F51-7A04-4BAB-8B91-6321416F72AB" + }, + { + "providerName": "Microsoft-Windows-Containers-Wcifs", + "providerGuid": "AEC5C129-7C10-407D-BE97-91A042C61AAA" + }, + { + "providerName": "Microsoft-Windows-CoreSystem-InitMachineConfig", + "providerGuid": "0B886108-1899-4D3A-9C0D-42D8FC4B9108" + }, + { + "providerName": "Microsoft-Windows-CoreSystem-NetProvision-JoinProviderOnline", + "providerGuid": "3629DD4D-D6F1-4302-A623-0768B51501C7" + }, + { + "providerName": "Microsoft-Windows-CoreSystem-SmsRouter", + "providerGuid": "A9C11050-9E93-4FA4-8FE0-7C4750A345B2" + }, + { + "providerName": "Microsoft-Windows-CoreWindow", + "providerGuid": "A3D95055-34CC-4E4A-B99F-EC88F5370495" + }, + { + "providerName": "Microsoft-Windows-CorruptedFileRecovery-Client", + "providerGuid": "BA093605-3909-4345-990B-26B746ADEE0A" + }, + { + "providerName": "Microsoft-Windows-CorruptedFileRecovery-Server", + "providerGuid": "D6F68875-CDF5-43A5-A3E3-53FFD683311C" + }, + { + "providerName": "Microsoft-Windows-Crashdump", + "providerGuid": "ECDAACFA-6FE9-477C-B5F0-85B76F8F50AA" + }, + { + "providerName": "Microsoft-Windows-CredUI", + "providerGuid": "5A24FCDB-1CF3-477B-B422-EF4909D51223" + }, + { + "providerName": "Microsoft-Windows-Crypto-BCrypt", + "providerGuid": "C7E089AC-BA2A-11E0-9AF7-68384824019B" + }, + { + "providerName": "Microsoft-Windows-Crypto-CNG", + "providerGuid": "E3E0E2F0-C9C5-11E0-8AB9-9EBC4824019B" + }, + { + "providerName": "Microsoft-Windows-Crypto-DPAPI", + "providerGuid": "89FE8F40-CDCE-464E-8217-15EF97D4C7C3" + }, + { + "providerName": "Microsoft-Windows-Crypto-DSSEnh", + "providerGuid": "43DAD447-735F-4829-A6FF-9829A87419FF" + }, + { + "providerName": "Microsoft-Windows-Crypto-NCrypt", + "providerGuid": "E8ED09DC-100C-45E2-9FC8-B53399EC1F70" + }, + { + "providerName": "Microsoft-Windows-Crypto-RNG", + "providerGuid": "54D5AC20-E14F-4FDA-92DA-EBF7556FF176" + }, + { + "providerName": "Microsoft-Windows-Crypto-RSAEnh", + "providerGuid": "152FDB2B-6E9D-4B60-B317-815D5F174C4A" + }, + { + "providerName": "Microsoft-Windows-D3D10Level9", + "providerGuid": "7E7D3382-023C-43CB-95D2-6F0CA6D70381" + }, + { + "providerName": "Microsoft-Windows-D3D9", + "providerGuid": "783ACA0A-790E-4D7F-8451-AA850511C6B9" + }, + { + "providerName": "Microsoft-Windows-DAL-Provider", + "providerGuid": "7E87506F-BACE-4BF1-BC09-3A1F37045C71" + }, + { + "providerName": "Microsoft-Windows-Data-Pdf", + "providerGuid": "B97561FE-B27A-4C48-AA3E-7D3ADDC105B1" + }, + { + "providerName": "Microsoft-Windows-DataIntegrityScan", + "providerGuid": "13BC4371-4E21-4E46-A84F-8C0FFB548CED" + }, + { + "providerName": "Microsoft-Windows-DateTimeControlPanel", + "providerGuid": "741FC222-44ED-4BA7-98E3-F405B2D2C4B4" + }, + { + "providerName": "Microsoft-Windows-DCLocator", + "providerGuid": "CFAA5446-C6C4-4F5C-866F-31C9B55B962D" + }, + { + "providerName": "Microsoft-Windows-DDisplay", + "providerGuid": "75051C9D-2833-4A29-8923-046DB7A432CA" + }, + { + "providerName": "Microsoft-Windows-Deduplication", + "providerGuid": "F9FE3908-44B8-48D9-9A32-5A763FF5ED79" + }, + { + "providerName": "Microsoft-Windows-Deduplication-Change", + "providerGuid": "1D5E499D-739C-45A6-A3E1-8CBE0A352BEB" + }, + { + "providerName": "Microsoft-Windows-Defrag-Core", + "providerGuid": "E3257C8C-C7CB-444F-9DA0-5D92A2625289" + }, + { + "providerName": "Microsoft-Windows-DeliveryOptimization", + "providerGuid": "F8AD09BA-419C-5134-1750-270F4D0FB889" + }, + { + "providerName": "Microsoft-Windows-Deplorch", + "providerGuid": "B9DA9FE6-AE5F-4F3E-B2FA-8E623C11DC75" + }, + { + "providerName": "Microsoft-Windows-DesktopActivityModerator", + "providerGuid": "32DD13DF-9C0B-4C3B-B854-EE76C050F5F4" + }, + { + "providerName": "Microsoft-Windows-DeviceAssociationService", + "providerGuid": "56C71C31-CFBD-4CDD-8559-505E042BBBE1" + }, + { + "providerName": "Microsoft-Windows-DeviceConfidence", + "providerGuid": "1D5990C1-EC62-49F0-9E37-1F4DB12DB41E" + }, + { + "providerName": "Microsoft-Windows-DeviceGuard", + "providerGuid": "F717D024-F5B4-4F03-9AB9-331B2DC38FFB" + }, + { + "providerName": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider", + "providerGuid": "3DA494E4-0FE2-415C-B895-FB5265C5C83B" + }, + { + "providerName": "Microsoft-Windows-DeviceManagement-Pushrouter", + "providerGuid": "F1201B5A-E170-42B6-8D20-B57AC57E6416" + }, + { + "providerName": "Microsoft-Windows-Devices-AccessBroker", + "providerGuid": "64FB8D23-F0B6-5D2D-B1F6-488303C1761F" + }, + { + "providerName": "Microsoft-Windows-Devices-Background", + "providerGuid": "64EF2B1C-4AE1-4E64-8599-1636E441EC88" + }, + { + "providerName": "Microsoft-Windows-Devices-Query", + "providerGuid": "DF63D0DC-97C2-5E48-C1CC-7B46BFD4DF88" + }, + { + "providerName": "Microsoft-Windows-DeviceSetupManager", + "providerGuid": "FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2" + }, + { + "providerName": "Microsoft-Windows-DeviceSync", + "providerGuid": "09EC9687-D7AD-40CA-9C5E-78A04A5AE993" + }, + { + "providerName": "Microsoft-Windows-DeviceUpdateAgent", + "providerGuid": "E8F9AF91-AFBE-5A03-DFEC-5D591686326C" + }, + { + "providerName": "Microsoft-Windows-DeviceUx", + "providerGuid": "DED165CF-485D-4770-A3E7-9C5F0320E80C" + }, + { + "providerName": "Microsoft-Windows-DevMgmt-UefiCsp", + "providerGuid": "739D66D8-76C4-4004-873F-169AE5C6EACA" + }, + { + "providerName": "Microsoft-Windows-DfsSvc", + "providerGuid": "7DA4FE0E-FD42-4708-9AA5-89B77A224885" + }, + { + "providerName": "Microsoft-Windows-Dhcp-Client", + "providerGuid": "15A7A4F8-0072-4EAB-ABAD-F98A4D666AED" + }, + { + "providerName": "Microsoft-Windows-DHCPv6-Client", + "providerGuid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778" + }, + { + "providerName": "Microsoft-Windows-DiagCpl", + "providerGuid": "1A396961-5F3C-4C71-8310-44C653C0BF8A" + }, + { + "providerName": "Microsoft-Windows-Diagnosis-AdvancedTaskManager", + "providerGuid": "178DADAF-7AC4-4593-AB3E-A45FDA6D0D55" + }, + { + "providerName": "Microsoft-Windows-Diagnosis-DPS", + "providerGuid": "6BBA3851-2C7E-4DEA-8F54-31E5AFD029E3" + }, + { + "providerName": "Microsoft-Windows-Diagnosis-MSDE", + "providerGuid": "A50B09F8-93EB-4396-84C9-DC921259F952" + }, + { + "providerName": "Microsoft-Windows-Diagnosis-PCW", + "providerGuid": "AABF8B86-7936-4FA2-ACB0-63127F879DBF" + }, + { + "providerName": "Microsoft-Windows-Diagnosis-PLA", + "providerGuid": "E4D53F84-7DE3-11D8-9435-505054503030" + }, + { + "providerName": "Microsoft-Windows-Diagnosis-Scheduled", + "providerGuid": "40AB57C2-1C53-4DF9-9324-FF7CF898A02C" + }, + { + "providerName": "Microsoft-Windows-Diagnosis-Scripted", + "providerGuid": "E1DD7E52-621D-44E3-A1AD-0370C2B25946" + }, + { + "providerName": "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider", + "providerGuid": "9363CCD9-D429-4452-9ADB-2501E704B810" + }, + { + "providerName": "Microsoft-Windows-Diagnosis-WDC", + "providerGuid": "05921578-2261-42C7-A0D3-26DDBCE6C50D" + }, + { + "providerName": "Microsoft-Windows-Diagnosis-WDI", + "providerGuid": "E01B1A7C-C5C9-4E67-99A9-5E85ACFB2E10" + }, + { + "providerName": "Microsoft-Windows-Diagnostics-LoggingChannel", + "providerGuid": "4BD2826E-54A1-4BA9-BF63-92B73EA1AC4A" + }, + { + "providerName": "Microsoft-Windows-Diagnostics-Networking", + "providerGuid": "36C23E18-0E66-11D9-BBEB-505054503030" + }, + { + "providerName": "Microsoft-Windows-Diagnostics-Performance", + "providerGuid": "CFC18EC0-96B1-4EBA-961B-622CAEE05B0A" + }, + { + "providerName": "Microsoft-Windows-Diagnostics-PerfTrack", + "providerGuid": "030F2F57-ABD0-4427-BCF1-3A3587D7DC7D" + }, + { + "providerName": "Microsoft-Windows-Direct3D10", + "providerGuid": "9B7E4C0F-342C-4106-A19F-4F2704F689F0" + }, + { + "providerName": "Microsoft-Windows-Direct3D10_1", + "providerGuid": "9B7E4C8F-342C-4106-A19F-4F2704F689F0" + }, + { + "providerName": "Microsoft-Windows-Direct3D11", + "providerGuid": "DB6F6DDB-AC77-4E88-8253-819DF9BBF140" + }, + { + "providerName": "Microsoft-Windows-Direct3D12", + "providerGuid": "5D8087DD-3A9B-4F56-90DF-49196CDC4F11" + }, + { + "providerName": "Microsoft-Windows-Direct3DShaderCache", + "providerGuid": "2D4EBCA6-EA64-453F-A292-AE2EA0EE513B" + }, + { + "providerName": "Microsoft-Windows-DirectComposition", + "providerGuid": "C44219D0-F344-11DF-A5E2-B307DFD72085" + }, + { + "providerName": "Microsoft-Windows-DirectManipulation", + "providerGuid": "5786E035-EF2D-4178-84F2-5A6BBEDBB947" + }, + { + "providerName": "Microsoft-Windows-Directory-Services-SAM", + "providerGuid": "0D4FDC09-8C27-494A-BDA0-505E4FD8ADAE" + }, + { + "providerName": "Microsoft-Windows-Directory-Services-SAM-Utility", + "providerGuid": "BD8FEA17-5549-4B49-AA03-1981D16396A9" + }, + { + "providerName": "Microsoft-Windows-DirectShow-Core", + "providerGuid": "968F313B-097F-4E09-9CDD-BC62692D138B" + }, + { + "providerName": "Microsoft-Windows-DirectShow-KernelSupport", + "providerGuid": "3CC2D4AF-DA5E-4ED4-BCBE-3CF995940483" + }, + { + "providerName": "Microsoft-Windows-DirectSound", + "providerGuid": "8A93B54B-C75A-49B5-A5BE-9060715B1A33" + }, + { + "providerName": "Microsoft-Windows-Disk", + "providerGuid": "6B4DB0BC-9A3D-467D-81B9-A84C6F2F3D40" + }, + { + "providerName": "Microsoft-Windows-DiskDiagnostic", + "providerGuid": "E670A5A2-CE74-4AB4-9347-61B815319F4C" + }, + { + "providerName": "Microsoft-Windows-DiskDiagnosticDataCollector", + "providerGuid": "E104FB41-6B04-4F3A-B47D-F0DF2F02B954" + }, + { + "providerName": "Microsoft-Windows-DiskDiagnosticResolver", + "providerGuid": "6B1FFE48-5B1E-4793-9F7F-AE926454499D" + }, + { + "providerName": "Microsoft-Windows-Dism-Api", + "providerGuid": "75B0DA21-8B50-42EB-9448-EC48B1729B57" + }, + { + "providerName": "Microsoft-Windows-Dism-Cli", + "providerGuid": "2F959466-24D4-4972-8729-0D5E3539EBC3" + }, + { + "providerName": "Microsoft-Windows-Display", + "providerGuid": "6ECE3302-FEE1-4EA9-8B88-086D459ED976" + }, + { + "providerName": "Microsoft-Windows-DisplayColorCalibration", + "providerGuid": "3239EB6F-C7FC-4953-AA15-646829A4CA4C" + }, + { + "providerName": "Microsoft-Windows-DisplaySwitch", + "providerGuid": "192EDE41-9175-4C86-AC02-9D003C9D43AB" + }, + { + "providerName": "Microsoft-Windows-DistributedCOM", + "providerGuid": "1B562E86-B7AA-4131-BADC-B6F3A001407E" + }, + { + "providerName": "Microsoft-Windows-DLNA-Namespace", + "providerGuid": "D38FB874-33E4-4DCF-911E-1B53BB106D53" + }, + { + "providerName": "Microsoft-Windows-DNS-Client", + "providerGuid": "1C95126E-7EEA-49A9-A3FE-A378B03DDB4D" + }, + { + "providerName": "Microsoft-Windows-Documents", + "providerGuid": "C89B991E-3B48-49B2-80D3-AC000DFC9749" + }, + { + "providerName": "Microsoft-Windows-DomainJoinManagerTriggerProvider", + "providerGuid": "5B004607-1087-4F16-B10E-979685A8D131" + }, + { + "providerName": "Microsoft-Windows-DotNETRuntime", + "providerGuid": "E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4" + }, + { + "providerName": "Microsoft-Windows-DotNETRuntimeRundown", + "providerGuid": "A669021C-C450-4609-A035-5AF59AF4DF18" + }, + { + "providerName": "Microsoft-Windows-DriverFrameworks-KernelMode-Performance", + "providerGuid": "486A5C7C-11CC-46C5-9DE7-43DFE0BB57C1" + }, + { + "providerName": "Microsoft-Windows-DriverFrameworks-UserMode", + "providerGuid": "2E35AAEB-857F-4BEB-A418-2E6C0E54D988" + }, + { + "providerName": "Microsoft-Windows-DriverFrameworks-UserMode-Performance", + "providerGuid": "9FA5DD5D-999E-466A-8CA9-7B3A66F8882F" + }, + { + "providerName": "Microsoft-Windows-DriverProxy", + "providerGuid": "45C0E4CB-5120-5F84-0418-8A18ED702E9A" + }, + { + "providerName": "Microsoft-Windows-DSC", + "providerGuid": "50DF9E12-A8C4-4939-B281-47E1325BA63E" + }, + { + "providerName": "Microsoft-Windows-DUI", + "providerGuid": "8360BD0F-A7DC-4391-91A7-A457C5C381E4" + }, + { + "providerName": "Microsoft-Windows-DUSER", + "providerGuid": "8429E243-345B-47C1-8A91-2C94CAF0DAAB" + }, + { + "providerName": "Microsoft-Windows-DVD", + "providerGuid": "E18D0FCA-9515-4232-98E4-89E456D8551B" + }, + { + "providerName": "Microsoft-Windows-Dwm-Api", + "providerGuid": "292A52C4-FA27-4461-B526-54A46430BD54" + }, + { + "providerName": "Microsoft-Windows-Dwm-Compositor", + "providerGuid": "044A9015-D96C-5DD1-0199-72D258325298" + }, + { + "providerName": "Microsoft-Windows-Dwm-Core", + "providerGuid": "9E9BBA3C-2E38-40CB-99F4-9E8281425164" + }, + { + "providerName": "Microsoft-Windows-Dwm-Dwm", + "providerGuid": "D29D56EA-4867-4221-B02E-CFD998834075" + }, + { + "providerName": "Microsoft-Windows-Dwm-Redir", + "providerGuid": "7D99F6A4-1BEC-4C09-9703-3AAA8148347F" + }, + { + "providerName": "Microsoft-Windows-Dwm-Udwm", + "providerGuid": "A2D1C713-093B-43A7-B445-D09370EC9F47" + }, + { + "providerName": "Microsoft-Windows-DXGI", + "providerGuid": "CA11C036-0102-4A2D-A6AD-F03CFED5D3C9" + }, + { + "providerName": "Microsoft-Windows-DXGIDebug", + "providerGuid": "F1FF64EF-FAF3-5699-8E51-F6EC2FBD97D1" + }, + { + "providerName": "Microsoft-Windows-DxgKrnl", + "providerGuid": "802EC45A-1E99-4B83-9920-87C98277BA9D" + }, + { + "providerName": "Microsoft-Windows-DxgKrnl-SysMm", + "providerGuid": "9DE90B19-62C4-511D-A1C5-9E990812D18B" + }, + { + "providerName": "Microsoft-Windows-DXP", + "providerGuid": "728B8C72-0F0F-4071-9BCC-27CB3B6DACBE" + }, + { + "providerName": "Microsoft-Windows-DxpTaskSyncProvider", + "providerGuid": "271C5228-C3FE-4E47-831F-48C3652CE5AC" + }, + { + "providerName": "Microsoft-Windows-EapHost", + "providerGuid": "6EB8DB94-FE96-443F-A366-5FE0CEE7FB1C" + }, + { + "providerName": "Microsoft-Windows-EapMethods-RasChap", + "providerGuid": "58980F4B-BD39-4A3E-B344-492ED2254A4E" + }, + { + "providerName": "Microsoft-Windows-EapMethods-RasTls", + "providerGuid": "9CC0413E-5717-4AF5-82EB-6103D8707B45" + }, + { + "providerName": "Microsoft-Windows-EapMethods-Sim", + "providerGuid": "3D42A67D-9CE8-4284-B755-2550672B0CE0" + }, + { + "providerName": "Microsoft-Windows-EapMethods-Ttls", + "providerGuid": "D710D46C-235D-4798-AC20-9F83E1DCD557" + }, + { + "providerName": "Microsoft-Windows-EaseOfAccess", + "providerGuid": "74B4A4B1-2302-4768-AC5B-9773DD456B08" + }, + { + "providerName": "Microsoft-Windows-EDP-AppLearning", + "providerGuid": "9803DAA0-81BA-483A-986C-F0E395B9F8D1" + }, + { + "providerName": "Microsoft-Windows-EDP-Audit-Regular", + "providerGuid": "50F99B2D-96D2-421F-BE4C-222C4140DA9F" + }, + { + "providerName": "Microsoft-Windows-EDP-Audit-TCB", + "providerGuid": "287D59B6-79BA-4741-A08B-2FEDEEDE6435" + }, + { + "providerName": "Microsoft-Windows-EFS", + "providerGuid": "3663A992-84BE-40EA-BBA9-90C7ED544222" + }, + { + "providerName": "Microsoft-Windows-ELS-Hyphenation", + "providerGuid": "51AEDB05-890B-4ADE-8BA1-0BA14B8E8973" + }, + { + "providerName": "Microsoft-Windows-EndpointTriggerProvider", + "providerGuid": "92AAB24D-D9A9-4A60-9F94-201FED3E3E88" + }, + { + "providerName": "Microsoft-Windows-Energy-Estimation-Engine", + "providerGuid": "DDCC3826-A68A-4E0D-BCFD-9C06C27C6948" + }, + { + "providerName": "Microsoft-Windows-EnergyEfficiencyWizard", + "providerGuid": "1A772F65-BE1E-4FC6-96BB-248E03FA60F5" + }, + { + "providerName": "Microsoft-Windows-EnhancedPhishingProtection-Events", + "providerGuid": "E8ABC5FB-BF87-5462-278D-1B5E18775A8F" + }, + { + "providerName": "Microsoft-Windows-EnhancedStorage-ClassDriver", + "providerGuid": "F6CF91BE-E7D7-57D6-2A3D-278CA406D190" + }, + { + "providerName": "Microsoft-Windows-EnhancedStorage-EhStorTcgDrv", + "providerGuid": "AA3AA23B-BB6D-425A-B58C-1D7E37F5D02A" + }, + { + "providerName": "Microsoft-Windows-EQoS", + "providerGuid": "54CB22FF-26B4-4393-A8C2-6B0715912C5F" + }, + { + "providerName": "Microsoft-Windows-ErrorReportingConsole", + "providerGuid": "017247F2-7E96-11DC-8314-0800200C9A66" + }, + { + "providerName": "Microsoft-Windows-ESE", + "providerGuid": "478EA8A8-00BE-4BA6-8E75-8B9DC7DB9F78" + }, + { + "providerName": "Microsoft-Windows-EventCollector", + "providerGuid": "B977CF02-76F6-DF84-CC1A-6A4B232322B6" + }, + { + "providerName": "Microsoft-Windows-Eventlog", + "providerGuid": "FC65DDD8-D6EF-4962-83D5-6E5CFE9CE148" + }, + { + "providerName": "Microsoft-Windows-EventLog-WMIProvider", + "providerGuid": "35AC6CE8-6104-411D-976C-877F183D2D32" + }, + { + "providerName": "Microsoft-Windows-EventSystem", + "providerGuid": "899DAACE-4868-4295-AFCD-9EB8FB497561" + }, + { + "providerName": "Microsoft-Windows-exFAT-SQM", + "providerGuid": "494E7A3D-8DB9-4EC4-B43E-2844AF6E38D6" + }, + { + "providerName": "Microsoft-Windows-FailoverClustering-Client", + "providerGuid": "A82FDA5D-745F-409C-B0FE-18AE0678A0E0" + }, + { + "providerName": "Microsoft-Windows-Fat-SQM", + "providerGuid": "3E59A529-B0B3-4A11-8129-9FFE6BB46EB9" + }, + { + "providerName": "Microsoft-Windows-Fault-Tolerant-Heap", + "providerGuid": "6B93BF66-A922-4C11-A617-CF60D95C133D" + }, + { + "providerName": "Microsoft-Windows-FeatureConfiguration", + "providerGuid": "C2F36562-A1E4-4BC3-A6F6-01A7ADB643E8" + }, + { + "providerName": "Microsoft-Windows-Feedback-Service-TriggerProvider", + "providerGuid": "E46EEAD8-0C54-4489-9898-8FA79D059E0E" + }, + { + "providerName": "Microsoft-Windows-FileHistory-Catalog", + "providerGuid": "B447B4DC-7780-11E0-ADA3-18A90531A85A" + }, + { + "providerName": "Microsoft-Windows-FileHistory-ConfigManager", + "providerGuid": "B447B4DD-7780-11E0-ADA3-18A90531A85A" + }, + { + "providerName": "Microsoft-Windows-FileHistory-Core", + "providerGuid": "B447B4DB-7780-11E0-ADA3-18A90531A85A" + }, + { + "providerName": "Microsoft-Windows-FileHistory-Engine", + "providerGuid": "B447B4DE-7780-11E0-ADA3-18A90531A85A" + }, + { + "providerName": "Microsoft-Windows-FileHistory-EventListener", + "providerGuid": "B447B4DF-7780-11E0-ADA3-18A90531A85A" + }, + { + "providerName": "Microsoft-Windows-FileHistory-Service", + "providerGuid": "B447B4E0-7780-11E0-ADA3-18A90531A85A" + }, + { + "providerName": "Microsoft-Windows-FileHistory-UI", + "providerGuid": "B447B4E1-7780-11E0-ADA3-18A90531A85A" + }, + { + "providerName": "Microsoft-Windows-FileInfoMinifilter", + "providerGuid": "A319D300-015C-48BE-ACDB-47746E154751" + }, + { + "providerName": "Microsoft-Windows-FilterManager", + "providerGuid": "F3C5E28E-63F6-49C7-A204-E48A1BC4B09D" + }, + { + "providerName": "Microsoft-Windows-Firewall", + "providerGuid": "E595F735-B42A-494B-AFCD-B68666945CD3" + }, + { + "providerName": "Microsoft-Windows-Firewall-CPL", + "providerGuid": "546549BE-9D63-46AA-9154-4F6EB9526378" + }, + { + "providerName": "Microsoft-Windows-FirstUX-PerfInstrumentation", + "providerGuid": "FBEF8096-2CA3-4082-ACDE-DCFB47E96B72" + }, + { + "providerName": "Microsoft-Windows-FltMgrTrace_307b3ab035ae31a8462e37b4da258d1a", + "providerGuid": "307B3AB0-35AE-31A8-462E-37B4DA258D1A" + }, + { + "providerName": "Microsoft-Windows-FMS", + "providerGuid": "DEA07764-0790-44DE-B9C4-49677B17174F" + }, + { + "providerName": "Microsoft-Windows-Folder Redirection", + "providerGuid": "7D7B0C39-93F6-4100-BD96-4DDA859652C5" + }, + { + "providerName": "Microsoft-Windows-Forwarding", + "providerGuid": "699E309C-E782-4400-98C8-E21D162D7B7B" + }, + { + "providerName": "Microsoft-Windows-FunctionDiscovery", + "providerGuid": "9DB0FDB5-3B21-440E-A94B-63738A4BE5DE" + }, + { + "providerName": "Microsoft-Windows-FunctionDiscoveryHost", + "providerGuid": "538CBBAD-4877-4EB2-B26E-7CAEE8F0F8CB" + }, + { + "providerName": "Microsoft-Windows-GenericRoaming", + "providerGuid": "4EACB4D0-263B-4B93-8CD6-778A278E5642" + }, + { + "providerName": "Microsoft-Windows-GPIO-ClassExtension", + "providerGuid": "55AB77F6-FA04-43EF-AF45-688FBF500482" + }, + { + "providerName": "Microsoft-Windows-GPIOButtons", + "providerGuid": "E13FF11E-E989-4838-A9FA-38A4D13914CF" + }, + { + "providerName": "Microsoft-Windows-Graphics-Capture-Server", + "providerGuid": "7D0CBD25-390E-524D-8C1E-2A8E846055C0" + }, + { + "providerName": "Microsoft-Windows-Graphics-Printing", + "providerGuid": "E7AA32FB-77D0-477F-987D-7E83DF1B7ED0" + }, + { + "providerName": "Microsoft-Windows-Graphics-Printing3D", + "providerGuid": "BE967569-E3C8-425B-AD0E-4F2C790B1848" + }, + { + "providerName": "Microsoft-Windows-GraphicsCapture-API", + "providerGuid": "347D2CDF-F126-56D7-12B1-69E27C655D7E" + }, + { + "providerName": "Microsoft-Windows-GroupPolicy", + "providerGuid": "AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9" + }, + { + "providerName": "Microsoft-Windows-GroupPolicyTriggerProvider", + "providerGuid": "BD2F4252-5E1E-49FC-9A30-F3978AD89EE2" + }, + { + "providerName": "Microsoft-Windows-HAL", + "providerGuid": "63D1E632-95CC-4443-9312-AF927761D52A" + }, + { + "providerName": "Microsoft-Windows-HealthCenter", + "providerGuid": "588C5C5A-FFC5-44A2-9A7F-D5E8DBE6EFD7" + }, + { + "providerName": "Microsoft-Windows-HealthCenterCPL", + "providerGuid": "959F1FAC-7CA8-4ED1-89DC-CDFA7E093CB0" + }, + { + "providerName": "Microsoft-Windows-Heap-Snapshot", + "providerGuid": "901D2AFA-4FF6-46D7-8D0E-53645E1A47F5" + }, + { + "providerName": "Microsoft-Windows-HelloForBusiness", + "providerGuid": "906B8A99-63CE-58D7-86AB-10989BBD5567" + }, + { + "providerName": "Microsoft-Windows-Help", + "providerGuid": "DE513A55-C345-438B-9A74-E18CAC5C5CC5" + }, + { + "providerName": "Microsoft-Windows-hidcfu", + "providerGuid": "7628E972-6D6F-4974-B58F-6428622EC09A" + }, + { + "providerName": "Microsoft-Windows-HomeGroup-ControlPanel", + "providerGuid": "134EA407-755D-4A93-B8A6-F290CD155023" + }, + { + "providerName": "Microsoft-Windows-Host-Network-Management", + "providerGuid": "93F693DC-9163-4DEE-AF64-D855218AF242" + }, + { + "providerName": "Microsoft-Windows-Host-Network-Service", + "providerGuid": "0C885E0D-6EB6-476C-A048-2457EED3A5C1" + }, + { + "providerName": "Microsoft-Windows-HostGuardianClient-Service", + "providerGuid": "5D487FAD-104B-5CA6-CA4E-14C206850501" + }, + { + "providerName": "Microsoft-Windows-HostGuardianService-CA", + "providerGuid": "9FB3388C-A54C-4E98-BDD1-445A82ED4BF7" + }, + { + "providerName": "Microsoft-Windows-HostGuardianService-Client", + "providerGuid": "7DEE1FDC-FFA8-4087-912A-95189D6A2D7F" + }, + { + "providerName": "Microsoft-Windows-Hotpatch-Monitor", + "providerGuid": "57EAF242-3772-533C-9FD2-29ED95606D14" + }, + { + "providerName": "Microsoft-Windows-HotspotAuth", + "providerGuid": "DE095DBE-8667-4168-94C2-48CA61665ACA" + }, + { + "providerName": "Microsoft-Windows-Http-SQM-Provider", + "providerGuid": "F5344219-87A4-4399-B14A-E59CD118ABB8" + }, + { + "providerName": "Microsoft-Windows-HttpEvent", + "providerGuid": "7B6BC78C-898B-4170-BBF8-1A469EA43FC5" + }, + { + "providerName": "Microsoft-Windows-HttpLog", + "providerGuid": "C42A2738-2333-40A5-A32F-6ACC36449DCC" + }, + { + "providerName": "Microsoft-Windows-HttpService", + "providerGuid": "DD5EF90A-6398-47A4-AD34-4DCECDEF795F" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-Chipset", + "providerGuid": "DE9BA731-7F33-4F44-98C9-6CAC856B9F83" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-Compute", + "providerGuid": "17103E3F-3C6E-4677-BB17-3B267EB5BE57" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-ComputeLib", + "providerGuid": "AF7FD3A7-B248-460C-A9F5-FEC39EF8468C" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-Config", + "providerGuid": "02F3A5E3-E742-4720-85A5-F64C4184E511" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-CrashDump", + "providerGuid": "C7C9E4F7-C41D-5C68-F104-D72A920016C7" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-Debug", + "providerGuid": "EDED5085-79D0-4E31-9B4E-4299B78CBEEB" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-DynMem", + "providerGuid": "B1D080A6-F3A5-42F6-B6F1-B9FD86C088DA" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-EmulatedDevices", + "providerGuid": "DA5A028B-B248-4A75-B60A-024FE6457484" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-EmulatedNic", + "providerGuid": "09242393-1349-4F4D-9FD7-59CC79F553CE" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-EmulatedStor", + "providerGuid": "86E15E01-EDF1-4AC7-89CF-B19563FD6894" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-Guest-Drivers-Dynamic-Memory", + "providerGuid": "BA2FFB5C-E20A-4FB9-91B4-45F61B4B66A0" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-Guest-Drivers-Storage-Filter", + "providerGuid": "0B9FDCCC-451C-449C-9BD8-6756FCC6091A" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-Guest-Drivers-Vmbus", + "providerGuid": "F2E2CE31-0E8A-4E46-A03B-2E0FE97E93C2" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-Hierarchical-NIC-Switch", + "providerGuid": "31732CA5-D67C-59FD-DD5C-60A136EE4953" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-Hypervisor", + "providerGuid": "52FC89F8-995E-434C-A91E-199986449890" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-Integration", + "providerGuid": "2B74A015-3873-4C56-9928-EA80C58B2787" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-Integration-RDV", + "providerGuid": "FDFF33EC-70AA-46D3-BA65-7210009FA2A7" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-KMCL", + "providerGuid": "FA3F78FF-BA6D-4EDE-96B2-9C5BB803E3BA" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-KMCL-Child", + "providerGuid": "16D90D71-CACA-5CD9-A618-8210D93015F3" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-Netvsc", + "providerGuid": "152FBE4B-C7AD-4F68-BADA-A4FCC1464F6C" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-Serial", + "providerGuid": "8F9DF503-1D12-49EC-BB28-F6EC42D361D4" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-StorageVSP", + "providerGuid": "10B3D268-9782-49A4-AACC-A93C5482CB6F" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-SynthFcVdev", + "providerGuid": "5B621A17-3B58-4D03-94F0-314F4E9C79AE" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-SynthNic", + "providerGuid": "C29C4FB7-B60E-4FFF-9AF9-CF21F9B09A34" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-SynthStor", + "providerGuid": "EDACD782-2564-4497-ADE6-7199377850F2" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-Tpm", + "providerGuid": "13EAE551-76CA-4DDC-B974-D3A0F8D44A03" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-UiDevices", + "providerGuid": "339AAD0A-4124-4968-8147-4CBBB1F8B3D5" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-VfpExt", + "providerGuid": "9F2660EA-CFE7-428F-9850-AECA612619B0" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-VfpExt-Ifr", + "providerGuid": "DBA692D9-D755-51B8-84EE-FE38FD18F4F0" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-VID", + "providerGuid": "5931D877-4860-4EE7-A95C-610A5F0D1407" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-Virtual-PMEM", + "providerGuid": "AE3F5BF8-AB9F-56D6-29C8-8C312E2FAEC2" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-VmbusVdev", + "providerGuid": "177D1599-9764-4E3A-BF9A-C86887AADDCE" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-VMMS", + "providerGuid": "6066F867-7CA1-4418-85FD-36E3F9C0600C" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-VMSP", + "providerGuid": "1CEB22B1-97FF-4703-BEB2-333EB89B522A" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-VmSwitch", + "providerGuid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-VSmb", + "providerGuid": "7B0EA079-E3BC-424A-B2F0-E3D8478D204B" + }, + { + "providerName": "Microsoft-Windows-Hyper-V-Worker", + "providerGuid": "51DDFA29-D5C8-4803-BE4B-2ECB715570FE" + }, + { + "providerName": "Microsoft-Windows-IdCtrls", + "providerGuid": "6D7662A9-034E-4B1F-A167-67819C401632" + }, + { + "providerName": "Microsoft-Windows-IdleTriggerProvider", + "providerGuid": "9E03F75A-BCBE-428A-8F3C-D46F2A444935" + }, + { + "providerName": "Microsoft-Windows-IE-F12-Provider", + "providerGuid": "D17FFF2F-392D-478C-A41D-737A216EB2A4" + }, + { + "providerName": "Microsoft-Windows-IE-SmartScreen", + "providerGuid": "52F82079-1974-4C67-81DA-807B892778BB" + }, + { + "providerName": "Microsoft-Windows-IME-Broker", + "providerGuid": "E2C15FD7-8924-4C8C-8CFE-DA0BE539CE27" + }, + { + "providerName": "Microsoft-Windows-IME-CandidateUI", + "providerGuid": "7C4117B1-ED82-4F47-B2CA-29E4E25719C7" + }, + { + "providerName": "Microsoft-Windows-IME-CustomerFeedbackManager", + "providerGuid": "E2242B38-9453-42FD-B446-00746E76EB82" + }, + { + "providerName": "Microsoft-Windows-IME-CustomerFeedbackManagerUI", + "providerGuid": "1B734B40-A458-4B81-954F-AD7C9461BED8" + }, + { + "providerName": "Microsoft-Windows-IME-JPAPI", + "providerGuid": "31BCAC7F-4AB8-47A1-B73A-A161EE68D585" + }, + { + "providerName": "Microsoft-Windows-IME-JPLMP", + "providerGuid": "DBC388BC-89C2-4FE0-B71F-6E4881FB575C" + }, + { + "providerName": "Microsoft-Windows-IME-JPPRED", + "providerGuid": "3AD571F3-BDAE-4942-8733-4D1B85870A1E" + }, + { + "providerName": "Microsoft-Windows-IME-JPSetting", + "providerGuid": "14371053-1813-471A-9510-1CF1D0A055A8" + }, + { + "providerName": "Microsoft-Windows-IME-JPTIP", + "providerGuid": "8C8A69AD-CC89-481F-BBAD-FD95B5006256" + }, + { + "providerName": "Microsoft-Windows-IME-KRAPI", + "providerGuid": "7562948E-2671-4DDA-8F8F-BF945EF984A1" + }, + { + "providerName": "Microsoft-Windows-IME-KRTIP", + "providerGuid": "E013E74B-97F4-4E1C-A120-596E5629ECFE" + }, + { + "providerName": "Microsoft-Windows-IME-OEDCompiler", + "providerGuid": "FD44A6E7-580F-4A9C-83D9-D820B7D3A033" + }, + { + "providerName": "Microsoft-Windows-IME-TCCORE", + "providerGuid": "F67B2345-47FA-4721-A6FB-FE08110EECF7" + }, + { + "providerName": "Microsoft-Windows-IME-TCTIP", + "providerGuid": "D5268C02-6F51-436F-983B-74F2EFBFAF3A" + }, + { + "providerName": "Microsoft-Windows-IME-TIP", + "providerGuid": "BDD4B92E-19EF-4497-9C4A-E10E7FD2E227" + }, + { + "providerName": "Microsoft-Windows-Immersive-Shell", + "providerGuid": "315A8872-923E-4EA2-9889-33CD4754BF64" + }, + { + "providerName": "Microsoft-Windows-Immersive-Shell-API", + "providerGuid": "5F0E257F-C224-43E5-9555-2ADCB8540A58" + }, + { + "providerName": "Microsoft-Windows-IndirectDisplays-ClassExtension-Events", + "providerGuid": "966CD1C0-3F69-42AD-9877-517DCE8462B4" + }, + { + "providerName": "Microsoft-Windows-Input-HIDCLASS", + "providerGuid": "6465DA78-E7A0-4F39-B084-8F53C7C30DC6" + }, + { + "providerName": "Microsoft-Windows-InputSwitch", + "providerGuid": "BB8E7234-BBF4-48A7-8741-339206ED1DFB" + }, + { + "providerName": "Microsoft-Windows-Install-Agent", + "providerGuid": "E0C6F6DE-258A-50E0-AC1A-103482D118BC" + }, + { + "providerName": "Microsoft-Windows-International-RegionalOptionsControlPanel", + "providerGuid": "C6BF6832-F7BD-4151-AC21-753CE4707453" + }, + { + "providerName": "Microsoft-Windows-Iphlpsvc", + "providerGuid": "66A5C15C-4F8E-4044-BF6E-71D896038977" + }, + { + "providerName": "Microsoft-Windows-Iphlpsvc-Trace", + "providerGuid": "6600E712-C3B6-44A2-8A48-935C511F28C8" + }, + { + "providerName": "Microsoft-Windows-IPMIProvider", + "providerGuid": "2A45D52E-BBF3-4843-8E18-B356ED5F6A65" + }, + { + "providerName": "Microsoft-Windows-IPNAT", + "providerGuid": "A67075C2-3E39-4109-B6CD-6D750058A732" + }, + { + "providerName": "Microsoft-Windows-IPSEC-SRV", + "providerGuid": "C91EF675-842F-4FCF-A5C9-6EA93F2E4F8B" + }, + { + "providerName": "Microsoft-Windows-IPxlatCfg", + "providerGuid": "3E5AC668-AF52-4C15-B99B-A3E7A6616EBD" + }, + { + "providerName": "Microsoft-Windows-IsolatedUserMode", + "providerGuid": "73A33AB2-1966-4999-8ADD-868C41415269" + }, + { + "providerName": "Microsoft-Windows-KdsSvc", + "providerGuid": "89203471-D554-47D4-BDE4-7552EC219999" + }, + { + "providerName": "Microsoft-Windows-Kerberos-Local-Key-Distribution-Center", + "providerGuid": "57C834D7-0368-5D1B-8F01-1E2F89F0000D" + }, + { + "providerName": "Microsoft-Windows-Kernel-Acpi", + "providerGuid": "C514638F-7723-485B-BCFC-96565D735D4A" + }, + { + "providerName": "Microsoft-Windows-Kernel-AppCompat", + "providerGuid": "16A1ADC1-9B7F-4CD9-94B3-D8296AB1B130" + }, + { + "providerName": "Microsoft-Windows-Kernel-Audit-API-Calls", + "providerGuid": "E02A841C-75A3-4FA7-AFC8-AE09CF9B7F23" + }, + { + "providerName": "Microsoft-Windows-Kernel-Boot", + "providerGuid": "15CA44FF-4D7A-4BAA-BBA5-0998955E531E" + }, + { + "providerName": "Microsoft-Windows-Kernel-BootDiagnostics", + "providerGuid": "96AC7637-5950-4A30-B8F7-E07E8E5734C1" + }, + { + "providerName": "Microsoft-Windows-Kernel-Cache", + "providerGuid": "A2D34BF1-70AB-5B21-C819-5A0DD42748FD" + }, + { + "providerName": "Microsoft-Windows-Kernel-CPU-Partition", + "providerGuid": "3A493674-937F-5A23-F598-D56B9BD10D28" + }, + { + "providerName": "Microsoft-Windows-Kernel-CPU-Starvation", + "providerGuid": "7F54CA8A-6C72-5CBC-B96F-D0EF905B8BCE" + }, + { + "providerName": "Microsoft-Windows-Kernel-Disk", + "providerGuid": "C7BDE69A-E1E0-4177-B6EF-283AD1525271" + }, + { + "providerName": "Microsoft-Windows-Kernel-Dump", + "providerGuid": "17D2A329-4539-5F4D-3435-F510634CE3B9" + }, + { + "providerName": "Microsoft-Windows-Kernel-EventTracing", + "providerGuid": "B675EC37-BDB6-4648-BC92-F3FDC74D3CA2" + }, + { + "providerName": "Microsoft-Windows-Kernel-File", + "providerGuid": "EDD08927-9CC4-4E65-B970-C2560FB5C289" + }, + { + "providerName": "Microsoft-Windows-Kernel-General", + "providerGuid": "A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D" + }, + { + "providerName": "Microsoft-Windows-Kernel-Interrupt-Steering", + "providerGuid": "951B41EA-C830-44DC-A671-E2C9958809B8" + }, + { + "providerName": "Microsoft-Windows-Kernel-IO", + "providerGuid": "ABF1F586-2E50-4BA8-928D-49044E6F0DB7" + }, + { + "providerName": "Microsoft-Windows-Kernel-IoTrace", + "providerGuid": "A103CABD-8242-4A93-8DF5-1CDF3B3F26A6" + }, + { + "providerName": "Microsoft-Windows-Kernel-Licensing-StartServiceTrigger", + "providerGuid": "F5528ADA-BE5F-4F14-8AEF-A95DE7281161" + }, + { + "providerName": "Microsoft-Windows-Kernel-LicensingSqm", + "providerGuid": "A0AF438F-4431-41CB-A675-A265050EE947" + }, + { + "providerName": "Microsoft-Windows-Kernel-LiveDump", + "providerGuid": "BEF2AA8E-81CD-11E2-A7BB-5EAC6188709B" + }, + { + "providerName": "Microsoft-Windows-Kernel-Memory", + "providerGuid": "D1D93EF7-E1F2-4F45-9943-03D245FE6C00" + }, + { + "providerName": "Microsoft-Windows-Kernel-Network", + "providerGuid": "7DD42A49-5329-4832-8DFD-43D979153A88" + }, + { + "providerName": "Microsoft-Windows-Kernel-Pep", + "providerGuid": "5412704E-B2E1-4624-8FFD-55777B8F7373" + }, + { + "providerName": "Microsoft-Windows-Kernel-PnP", + "providerGuid": "9C205A39-1250-487D-ABD7-E831C6290539" + }, + { + "providerName": "Microsoft-Windows-Kernel-PnP-Rundown", + "providerGuid": "B3A0C2C8-83BB-4DDF-9F8D-4B22D3C38AD7" + }, + { + "providerName": "Microsoft-Windows-Kernel-Power", + "providerGuid": "331C3B3A-2005-44C2-AC5E-77220C37D6B4" + }, + { + "providerName": "Microsoft-Windows-Kernel-PowerTrigger", + "providerGuid": "AA1F73E8-15FD-45D2-ABFD-E7F64F78EB11" + }, + { + "providerName": "Microsoft-Windows-Kernel-Prefetch", + "providerGuid": "5322D61A-9EFA-4BC3-A3F9-14BE95C144F8" + }, + { + "providerName": "Microsoft-Windows-Kernel-Prm", + "providerGuid": "B931ED29-66F4-576E-0579-0B8818A5DC6B" + }, + { + "providerName": "Microsoft-Windows-Kernel-Process", + "providerGuid": "22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716" + }, + { + "providerName": "Microsoft-Windows-Kernel-Processor-Power", + "providerGuid": "0F67E49F-FE51-4E9F-B490-6F2948CC6027" + }, + { + "providerName": "Microsoft-Windows-Kernel-Registry", + "providerGuid": "70EB4F03-C1DE-4F73-A051-33D13D5413BD" + }, + { + "providerName": "Microsoft-Windows-Kernel-ShimEngine", + "providerGuid": "0BF2FB94-7B60-4B4D-9766-E82F658DF540" + }, + { + "providerName": "Microsoft-Windows-Kernel-StoreMgr", + "providerGuid": "A6AD76E3-867A-4635-91B3-4904BA6374D7" + }, + { + "providerName": "Microsoft-Windows-Kernel-Tm", + "providerGuid": "4CEC9C95-A65F-4591-B5C4-30100E51D870" + }, + { + "providerName": "Microsoft-Windows-Kernel-Tm-Trigger", + "providerGuid": "CE20D1C3-A247-4C41-BCB8-3C7F52C8B805" + }, + { + "providerName": "Microsoft-Windows-Kernel-WDI", + "providerGuid": "2FF3E6B7-CB90-4700-9621-443F389734ED" + }, + { + "providerName": "Microsoft-Windows-Kernel-WHEA", + "providerGuid": "7B563579-53C8-44E7-8236-0F87B9FE6594" + }, + { + "providerName": "Microsoft-Windows-Kernel-WSService-StartServiceTrigger", + "providerGuid": "3635D4B6-77E3-4375-8124-D545B7149337" + }, + { + "providerName": "Microsoft-Windows-Kernel-XDV", + "providerGuid": "F029AC39-38F0-4A40-B7DE-404D244004CB" + }, + { + "providerName": "Microsoft-Windows-KernelStreaming", + "providerGuid": "548C4417-CE45-41FF-99DD-528F01CE0FE1" + }, + { + "providerName": "Microsoft-Windows-KeyboardFilter", + "providerGuid": "84DE80EB-86E8-4FF6-85A6-9319ABD578A4" + }, + { + "providerName": "Microsoft-Windows-KnownFolders", + "providerGuid": "8939299F-2315-4C5C-9B91-ABB86AA0627D" + }, + { + "providerName": "Microsoft-Windows-L2NACP", + "providerGuid": "85FE7609-FF4A-48E9-9D50-12918E43E1DA" + }, + { + "providerName": "Microsoft-Windows-LanGPA", + "providerGuid": "CB070027-1534-4CF3-98EA-B9751F508376" + }, + { + "providerName": "Microsoft-Windows-LanguagePackSetup", + "providerGuid": "7237FFF9-A08A-4804-9C79-4A8704B70B87" + }, + { + "providerName": "Microsoft-Windows-LAPS", + "providerGuid": "4FCC72A9-D7CA-5DD2-8D34-6F41A0CDB7E0" + }, + { + "providerName": "Microsoft-Windows-LDAP-Client", + "providerGuid": "099614A5-5DD7-4788-8BC9-E29F43DB28FC" + }, + { + "providerName": "Microsoft-Windows-LimitsManagement", + "providerGuid": "73AA0094-FACB-4AEB-BD1D-A7B98DD5C799" + }, + { + "providerName": "Microsoft-Windows-LinkLayerDiscoveryProtocol", + "providerGuid": "DCBFB8F0-CD19-4F1C-A27D-23AC706DED72" + }, + { + "providerName": "Microsoft-Windows-LiveId", + "providerGuid": "05F02597-FE85-4E67-8542-69567AB8FD4F" + }, + { + "providerName": "Microsoft-Windows-LLTD-Mapper", + "providerGuid": "CCC64809-6B5F-4C1B-AB39-336904DA9B3B" + }, + { + "providerName": "Microsoft-Windows-LLTD-MapperIO", + "providerGuid": "0741C7BE-DAAC-4A5B-B00A-4BD9A2D89D0E" + }, + { + "providerName": "Microsoft-Windows-LLTD-Responder", + "providerGuid": "E159FC63-02FE-42F3-A234-028B9B8561CB" + }, + { + "providerName": "Microsoft-Windows-LocationServiceProvider", + "providerGuid": "8E889F0C-7D54-52B3-E4AE-2C8B27A482C2" + }, + { + "providerName": "Microsoft-Windows-LUA", + "providerGuid": "93C05D69-51A3-485E-877F-1806A8731346" + }, + { + "providerName": "Microsoft-Windows-Magnification", + "providerGuid": "C882FF1D-7585-4B33-B135-95C577179137" + }, + { + "providerName": "Microsoft-Windows-Management-SecureAssessment", + "providerGuid": "A329CF81-57EC-46ED-AB7C-261A52B0754A" + }, + { + "providerName": "Microsoft-Windows-MapControls", + "providerGuid": "ACD88D21-E1D4-4483-B974-0C1DA66CC529" + }, + { + "providerName": "Microsoft-Windows-MCCS-AccountAccessor", + "providerGuid": "4025D192-273D-42EC-BDF8-940EC34EEDCA" + }, + { + "providerName": "Microsoft-Windows-MCCS-AccountsHost", + "providerGuid": "04ECCF8E-8490-4AD1-8ED5-0AE7750E69E6" + }, + { + "providerName": "Microsoft-Windows-MCCS-AccountsRT", + "providerGuid": "DD2743C6-1722-4674-9F6F-C80044C4232E" + }, + { + "providerName": "Microsoft-Windows-MCCS-ActiveSyncCsp", + "providerGuid": "602A0873-9BDE-48B3-B6B7-277035293458" + }, + { + "providerName": "Microsoft-Windows-MCCS-ActiveSyncProvider", + "providerGuid": "4A155F10-25AD-47E6-ABA8-2C4F5EEE7846" + }, + { + "providerName": "Microsoft-Windows-MCCS-DavSyncProvider", + "providerGuid": "5D86C4E2-8FCD-48D7-A713-9A04609C0189" + }, + { + "providerName": "Microsoft-Windows-MCCS-EngineShared", + "providerGuid": "BF460FC6-45C5-4119-ADD3-E361A6E7D5AC" + }, + { + "providerName": "Microsoft-Windows-MCCS-InternetMail", + "providerGuid": "618473BC-8EEF-4868-ADFF-A1B640B06411" + }, + { + "providerName": "Microsoft-Windows-MCCS-InternetMailCsp", + "providerGuid": "BEC5E7A4-0527-42E8-8174-FABDE799AD7F" + }, + { + "providerName": "Microsoft-Windows-MCCS-NetworkHelper", + "providerGuid": "25B99A4C-2F80-4FCD-982D-69CD1F77BADF" + }, + { + "providerName": "Microsoft-Windows-MCCS-SyncController", + "providerGuid": "7FCB9791-F481-46D1-846E-2EB6F003C4D3" + }, + { + "providerName": "Microsoft-Windows-MCCS-SyncUtil", + "providerGuid": "DCA074CE-547C-4595-AE90-56229B8E3BD9" + }, + { + "providerName": "Microsoft-Windows-Media-Protection-PlayReady-Performance", + "providerGuid": "D2402FDE-7526-5A7B-501A-25DC7C9C282E" + }, + { + "providerName": "Microsoft-Windows-Media-Streaming", + "providerGuid": "982824E5-E446-46AE-BC74-836401FFB7B6" + }, + { + "providerName": "Microsoft-Windows-MediaEngine", + "providerGuid": "8F2048E0-F260-4F57-A8D1-932376291682" + }, + { + "providerName": "Microsoft-Windows-MediaFoundation-MFCaptureEngine", + "providerGuid": "B8197C10-845F-40CA-82AB-9341E98CFC2B" + }, + { + "providerName": "Microsoft-Windows-MediaFoundation-MFReadWrite", + "providerGuid": "4B7EAC67-FC53-448C-A49D-7CC6DB524DA7" + }, + { + "providerName": "Microsoft-Windows-MediaFoundation-MSVProc", + "providerGuid": "A4112D1A-6DFA-476E-BB75-E350D24934E1" + }, + { + "providerName": "Microsoft-Windows-MediaFoundation-Performance", + "providerGuid": "F404B94E-27E0-4384-BFE8-1D8D390B0AA3" + }, + { + "providerName": "Microsoft-Windows-MediaFoundation-Performance-Core", + "providerGuid": "B20E65AC-C905-4014-8F78-1B6A508142EB" + }, + { + "providerName": "Microsoft-Windows-MediaFoundation-Platform", + "providerGuid": "BC97B970-D001-482F-8745-B8D7D5759F99" + }, + { + "providerName": "Microsoft-Windows-MediaFoundation-PlayAPI", + "providerGuid": "B65471E1-019D-436F-BC38-E15FA8E87F53" + }, + { + "providerName": "Microsoft-Windows-Memory-Diagnostic-Task-Handler", + "providerGuid": "BABDA89A-4D5E-48EB-AF3D-E0E8410207C0" + }, + { + "providerName": "Microsoft-Windows-MemoryDiagnostics-Results", + "providerGuid": "5F92BC59-248F-4111-86A9-E393E12C6139" + }, + { + "providerName": "Microsoft-Windows-MemoryDiagnostics-Schedule", + "providerGuid": "73E9C9DE-A148-41F7-B1DB-4DA051FDC327" + }, + { + "providerName": "Microsoft-Windows-MF", + "providerGuid": "A7364E1A-894F-4B3D-A930-2ED9C8C4C811" + }, + { + "providerName": "Microsoft-Windows-MF-FrameServer", + "providerGuid": "9E22A3ED-7B32-4B99-B6C2-21DD6ACE01E1" + }, + { + "providerName": "Microsoft-Windows-MF-MFDshowReverseBridge", + "providerGuid": "AA1105FA-5AF2-5FD6-89B5-002421C5E2CA" + }, + { + "providerName": "Microsoft-Windows-MFH264Enc", + "providerGuid": "2A49DE31-8A5B-4D3A-A904-7FC7409AE90D" + }, + { + "providerName": "Microsoft-Windows-Minstore", + "providerGuid": "55B24B1D-DD9C-44C0-BA77-4F749F1B6976" + }, + { + "providerName": "Microsoft-Windows-MMCSS", + "providerGuid": "36008301-E154-466C-ACEC-5F4CBD6B4694" + }, + { + "providerName": "Microsoft-Windows-Mobile-Broadband-Experience-Api", + "providerGuid": "2E2BBB16-0C36-4B9B-A567-40924A199FD5" + }, + { + "providerName": "Microsoft-Windows-Mobile-Broadband-Experience-Api-Internal", + "providerGuid": "2AABD03B-F48B-419A-B4CE-7A14403F4A46" + }, + { + "providerName": "Microsoft-Windows-Mobile-Broadband-Experience-SmsApi", + "providerGuid": "0FF1C24B-7F05-45C0-ABDC-3C8521BE4F62" + }, + { + "providerName": "Microsoft-Windows-MobilityCenter", + "providerGuid": "91F42016-0B4E-4A4B-9BBB-825D06CBED35" + }, + { + "providerName": "Microsoft-Windows-mobsync", + "providerGuid": "B44AEC44-38F4-4B59-8DF3-10306ABF19B2" + }, + { + "providerName": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider", + "providerGuid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD" + }, + { + "providerName": "Microsoft-Windows-MosHost", + "providerGuid": "D116F0F2-A6D6-4F1F-BDDA-0C88C8D1F2E9" + }, + { + "providerName": "Microsoft-Windows-MountMgr", + "providerGuid": "E3BAC9F8-27BE-4823-8D7F-1CC320C05FA7" + }, + { + "providerName": "Microsoft-Windows-MP4SDECD", + "providerGuid": "7F2BD991-AE93-454A-B219-0BC23F02262A" + }, + { + "providerName": "Microsoft-Windows-MPEG2_DLNA-Encoder", + "providerGuid": "86EFFF39-2BDD-4EFD-BD0B-853D71B2A9DC" + }, + { + "providerName": "Microsoft-Windows-Mprddm", + "providerGuid": "3A5BEF13-D0F7-4E7F-9EC8-5E707DF711D0" + }, + { + "providerName": "Microsoft-Windows-MPRMSG", + "providerGuid": "F2C628AE-D26C-4352-9C45-74754E1E2F9F" + }, + { + "providerName": "Microsoft-Windows-MPS-CLNT", + "providerGuid": "37945DC2-899B-44D1-B79C-DD4A9E57FF98" + }, + { + "providerName": "Microsoft-Windows-MPS-DRV", + "providerGuid": "50BD1BFD-936B-4DB3-86BE-E25B96C25898" + }, + { + "providerName": "Microsoft-Windows-MPS-SRV", + "providerGuid": "5444519F-2484-45A2-991E-953E4B54C8E0" + }, + { + "providerName": "Microsoft-Windows-MPTF", + "providerGuid": "EA6C5BEA-F5CC-56A4-E146-671BF483D53B" + }, + { + "providerName": "Microsoft-Windows-MSDTC", + "providerGuid": "719BE4ED-E9BC-4DD8-A7CF-C85CE8E4975D" + }, + { + "providerName": "Microsoft-Windows-MSDTC 2", + "providerGuid": "5D9E0020-3761-4F36-90C8-38CE6511BD12" + }, + { + "providerName": "Microsoft-Windows-MSDTC Client", + "providerGuid": "7A67066E-193F-4D3A-82D3-322FEE5259DE" + }, + { + "providerName": "Microsoft-Windows-MSDTC Client 2", + "providerGuid": "155CB334-3D7F-4FF1-B107-DF8AFC3C0363" + }, + { + "providerName": "Microsoft-Windows-MSFTEDIT", + "providerGuid": "9640427C-7D03-4331-B8EE-FB77625BF381" + }, + { + "providerName": "Microsoft-Windows-MsiServer", + "providerGuid": "17E92E2A-3D08-413E-BAEB-A79A262BF486" + }, + { + "providerName": "Microsoft-Windows-MSMPEG2ADEC", + "providerGuid": "51311DE3-D55E-454A-9C58-43DC7B4C01D2" + }, + { + "providerName": "Microsoft-Windows-MSMPEG2VDEC", + "providerGuid": "AE5CF422-786A-476A-AC96-753B05877C99" + }, + { + "providerName": "Microsoft-Windows-msmpeg2venc", + "providerGuid": "D17B213A-C505-49C9-98CC-734253EF65D4" + }, + { + "providerName": "Microsoft-Windows-MUI", + "providerGuid": "A8A1F2F6-A13A-45E9-B1FE-3419569E5EF2" + }, + { + "providerName": "Microsoft-Windows-Narrator", + "providerGuid": "835B79E2-E76A-44C4-9885-26AD122D3B4D" + }, + { + "providerName": "Microsoft-Windows-Ncasvc", + "providerGuid": "126DED58-A28D-4113-8E7A-59D7444B2AF1" + }, + { + "providerName": "Microsoft-Windows-NcdAutoSetup", + "providerGuid": "EC23F986-AE2D-4269-B52F-4E20765C1A94" + }, + { + "providerName": "Microsoft-Windows-NCSI", + "providerGuid": "314DE49F-CE63-4779-BA2B-D616F6963A88" + }, + { + "providerName": "Microsoft-Windows-NDF-HelperClassDiscovery", + "providerGuid": "FC3BC8A7-2F61-449C-A8B4-22AC22058F92" + }, + { + "providerName": "Microsoft-Windows-NDIS", + "providerGuid": "CDEAD503-17F5-4A3E-B7AE-DF8CC2902EB9" + }, + { + "providerName": "Microsoft-Windows-NDIS-PacketCapture", + "providerGuid": "2ED6006E-4729-4609-B423-3EE7BCD678EF" + }, + { + "providerName": "Microsoft-Windows-NdisImPlatformEventProvider", + "providerGuid": "11C5D8AD-756A-42C2-8087-EB1B4A72A846" + }, + { + "providerName": "Microsoft-Windows-NdisImPlatformSysEvtProvider", + "providerGuid": "62DE9E48-90C6-4755-8813-6A7D655B0802" + }, + { + "providerName": "Microsoft-Windows-Ndu", + "providerGuid": "DF271536-4298-45E1-B0F2-E88F78619C5D" + }, + { + "providerName": "Microsoft-Windows-NetAdapterCim-Diag", + "providerGuid": "6CC2405D-817F-4886-886F-D5D1643210F0" + }, + { + "providerName": "Microsoft-Windows-Netshell", + "providerGuid": "AF2E340C-0743-4F5A-B2D3-2F7225D215DE" + }, + { + "providerName": "Microsoft-Windows-Network-and-Sharing-Center", + "providerGuid": "6A502821-AB44-40C8-B32F-37315D9D52E0" + }, + { + "providerName": "Microsoft-Windows-Network-Connection-Broker", + "providerGuid": "3EB875EB-8F4A-4800-A00B-E484C97D7551" + }, + { + "providerName": "Microsoft-Windows-Network-ExecutionContext", + "providerGuid": "0075E1AB-E1D1-5D1F-35F5-DA36FB4F41B1" + }, + { + "providerName": "Microsoft-Windows-Network-Setup", + "providerGuid": "A111F1C2-5923-47C0-9A68-D0BAFB577901" + }, + { + "providerName": "Microsoft-Windows-NetworkBridge", + "providerGuid": "A67075C2-3E39-4109-B6CD-6D750058A731" + }, + { + "providerName": "Microsoft-Windows-NetworkConnectivityStatus", + "providerGuid": "014DE49F-CE63-4779-BA2B-D616F6963A87" + }, + { + "providerName": "Microsoft-Windows-NetworkGCW", + "providerGuid": "BE932B00-0F8E-4386-AB89-873F7D0274AA" + }, + { + "providerName": "Microsoft-Windows-Networking-Correlation", + "providerGuid": "83ED54F0-4D48-4E45-B16E-726FFD1FA4AF" + }, + { + "providerName": "Microsoft-Windows-Networking-RealTimeCommunication", + "providerGuid": "1E39B4CE-D1E6-46CE-B65B-5AB05D6CC266" + }, + { + "providerName": "Microsoft-Windows-NetworkManagerTriggerProvider", + "providerGuid": "9B307223-4E4D-4BF5-9BE8-995CD8E7420B" + }, + { + "providerName": "Microsoft-Windows-NetworkProfile", + "providerGuid": "FBCFAC3F-8459-419F-8E48-1F0B49CDB85E" + }, + { + "providerName": "Microsoft-Windows-NetworkProfileTriggerProvider", + "providerGuid": "FBCFAC3F-8460-419F-8E48-1F0B49CDB85E" + }, + { + "providerName": "Microsoft-Windows-NetworkProvider", + "providerGuid": "1E9A4978-78C2-441E-8858-75B5D1326BC5" + }, + { + "providerName": "Microsoft-Windows-NetworkProvisioning", + "providerGuid": "93A19AB3-FB2C-46EB-91EF-56B0A318B983" + }, + { + "providerName": "Microsoft-Windows-NetworkSecurity", + "providerGuid": "7B702970-90BC-4584-8B20-C0799086EE5A" + }, + { + "providerName": "Microsoft-Windows-NlaSvc", + "providerGuid": "63B530F8-29C9-4880-A5B4-B8179096E7B8" + }, + { + "providerName": "Microsoft-Windows-Ntfs", + "providerGuid": "3FF37A1C-A68D-4D6E-8C9B-F79E8B16C482" + }, + { + "providerName": "Microsoft-Windows-Ntfs-UBPM", + "providerGuid": "8E6A5303-A4CE-498F-AFDB-E03A8A82B077" + }, + { + "providerName": "Microsoft-Windows-NtfsLog_38cd4a5ae98f33938fa5234e6817e23d", + "providerGuid": "38CD4A5A-E98F-3393-8FA5-234E6817E23D" + }, + { + "providerName": "Microsoft-Windows-NTLM", + "providerGuid": "AC43300D-5FCC-4800-8E99-1BD3F85F0320" + }, + { + "providerName": "Microsoft-Windows-ntshrui", + "providerGuid": "676F167F-F72C-446E-A498-EDA43319A5E3" + }, + { + "providerName": "Microsoft-Windows-NvmeDisk", + "providerGuid": "9799276C-FB04-47E8-845E-36946045C218" + }, + { + "providerName": "Microsoft-Windows-NWiFi", + "providerGuid": "0BD3506A-9030-4F76-9B88-3E8FE1F7CFB6" + }, + { + "providerName": "Microsoft-Windows-OfflineFiles", + "providerGuid": "95353826-4FBE-41D4-9C42-F521C6E86360" + }, + { + "providerName": "Microsoft-Windows-OfflineFiles-CscApi", + "providerGuid": "19EE4CF9-5322-4843-B0D8-BAB81BE4E81E" + }, + { + "providerName": "Microsoft-Windows-OfflineFiles-CscDclUser", + "providerGuid": "D5418619-C167-44D9-BC36-765BEB5D55F3" + }, + { + "providerName": "Microsoft-Windows-OfflineFiles-CscFastSync", + "providerGuid": "791CD79C-65B5-48A3-804C-786048994F47" + }, + { + "providerName": "Microsoft-Windows-OfflineFiles-CscNetApi", + "providerGuid": "361F227C-AA14-4D19-9007-0C8D1A8A541B" + }, + { + "providerName": "Microsoft-Windows-OfflineFiles-CscService", + "providerGuid": "89D89015-C0DF-414C-BC48-F50E114832BC" + }, + { + "providerName": "Microsoft-Windows-OfflineFiles-CscUM", + "providerGuid": "5E23B838-5B71-47E6-B123-6FE02EF573EF" + }, + { + "providerName": "Microsoft-Windows-OLE-Perf", + "providerGuid": "84958368-7DA7-49A0-B33D-07FABB879626" + }, + { + "providerName": "Microsoft-Windows-OLEACC", + "providerGuid": "19D2C934-EE9B-49E5-AAEB-9CCE721D2C65" + }, + { + "providerName": "Microsoft-Windows-OneBackup", + "providerGuid": "72561CF0-C85C-4F78-9E8D-CBA9093DF62D" + }, + { + "providerName": "Microsoft-Windows-OneX", + "providerGuid": "AB0D8EF9-866D-4D39-B83F-453F3B8F6325" + }, + { + "providerName": "Microsoft-Windows-OOBE-FirstLogonAnim", + "providerGuid": "2D4C0C5E-6704-493A-A44B-F5ADD4FC9283" + }, + { + "providerName": "Microsoft-Windows-OOBE-Machine-Core", + "providerGuid": "EC276CDE-2A17-473C-A010-2FF78D5426D2" + }, + { + "providerName": "Microsoft-Windows-OOBE-Machine-DUI", + "providerGuid": "F5DBAA02-15D6-4644-A784-7032D508BF64" + }, + { + "providerName": "Microsoft-Windows-OobeLdr", + "providerGuid": "75EBC33E-8670-4EB6-B535-3B9D6BB222FD" + }, + { + "providerName": "Microsoft-Windows-osk", + "providerGuid": "4F768BE8-9C69-4BBC-87FC-95291D3F9D0C" + }, + { + "providerName": "Microsoft-Windows-OtpCredentialProviderEvt", + "providerGuid": "5CAD485A-210F-4C16-80C5-F892DE74E28D" + }, + { + "providerName": "Microsoft-Windows-OverlayFilter", + "providerGuid": "46C78E5C-A213-46A8-8A6B-622F6916201D" + }, + { + "providerName": "Microsoft-Windows-ParentalControls", + "providerGuid": "01090065-B467-4503-9B28-533766761087" + }, + { + "providerName": "Microsoft-Windows-Partition", + "providerGuid": "412BDFF2-A8C4-470D-8F33-63FE0D8C20E2" + }, + { + "providerName": "Microsoft-Windows-PCI", + "providerGuid": "1A9443D4-B099-44D6-8EB1-829B9C2FE290" + }, + { + "providerName": "Microsoft-Windows-PCRPF", + "providerGuid": "5909C524-5E57-5275-803F-DDB7B74C52F2" + }, + { + "providerName": "Microsoft-Windows-PDC", + "providerGuid": "A6BF0DEB-3659-40AD-9F81-E25AF62CE3C7" + }, + { + "providerName": "Microsoft-Windows-PDFReader", + "providerGuid": "DFA86FAA-2C55-4140-BFF9-5CC586217A7B" + }, + { + "providerName": "Microsoft-Windows-PDH", + "providerGuid": "04D66358-C4A1-419B-8023-23B73902DE2C" + }, + { + "providerName": "Microsoft-Windows-PerceptionRuntime", + "providerGuid": "ADD0DE40-32B0-4B58-9D5E-938B2F5C1D1F" + }, + { + "providerName": "Microsoft-Windows-PerceptionSensorDataService", + "providerGuid": "85BE49EA-38F1-4547-A604-80060202FB27" + }, + { + "providerName": "Microsoft-Windows-PerfDisk", + "providerGuid": "7F9D83DE-8ABB-457F-98E8-4AD161449ECC" + }, + { + "providerName": "Microsoft-Windows-Perflib", + "providerGuid": "13B197BD-7CEE-4B4E-8DD0-59314CE374CE" + }, + { + "providerName": "Microsoft-Windows-PerfNet", + "providerGuid": "CAB2B8A5-49B9-4EEC-B1B0-FAC21DA05A3B" + }, + { + "providerName": "Microsoft-Windows-Performance-Recorder-Control", + "providerGuid": "36B6F488-AAD7-48C2-AFE3-D4EC2C8B46FA" + }, + { + "providerName": "Microsoft-Windows-PerfOS", + "providerGuid": "F82FB576-E941-4956-A2C7-A0CF83F6450A" + }, + { + "providerName": "Microsoft-Windows-PerfProc", + "providerGuid": "72D211E1-4C54-4A93-9520-4901681B2271" + }, + { + "providerName": "Microsoft-Windows-PersistentMemory-Nvdimm", + "providerGuid": "A7F2235F-BE51-51ED-DECF-F4498812A9A2" + }, + { + "providerName": "Microsoft-Windows-PersistentMemory-PmemDisk", + "providerGuid": "0FA2EE03-1FEB-5057-3BB3-EB25521B8482" + }, + { + "providerName": "Microsoft-Windows-PersistentMemory-ScmBus", + "providerGuid": "C03715CE-EA6F-5B67-4449-DA1D1E1AFEB8" + }, + { + "providerName": "Microsoft-Windows-Photo-Image-Codec", + "providerGuid": "BE3A31EA-AA6C-4196-9DCC-9CA13A49E09F" + }, + { + "providerName": "Microsoft-Windows-PhotoAcq", + "providerGuid": "76CFA528-B26E-B773-62D0-9588270442A6" + }, + { + "providerName": "Microsoft-Windows-PktMon", + "providerGuid": "4D4F80D9-C8BD-4D73-BB5B-19C90402C5AC" + }, + { + "providerName": "Microsoft-Windows-PlayToManager", + "providerGuid": "BB311100-2D9F-4CD3-B2D6-F4EA3839C548" + }, + { + "providerName": "Microsoft-Windows-PortableDeviceStatusProvider", + "providerGuid": "8C63B5A5-B484-4381-892D-EDD424582DF7" + }, + { + "providerName": "Microsoft-Windows-PortableDeviceSyncProvider", + "providerGuid": "A3E1697B-A12C-46B9-84D1-7FFE73C4B678" + }, + { + "providerName": "Microsoft-Windows-Power-CAD", + "providerGuid": "DABA4D32-CC40-4266-BB95-C30344DBC680" + }, + { + "providerName": "Microsoft-Windows-Power-Meter-Polling", + "providerGuid": "306C4E0B-E148-543D-315B-C618EB93157C" + }, + { + "providerName": "Microsoft-Windows-Power-Troubleshooter", + "providerGuid": "CDC05E28-C449-49C6-B9D2-88CF761644DF" + }, + { + "providerName": "Microsoft-Windows-PowerCfg", + "providerGuid": "9F0C4EA8-EC01-4200-A00D-B9701CBEA5D8" + }, + { + "providerName": "Microsoft-Windows-PowerCpl", + "providerGuid": "B1F90B27-4551-49D6-B2BD-DFC6453762A6" + }, + { + "providerName": "Microsoft-Windows-PowerShell", + "providerGuid": "A0C1853B-5C40-4B15-8766-3CF1C58F985A" + }, + { + "providerName": "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager", + "providerGuid": "AAF67066-0BF8-469F-AB76-275590C434EE" + }, + { + "providerName": "Microsoft-Windows-PrintBRM", + "providerGuid": "CF3F502E-B40D-4071-996F-00981EDF938E" + }, + { + "providerName": "Microsoft-Windows-PrintService", + "providerGuid": "747EF6FD-E535-4D16-B510-42C90F6873A1" + }, + { + "providerName": "Microsoft-Windows-PrintService-USBMon", + "providerGuid": "7F812073-B28D-4AFC-9CED-B8010F914EF6" + }, + { + "providerName": "Microsoft-Windows-Privacy-Auditing", + "providerGuid": "D67FBB76-D18A-5AE3-24A3-8C1DB52D6C62" + }, + { + "providerName": "Microsoft-Windows-Privacy-Auditing-Activity-History-Privacy-Settings", + "providerGuid": "63DD5DFB-2488-5E1F-7895-D49FF5BC7125" + }, + { + "providerName": "Microsoft-Windows-Privacy-Auditing-CPSS", + "providerGuid": "15F4CD44-CA53-5422-DB17-4E76821B5A69" + }, + { + "providerName": "Microsoft-Windows-Privacy-Auditing-DiagnosticData", + "providerGuid": "D3610DCA-4501-5A5D-21A7-30CA91130711" + }, + { + "providerName": "Microsoft-Windows-Privacy-Auditing-OneSettingsClient", + "providerGuid": "23F0F2C7-C77C-51EE-0AC1-5AC7796A85DF" + }, + { + "providerName": "Microsoft-Windows-Privacy-Auditing-PermissiveLearningMode", + "providerGuid": "811A1DDB-2E69-5F25-ADC0-4B186170E760" + }, + { + "providerName": "Microsoft-Windows-Privacy-Auditing-TailoredExperiences", + "providerGuid": "1BD672B8-445E-53FC-35EF-09F53672C385" + }, + { + "providerName": "Microsoft-Windows-ProcessExitMonitor", + "providerGuid": "FD771D53-8492-4057-8E35-8C02813AF49B" + }, + { + "providerName": "Microsoft-Windows-Processor-Aggregator", + "providerGuid": "CBA16CF2-2FAB-49F8-89AE-894E718649E7" + }, + { + "providerName": "Microsoft-Windows-ProcessStateManager", + "providerGuid": "D49918CF-9489-4BF1-9D7B-014D864CF71F" + }, + { + "providerName": "Microsoft-Windows-Program-Compatibility-Assistant", + "providerGuid": "4CB314DF-C11F-47D7-9C04-65FB0051561B" + }, + { + "providerName": "Microsoft-Windows-ProjFS-Filter", + "providerGuid": "B6D7DC51-78CF-4E85-8BAC-488A9F47A0BB" + }, + { + "providerName": "Microsoft-Windows-Provisioning-Diagnostics-Provider", + "providerGuid": "ED8B9BD3-F66E-4FF2-B86B-75C7925F72A9" + }, + { + "providerName": "Microsoft-Windows-Proximity-Common", + "providerGuid": "28058203-D394-4AFC-B2A6-2F9155A3BB95" + }, + { + "providerName": "Microsoft-Windows-Push-To-Install-Service", + "providerGuid": "3A718A68-6974-4075-ABD3-E8243CAEF398" + }, + { + "providerName": "Microsoft-Windows-PushNotifications-Developer", + "providerGuid": "5CAD3597-5FEC-4C62-9CE1-9D7ABC723D3A" + }, + { + "providerName": "Microsoft-Windows-PushNotifications-InProc", + "providerGuid": "815A1F4A-3F8D-4B37-9B31-5142F9D724A5" + }, + { + "providerName": "Microsoft-Windows-PushNotifications-Platform", + "providerGuid": "88CD9180-4491-4640-B571-E3BEE2527943" + }, + { + "providerName": "Microsoft-Windows-QoS-Pacer", + "providerGuid": "914ED502-B70D-4ADD-B758-95692854F8A3" + }, + { + "providerName": "Microsoft-Windows-QoS-qWAVE", + "providerGuid": "6BA132C4-DA49-415B-A7F4-31870DC9FE25" + }, + { + "providerName": "Microsoft-Windows-QoS-WMI-Diag", + "providerGuid": "725BA9B3-C1F3-4518-AF1B-C8D669191E15" + }, + { + "providerName": "Microsoft-Windows-RadioManager", + "providerGuid": "92061E3D-21CD-45BC-A3DF-0E8AE5E8580A" + }, + { + "providerName": "Microsoft-Windows-Ras-AgileVpn", + "providerGuid": "B5325CD6-438E-4EC1-AA46-14F46F2570E4" + }, + { + "providerName": "Microsoft-Windows-Ras-NdisWanPacketCapture", + "providerGuid": "D84521F7-2235-4237-A7C0-14E3A9676286" + }, + { + "providerName": "Microsoft-Windows-RasServer", + "providerGuid": "29D13147-1C2E-48EC-9994-E29DFE496EB3" + }, + { + "providerName": "Microsoft-Windows-RasSstp", + "providerGuid": "6C260F2C-049A-43D8-BF4D-D350A4E6611A" + }, + { + "providerName": "Microsoft-Windows-Rdp-Graphics-RdpAvenc", + "providerGuid": "EC7B8A8B-1432-58B3-6025-BE73D4EA28ED" + }, + { + "providerName": "Microsoft-Windows-Rdp-Graphics-RdpLite", + "providerGuid": "54DE4FB6-64D0-5710-3C14-13E4456119CE" + }, + { + "providerName": "Microsoft-Windows-ReadyBoost", + "providerGuid": "E6307A09-292C-497E-AAD6-498F68E2B619" + }, + { + "providerName": "Microsoft-Windows-ReadyBoostDriver", + "providerGuid": "2A274310-42D5-4019-B816-E4B8C7ABE95C" + }, + { + "providerName": "Microsoft-Windows-ReFS", + "providerGuid": "CD9C6198-BF73-4106-803B-C17D26559018" + }, + { + "providerName": "Microsoft-Windows-ReFS-v1", + "providerGuid": "059F0F37-910E-4FF0-A7EE-AE8D49DD319B" + }, + { + "providerName": "Microsoft-Windows-ReFsDedupSvc", + "providerGuid": "596CB176-FB71-587A-8FFB-F5CF15EE1E36" + }, + { + "providerName": "Microsoft-Windows-Remote-FileSystem-Log", + "providerGuid": "20C46239-D059-4214-A11E-7D6769CBE020" + }, + { + "providerName": "Microsoft-Windows-Remote-FileSystem-Monitor", + "providerGuid": "51734B23-5B7E-4892-BA8E-45BC110B735C" + }, + { + "providerName": "Microsoft-Windows-RemoteApp and Desktop Connections", + "providerGuid": "1B8B402D-78DC-46FB-BF71-46E64AEDF165" + }, + { + "providerName": "Microsoft-Windows-RemoteAssistance", + "providerGuid": "5B0A651A-8807-45CC-9656-7579815B6AF0" + }, + { + "providerName": "Microsoft-Windows-RemoteDesktopServices-RdpClipCdv", + "providerGuid": "B1E2EE25-B5BC-5129-0582-81A0A146B59B" + }, + { + "providerName": "Microsoft-Windows-RemoteDesktopServices-RdpCoreCDV", + "providerGuid": "C8E6DC53-660C-44EE-8D00-E47F189DB87F" + }, + { + "providerName": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS", + "providerGuid": "1139C61B-B549-4251-8ED3-27250A1EDEC8" + }, + { + "providerName": "Microsoft-Windows-RemoteDesktopServices-SessionServices", + "providerGuid": "F1394DE0-32C7-4A76-A6DE-B245E48F4615" + }, + { + "providerName": "Microsoft-Windows-Remotefs-Rdbss", + "providerGuid": "1A870028-F191-4699-8473-6FCD299EAB77" + }, + { + "providerName": "Microsoft-Windows-RemoteHelp", + "providerGuid": "8B7587BF-3253-5620-FB1F-625BCA71D28D" + }, + { + "providerName": "Microsoft-Windows-ResetEng", + "providerGuid": "A4445C76-ED85-C8A3-02C1-532A38614A9E" + }, + { + "providerName": "Microsoft-Windows-ResetEng-Trace", + "providerGuid": "7FA514B5-A023-4B62-A6AB-2946A483E065" + }, + { + "providerName": "Microsoft-Windows-Resource-Exhaustion-Detector", + "providerGuid": "9988748E-C2E8-4054-85F6-0C3E1CAD2470" + }, + { + "providerName": "Microsoft-Windows-Resource-Exhaustion-Resolver", + "providerGuid": "91F5FB12-FDEA-4095-85D5-614B495CD9DE" + }, + { + "providerName": "Microsoft-Windows-ResourcePublication", + "providerGuid": "74C2135F-CC76-45C3-879A-EF3BB1EEAF86" + }, + { + "providerName": "Microsoft-Windows-RestartManager", + "providerGuid": "0888E5EF-9B98-4695-979D-E92CE4247224" + }, + { + "providerName": "Microsoft-Windows-RetailDemo", + "providerGuid": "D3F29EDA-805D-428A-9902-B259B937F84B" + }, + { + "providerName": "Microsoft-Windows-RPC", + "providerGuid": "6AD52B32-D609-4BE9-AE07-CE8DAE937E39" + }, + { + "providerName": "Microsoft-Windows-RPC-Audit", + "providerGuid": "3C578D57-F85A-5FC9-DEA0-8C663CCFF942" + }, + { + "providerName": "Microsoft-Windows-RPC-Events", + "providerGuid": "F4AED7C7-A898-4627-B053-44A7CAA12FCD" + }, + { + "providerName": "Microsoft-Windows-RPC-FirewallManager", + "providerGuid": "F997CD11-0FC9-4AB4-ACBA-BC742A4C0DD3" + }, + { + "providerName": "Microsoft-Windows-RPC-Proxy-LBS", + "providerGuid": "272A979B-34B5-48EC-94F5-7225A59C85A0" + }, + { + "providerName": "Microsoft-Windows-RPCSS", + "providerGuid": "D8975F88-7DDB-4ED0-91BF-3ADF48C48E0C" + }, + { + "providerName": "Microsoft-Windows-RRAS", + "providerGuid": "24989972-0967-4E21-A926-93854033638E" + }, + { + "providerName": "Microsoft-Windows-RTWorkQueue-Extended", + "providerGuid": "83FAAA86-63C8-4DD8-A2DA-FBADDDFC0655" + }, + { + "providerName": "Microsoft-Windows-RTWorkQueue-Threading", + "providerGuid": "E18D0FC9-9515-4232-98E4-89E456D8551B" + }, + { + "providerName": "Microsoft-Windows-Runtime-Graphics", + "providerGuid": "FA5CF675-72EB-49E2-B447-DE5552FAFF1C" + }, + { + "providerName": "Microsoft-Windows-Runtime-Media", + "providerGuid": "8F0DB3A8-299B-4D64-A4ED-907B409D4584" + }, + { + "providerName": "Microsoft-Windows-Runtime-Networking", + "providerGuid": "6EB875EB-8F4A-4800-A00B-E484C97D7561" + }, + { + "providerName": "Microsoft-Windows-Runtime-Networking-BackgroundTransfer", + "providerGuid": "B9D5B35D-BBB8-4625-9450-F71A5D414F4F" + }, + { + "providerName": "Microsoft-Windows-Runtime-Web-Http", + "providerGuid": "41877CB4-11FC-4188-B590-712C143C881D" + }, + { + "providerName": "Microsoft-Windows-Runtime-WebAPI", + "providerGuid": "6BD96334-DC49-441A-B9C4-41425BA628D8" + }, + { + "providerName": "Microsoft-Windows-Schannel-Events", + "providerGuid": "91CC1150-71AA-47E2-AE18-C96E61736B6F" + }, + { + "providerName": "Microsoft-Windows-SCPNP", + "providerGuid": "9F650C63-9409-453C-A652-83D7185A2E83" + }, + { + "providerName": "Microsoft-Windows-Sdbus", + "providerGuid": "FE28004E-B08F-4407-92B3-BAD3A2C51708" + }, + { + "providerName": "Microsoft-Windows-Sdstor", + "providerGuid": "AFE654EB-0A83-4EB4-948F-D4510EC39C30" + }, + { + "providerName": "Microsoft-Windows-Search", + "providerGuid": "CA4E628D-8567-4896-AB6B-835B221F373F" + }, + { + "providerName": "Microsoft-Windows-Search-Core", + "providerGuid": "49C2C27C-FE2D-40BF-8C4E-C3FB518037E7" + }, + { + "providerName": "Microsoft-Windows-Search-ProfileNotify", + "providerGuid": "FC6F77DD-769A-470E-BCF9-1B6555A118BE" + }, + { + "providerName": "Microsoft-Windows-Search-ProtocolHandlers", + "providerGuid": "DAB065A9-620F-45BA-B5D6-D6BB8EFEDEE9" + }, + { + "providerName": "Microsoft-Windows-SEC", + "providerGuid": "16C6501A-FF2D-46EA-868D-8F96CB0CB52D" + }, + { + "providerName": "Microsoft-Windows-SEC-WFP", + "providerGuid": "62834E12-795F-5AB2-B404-8D6D870DBBEB" + }, + { + "providerName": "Microsoft-Windows-Security-Audit-Configuration-Client", + "providerGuid": "08466062-AED4-4834-8B04-CDDB414504E5" + }, + { + "providerName": "Microsoft-Windows-Security-Auditing", + "providerGuid": "54849625-5478-4994-A5BA-3E3B0328C30D" + }, + { + "providerName": "Microsoft-Windows-Security-EnterpriseData-FileRevocationManager", + "providerGuid": "2CD58181-0BB6-463E-828A-056FF837F966" + }, + { + "providerName": "Microsoft-Windows-Security-ExchangeActiveSyncProvisioning", + "providerGuid": "9249D0D0-F034-402F-A29B-92FA8853D9F3" + }, + { + "providerName": "Microsoft-Windows-Security-IdentityStore", + "providerGuid": "00B7E1DF-B469-4C69-9C41-53A6576E3DAD" + }, + { + "providerName": "Microsoft-Windows-Security-Isolation-BrokeringFileSystem", + "providerGuid": "CD8B60A0-2A19-5EB9-564F-6154E2D987F4" + }, + { + "providerName": "Microsoft-Windows-Security-Kerberos", + "providerGuid": "98E6CFCB-EE0A-41E0-A57B-622D4E1B30B1" + }, + { + "providerName": "Microsoft-Windows-Security-LessPrivilegedAppContainer", + "providerGuid": "45EEC9E5-4A1B-5446-7AD8-A4AB1313C437" + }, + { + "providerName": "Microsoft-Windows-Security-Mitigations", + "providerGuid": "FAE10392-F0AF-4AC0-B8FF-9F4D920C3CDF" + }, + { + "providerName": "Microsoft-Windows-Security-Netlogon", + "providerGuid": "E5BA83F6-07D0-46B1-8BC7-7E669A1D31DC" + }, + { + "providerName": "Microsoft-Windows-Security-SPP", + "providerGuid": "E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156" + }, + { + "providerName": "Microsoft-Windows-Security-SPP-UX", + "providerGuid": "6BDADC96-673E-468C-9F5B-F382F95B2832" + }, + { + "providerName": "Microsoft-Windows-Security-SPP-UX-GC", + "providerGuid": "BBBDD6A3-F35E-449B-A471-4D830C8EDA1F" + }, + { + "providerName": "Microsoft-Windows-Security-SPP-UX-GenuineCenter-Logging", + "providerGuid": "FB829150-CD7D-44C3-AF5B-711A3C31CEDC" + }, + { + "providerName": "Microsoft-Windows-Security-SPP-UX-Notifications", + "providerGuid": "C4EFC9BB-2570-4821-8923-1BAD317D2D4B" + }, + { + "providerName": "Microsoft-Windows-Security-UserConsentVerifier", + "providerGuid": "40783728-8921-45D0-B231-919037B4B4FD" + }, + { + "providerName": "Microsoft-Windows-Security-Vault", + "providerGuid": "E6C92FB8-89D7-4D1F-BE46-D56E59804783" + }, + { + "providerName": "Microsoft-Windows-SecurityMitigationsBroker", + "providerGuid": "EA8CD8A5-78FF-4418-B292-AADC6A7181DF" + }, + { + "providerName": "Microsoft-Windows-SendTo", + "providerGuid": "35642CF5-DA5E-410B-9D9C-A45F3638042B" + }, + { + "providerName": "Microsoft-Windows-Sens", + "providerGuid": "BE69781C-B63B-41A1-8E24-A4FC7B3FC498" + }, + { + "providerName": "Microsoft-Windows-SENSE", + "providerGuid": "FAE96D09-ADE1-5223-0098-AF7B67348531" + }, + { + "providerName": "Microsoft-Windows-SenseIR", + "providerGuid": "B6D775EF-1436-4FE6-BAD3-9E436319E218" + }, + { + "providerName": "Microsoft-Windows-Sensors", + "providerGuid": "D8900E18-36CB-4548-966F-13F068D1F78E" + }, + { + "providerName": "Microsoft-Windows-Sensors-Core", + "providerGuid": "751C292B-23E6-58CF-1FD4-38F8512C66C2" + }, + { + "providerName": "Microsoft-Windows-Sensors-Core-Performance", + "providerGuid": "9E051EAA-7FEE-4F9F-8897-D86F3692E8AF" + }, + { + "providerName": "Microsoft-Windows-Serial-ClassExtension", + "providerGuid": "47BC9477-A8BA-452E-B951-4F2ED3593CF9" + }, + { + "providerName": "Microsoft-Windows-Serial-ClassExtension-V2", + "providerGuid": "EEE173EF-7ED2-45DE-9877-01C70A852FBD" + }, + { + "providerName": "Microsoft-Windows-ServiceReportingApi", + "providerGuid": "606A6A38-70EC-4309-B3A3-82FF86F73329" + }, + { + "providerName": "Microsoft-Windows-Services", + "providerGuid": "0063715B-EEDA-4007-9429-AD526F62696E" + }, + { + "providerName": "Microsoft-Windows-Services-Svchost", + "providerGuid": "06184C97-5201-480E-92AF-3A3626C5B140" + }, + { + "providerName": "Microsoft-Windows-ServiceTriggerPerfEventProvider", + "providerGuid": "6545939F-3398-411A-88B7-6A8914B8CEC7" + }, + { + "providerName": "Microsoft-Windows-Servicing", + "providerGuid": "BD12F3B8-FC40-4A61-A307-B7A013A069C1" + }, + { + "providerName": "Microsoft-Windows-Setup", + "providerGuid": "75EBC33E-997F-49CF-B49F-ECC50184B75D" + }, + { + "providerName": "Microsoft-Windows-SetupCl", + "providerGuid": "75EBC33E-D017-4D0F-93AB-0B4F86579164" + }, + { + "providerName": "Microsoft-Windows-SetupPlatform", + "providerGuid": "530FB9B9-C515-4472-9313-FB346F9255E3" + }, + { + "providerName": "Microsoft-Windows-SetupQueue", + "providerGuid": "A615ACB9-D5A4-4738-B561-1DF301D207F8" + }, + { + "providerName": "Microsoft-Windows-SetupUGC", + "providerGuid": "75EBC33E-0870-49E5-BDCE-9D7028279489" + }, + { + "providerName": "Microsoft-Windows-SharedAccess_NAT", + "providerGuid": "A6F32731-9A38-4159-A220-3D9B7FC5FE5D" + }, + { + "providerName": "Microsoft-Windows-ShareMedia-ControlPanel", + "providerGuid": "02012A8A-ADF5-4FAB-92CB-CCB7BB3E689A" + }, + { + "providerName": "Microsoft-Windows-Shell-AppWizCpl", + "providerGuid": "08D945EB-C8BD-44AA-994F-86079D8DCE35" + }, + { + "providerName": "Microsoft-Windows-Shell-AuthUI", + "providerGuid": "63D2BB1D-E39A-41B8-9A3D-52DD06677588" + }, + { + "providerName": "Microsoft-Windows-Shell-ConnectedAccountState", + "providerGuid": "6DF57621-E7E4-410F-A7E9-E43EEB61B11F" + }, + { + "providerName": "Microsoft-Windows-Shell-Core", + "providerGuid": "30336ED4-E327-447C-9DE0-51B652C86108" + }, + { + "providerName": "Microsoft-Windows-Shell-DefaultPrograms", + "providerGuid": "65D99466-7A8E-489C-B8E1-962BC945031E" + }, + { + "providerName": "Microsoft-Windows-Shell-LockScreenContent", + "providerGuid": "A3C0D58A-9FE5-4F24-A2CE-E16DE8BAA0D2" + }, + { + "providerName": "Microsoft-Windows-Shell-OpenWith", + "providerGuid": "11BD2A68-77FF-4991-9658-F451F2EB6CE1" + }, + { + "providerName": "Microsoft-Windows-Shell-Shwebsvc", + "providerGuid": "F61CEFC0-AA2E-11DA-A746-0800200C9A66" + }, + { + "providerName": "Microsoft-Windows-Shell-ZipFolder", + "providerGuid": "1F84007D-19CE-4B15-9E81-8A3DD8EB9ECB" + }, + { + "providerName": "Microsoft-Windows-ShellCommon-StartLayoutPopulation", + "providerGuid": "97CA8142-10B1-4BAA-9FBB-70A7D11231C3" + }, + { + "providerName": "Microsoft-Windows-Shsvcs", + "providerGuid": "059C3E04-5535-4929-85E1-93030E78F47B" + }, + { + "providerName": "Microsoft-Windows-SleepStudy", + "providerGuid": "D37687E7-8BF0-4D11-B589-A7ABE080756A" + }, + { + "providerName": "Microsoft-Windows-SmartCard-Audit", + "providerGuid": "09AC07B9-6AC9-43BC-A50F-58419A797C69" + }, + { + "providerName": "Microsoft-Windows-SmartCard-DeviceEnum", + "providerGuid": "AAEAC398-3028-487C-9586-44EACAD03637" + }, + { + "providerName": "Microsoft-Windows-Smartcard-Server", + "providerGuid": "4FCBF664-A33A-4652-B436-9D558983D955" + }, + { + "providerName": "Microsoft-Windows-SmartCard-TPM-VCard-Module", + "providerGuid": "125F2CF1-2768-4D33-976E-527137D080F8" + }, + { + "providerName": "Microsoft-Windows-Smartcard-Trigger", + "providerGuid": "AEDD909F-41C6-401A-9E41-DFC33006AF5D" + }, + { + "providerName": "Microsoft-Windows-SmartScreen", + "providerGuid": "3CB2A168-FE34-4A4E-BDAD-DCF422F34473" + }, + { + "providerName": "Microsoft-Windows-SMBClient", + "providerGuid": "988C59C5-0A1C-45B6-A555-0C62276E327D" + }, + { + "providerName": "Microsoft-Windows-SMBDirect", + "providerGuid": "DB66EA65-B7BB-4CA9-8748-334CB5C32400" + }, + { + "providerName": "Microsoft-Windows-SMBServer", + "providerGuid": "D48CE617-33A2-4BC3-A5C7-11AA4F29619E" + }, + { + "providerName": "Microsoft-Windows-SMBWitnessClient", + "providerGuid": "32254F6C-AA33-46F0-A5E3-1CBCC74BF683" + }, + { + "providerName": "Microsoft-Windows-SmbWmiProvider", + "providerGuid": "50B9E206-9D55-4092-92E8-F157A8235799" + }, + { + "providerName": "Microsoft-Windows-SoftwareRestrictionPolicies", + "providerGuid": "7D29D58A-931A-40AC-8743-48C733045548" + }, + { + "providerName": "Microsoft-Windows-SPB-ClassExtension", + "providerGuid": "72CD9FF7-4AF8-4B89-AEDE-5F26FDA13567" + }, + { + "providerName": "Microsoft-Windows-SPB-HIDI2C", + "providerGuid": "991F8FE6-249D-44D6-B93D-5A3060C1DEDB" + }, + { + "providerName": "Microsoft-Windows-SpecialAdministrationConsole", + "providerGuid": "8551491D-2545-5955-44BD-F5F1EFACFCDA" + }, + { + "providerName": "Microsoft-Windows-Speech-TTS", + "providerGuid": "74DCC47A-846E-4C98-9E2C-80043ED82B15" + }, + { + "providerName": "Microsoft-Windows-Speech-UserExperience", + "providerGuid": "13480A22-D79F-4334-9D32-AA239398AD3C" + }, + { + "providerName": "Microsoft-Windows-Spell-Checking", + "providerGuid": "D0E22EFC-AC66-4B25-A72D-382736B5E940" + }, + { + "providerName": "Microsoft-Windows-SpellChecker", + "providerGuid": "B2FCD41F-9A40-4150-8C92-B224B7D8C8AA" + }, + { + "providerName": "Microsoft-Windows-Spellchecking-Host", + "providerGuid": "1BDA2AB1-BBC1-4ACB-A849-C0EF2B249672" + }, + { + "providerName": "Microsoft-Windows-SruMon", + "providerGuid": "C8DBF506-E3D3-4822-930D-84C557EB6247" + }, + { + "providerName": "Microsoft-Windows-SrumTelemetry", + "providerGuid": "48D445A8-2F64-4D49-B093-A5774D8DC531" + }, + { + "providerName": "Microsoft-Windows-StartNameRes", + "providerGuid": "277C9237-51D8-5C1C-B089-F02C683E5BA7" + }, + { + "providerName": "Microsoft-Windows-StartupRepair", + "providerGuid": "C914F0DF-835A-4A22-8C70-732C9A80C634" + }, + { + "providerName": "Microsoft-Windows-StateRepository", + "providerGuid": "89592015-D996-4636-8F61-066B5D4DD739" + }, + { + "providerName": "Microsoft-Windows-stobject", + "providerGuid": "86133982-63D7-4741-928E-EF1349B80219" + }, + { + "providerName": "Microsoft-Windows-Storage-Tiering", + "providerGuid": "4A104570-EC6D-4560-A40F-858FA955E84F" + }, + { + "providerName": "Microsoft-Windows-Storage-Tiering-IoHeat", + "providerGuid": "990C55FC-2662-47F6-B7D7-EB3C027CB13F" + }, + { + "providerName": "Microsoft-Windows-StorageManagement", + "providerGuid": "7E58E69A-E361-4F06-B880-AD2F4B64C944" + }, + { + "providerName": "Microsoft-Windows-StorageManagement-PartUtil", + "providerGuid": "93DB76C2-63AB-5DE1-88B3-C068686675B8" + }, + { + "providerName": "Microsoft-Windows-StorageManagement-WSP-FS", + "providerGuid": "435F8E4B-8CC4-430E-9796-28CAE4976576" + }, + { + "providerName": "Microsoft-Windows-StorageManagement-WSP-Health", + "providerGuid": "B1F01D1A-AE3A-4940-81EE-DDCCBAD380EF" + }, + { + "providerName": "Microsoft-Windows-StorageManagement-WSP-Host", + "providerGuid": "595F33EA-D4AF-4F4D-B4DD-9DACDD17FC6E" + }, + { + "providerName": "Microsoft-Windows-StorageManagement-WSP-Spaces", + "providerGuid": "88C09888-118D-48FC-8863-E1C6D39CA4DF" + }, + { + "providerName": "Microsoft-Windows-StorageSettings", + "providerGuid": "E934E6DD-62BE-55D8-1CC8-416D0039498B" + }, + { + "providerName": "Microsoft-Windows-StorageSpaces-Api", + "providerGuid": "BCF0C6A7-6130-5208-F27D-FA77A91F12DF" + }, + { + "providerName": "Microsoft-Windows-StorageSpaces-Driver", + "providerGuid": "595F7F52-C90A-4026-A125-8EB5E083F15E" + }, + { + "providerName": "Microsoft-Windows-StorageSpaces-ManagementAgent", + "providerGuid": "AA4C798D-D91B-4B07-A013-787F5803D6FC" + }, + { + "providerName": "Microsoft-Windows-StorageSpaces-Parser", + "providerGuid": "5BCF2A5C-2E90-5A03-AA4E-2E459BAE21B4" + }, + { + "providerName": "Microsoft-Windows-StorageSpaces-SpaceManager", + "providerGuid": "69C8CA7E-1ADF-472B-BA4C-A0485986B9F6" + }, + { + "providerName": "Microsoft-Windows-StorageVolume", + "providerGuid": "C8127B86-E611-5638-63F4-AE37539084D2" + }, + { + "providerName": "Microsoft-Windows-StorDiag", + "providerGuid": "F5D05B38-80A6-4653-825D-C414E4AB3C68" + }, + { + "providerName": "Microsoft-Windows-Store", + "providerGuid": "9C2A37F3-E5FD-5CAE-BCD1-43DAFEEE1FF0" + }, + { + "providerName": "Microsoft-Windows-StorPort", + "providerGuid": "C4636A1E-7986-4646-BF10-7BC3B4A76E8E" + }, + { + "providerName": "Microsoft-Windows-Storsvc", + "providerGuid": "A963A23C-0058-521D-71EC-A1CCE6173F21" + }, + { + "providerName": "Microsoft-Windows-Subsys-Csr", + "providerGuid": "E8316A2D-0D94-4F52-85DD-1E15B66C5891" + }, + { + "providerName": "Microsoft-Windows-Subsys-SMSS", + "providerGuid": "43E63DA5-41D1-4FBF-ADED-1BBED98FDD1D" + }, + { + "providerName": "Microsoft-Windows-Sudo", + "providerGuid": "9D74DC62-B75F-54CD-BE9E-C28940B5FEED" + }, + { + "providerName": "Microsoft-Windows-Superfetch", + "providerGuid": "99806515-9F51-4C2F-B918-1EAE407AA8CB" + }, + { + "providerName": "Microsoft-Windows-Sysprep", + "providerGuid": "75EBC33E-77B8-4BA8-9474-4F4A9DB2F5C6" + }, + { + "providerName": "Microsoft-Windows-System-Profile-HardwareId", + "providerGuid": "3419DE6D-5D7F-4668-ACC8-F80566814D96" + }, + { + "providerName": "Microsoft-Windows-System-Restore", + "providerGuid": "126CDB97-D346-4894-8A34-658DA5EEA1B6" + }, + { + "providerName": "Microsoft-Windows-SystemEventsBroker", + "providerGuid": "B6BFCC79-A3AF-4089-8D4D-0EECB1B80779" + }, + { + "providerName": "Microsoft-Windows-SystemSettingsHandlers", + "providerGuid": "FBBD52E1-DF97-529D-4B67-53F67DA99A98" + }, + { + "providerName": "Microsoft-Windows-SystemSettingsThreshold", + "providerGuid": "8BCDF442-3070-4118-8C94-E8843BE363B3" + }, + { + "providerName": "Microsoft-Windows-TabletPC-InputPanel", + "providerGuid": "E978F84E-582D-4167-977E-32AF52706888" + }, + { + "providerName": "Microsoft-Windows-TabletPC-MathInput", + "providerGuid": "8443CCB7-FEB0-4B8D-8E28-8D4C7CB814E8" + }, + { + "providerName": "Microsoft-Windows-TabletPC-MathRecognizer", + "providerGuid": "BDB462FC-A297-49A2-BF2E-4F1809E12ABC" + }, + { + "providerName": "Microsoft-Windows-TabletPC-Platform-Input-Core", + "providerGuid": "B5FD844A-01D4-4B10-A57F-58B13B561582" + }, + { + "providerName": "Microsoft-Windows-TabletPC-Platform-Input-Ninput", + "providerGuid": "2C3E6D9F-8298-450F-8E5D-49B724F1216F" + }, + { + "providerName": "Microsoft-Windows-TabletPC-Platform-Input-Wisp", + "providerGuid": "E5AA2A53-30BE-40F5-8D84-AD3F40A404CD" + }, + { + "providerName": "Microsoft-Windows-TabletPC-Platform-Manipulations", + "providerGuid": "2FD7A9A5-B1A1-4FC7-B95C-C32FED818F30" + }, + { + "providerName": "Microsoft-Windows-TaskbarCPL", + "providerGuid": "05D7B0F0-2121-4EFF-BF6B-ED3F69B894D7" + }, + { + "providerName": "Microsoft-Windows-TaskScheduler", + "providerGuid": "DE7B24EA-73C8-4A09-985D-5BDADCFA9017" + }, + { + "providerName": "Microsoft-Windows-TCPIP", + "providerGuid": "2F07E2EE-15DB-40F1-90EF-9D7BA282188A" + }, + { + "providerName": "Microsoft-Windows-TenantRestrictions", + "providerGuid": "4053FADA-178B-5AA8-746B-7CF8538B5118" + }, + { + "providerName": "Microsoft-Windows-TerminalServices-ClientActiveXCore", + "providerGuid": "28AA95BB-D444-4719-A36F-40462168127E" + }, + { + "providerName": "Microsoft-Windows-TerminalServices-ClientUSBDevices", + "providerGuid": "6E400999-5B82-475F-B800-CEF6FE361539" + }, + { + "providerName": "Microsoft-Windows-TerminalServices-LocalSessionManager", + "providerGuid": "5D896912-022D-40AA-A3A8-4FA5515C76D7" + }, + { + "providerName": "Microsoft-Windows-TerminalServices-MediaRedirection", + "providerGuid": "3F7B2F99-B863-4045-AD05-F6AFB62E7AF1" + }, + { + "providerName": "Microsoft-Windows-TerminalServices-PnPDevices", + "providerGuid": "27A8C1E2-EB19-463E-8424-B399DF27A216" + }, + { + "providerName": "Microsoft-Windows-TerminalServices-Printers", + "providerGuid": "952773BF-C2B7-49BC-88F4-920744B82C43" + }, + { + "providerName": "Microsoft-Windows-TerminalServices-RdpSoundDriver", + "providerGuid": "127E0DC5-E13B-4935-985E-78FD508B1D80" + }, + { + "providerName": "Microsoft-Windows-TerminalServices-RemoteConnectionManager", + "providerGuid": "C76BAA63-AE81-421C-B425-340B4B24157F" + }, + { + "providerName": "Microsoft-Windows-TerminalServices-ServerUSBDevices", + "providerGuid": "DCBE5AAA-16E2-457C-9337-366950045F0A" + }, + { + "providerName": "Microsoft-Windows-Tethering-Manager", + "providerGuid": "CC311F1F-623C-4CA4-BA44-A458016555E8" + }, + { + "providerName": "Microsoft-Windows-Tethering-Station", + "providerGuid": "585CAB4F-9351-436E-9D99-DC4B41A20DE0" + }, + { + "providerName": "Microsoft-Windows-TextPredictionEngine", + "providerGuid": "39A63500-7D76-49CD-994F-FFD796EF5A53" + }, + { + "providerName": "Microsoft-Windows-ThemeCPL", + "providerGuid": "61F044AF-9104-4CA5-81EE-CB6C51BB01AB" + }, + { + "providerName": "Microsoft-Windows-ThemeUI", + "providerGuid": "869FB599-80AA-485D-BCA7-DB18D72B7219" + }, + { + "providerName": "Microsoft-Windows-Thermal-Polling", + "providerGuid": "E8A7C168-81EE-465C-8E8E-D39A2AC1CA41" + }, + { + "providerName": "Microsoft-Windows-Threat-Intelligence", + "providerGuid": "F4E1897C-BB5D-5668-F1D8-040F4D8DD344" + }, + { + "providerName": "Microsoft-Windows-Time-Service", + "providerGuid": "06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB" + }, + { + "providerName": "Microsoft-Windows-Time-Service-PTP-Provider", + "providerGuid": "CFFB980E-327C-5B87-19C6-62C4C3BE2290" + }, + { + "providerName": "Microsoft-Windows-TimeBroker", + "providerGuid": "0657ADC1-9AE8-4E18-932D-E6079CDA5AB3" + }, + { + "providerName": "Microsoft-Windows-TPM-WMI", + "providerGuid": "7D5387B0-CBE0-11DA-A94D-0800200C9A66" + }, + { + "providerName": "Microsoft-Windows-TriggerEmulatorProvider", + "providerGuid": "F230D19A-5D93-47D9-A83F-53829EDFB8DF" + }, + { + "providerName": "Microsoft-Windows-Troubleshooting-Recommended", + "providerGuid": "4969DE67-439C-516F-F805-A82A4F905730" + }, + { + "providerName": "Microsoft-Windows-TSF-msctf", + "providerGuid": "4FBA1227-F606-4E5F-B9E8-FAB9AB5740F3" + }, + { + "providerName": "Microsoft-Windows-TSF-msutb", + "providerGuid": "74B655A2-8958-410E-80E2-3457051B8DFF" + }, + { + "providerName": "Microsoft-Windows-TSF-UIManager", + "providerGuid": "4DD778B8-379C-4D8C-B659-517A43D6DF7D" + }, + { + "providerName": "Microsoft-Windows-TunnelDriver", + "providerGuid": "4EDBE902-9ED3-4CF0-93E8-B8B5FA920299" + }, + { + "providerName": "Microsoft-Windows-TunnelDriver-SQM-Provider", + "providerGuid": "4214DCD2-7C33-4F74-9898-719CCCEEC20F" + }, + { + "providerName": "Microsoft-Windows-TZSync", + "providerGuid": "3527CB55-1298-49D4-AB94-1243DB0FCAFF" + }, + { + "providerName": "Microsoft-Windows-TZUtil", + "providerGuid": "2D318B91-E6E7-4C46-BD04-BFE6DB412CF9" + }, + { + "providerName": "Microsoft-Windows-UAC", + "providerGuid": "E7558269-3FA5-46ED-9F4D-3C6E282DDE55" + }, + { + "providerName": "Microsoft-Windows-UAC-FileVirtualization", + "providerGuid": "C02AFC2B-E24E-4449-AD76-BCC2C2575EAD" + }, + { + "providerName": "Microsoft-Windows-UI-Input-Inking", + "providerGuid": "BF1DB390-3E67-4D4D-A287-8958044A3DB4" + }, + { + "providerName": "Microsoft-Windows-UI-Search", + "providerGuid": "D8965FCF-7397-4E0E-B750-21A4580BD880" + }, + { + "providerName": "Microsoft-Windows-UIAnimation", + "providerGuid": "E0A40B26-30C4-4656-BC9A-74A5C3A0B2EC" + }, + { + "providerName": "Microsoft-Windows-UIAutomationCore", + "providerGuid": "820A42D8-38C4-465D-B64E-D7D56EA1D612" + }, + { + "providerName": "Microsoft-Windows-UIRibbon", + "providerGuid": "87D476FE-1A0F-4370-B785-60B028019693" + }, + { + "providerName": "Microsoft-Windows-UniversalTelemetryClient", + "providerGuid": "6489B27F-7C43-5886-1D00-0A61BB2A375B" + }, + { + "providerName": "Microsoft-Windows-URLMon", + "providerGuid": "245F975D-909D-49ED-B8F9-9A75691D6B6B" + }, + { + "providerName": "Microsoft-Windows-USB-CCID", + "providerGuid": "F708C483-4880-11E6-9121-5CF37068B67B" + }, + { + "providerName": "Microsoft-Windows-USB-MAUSBHOST", + "providerGuid": "7725B5F9-1F2E-4E21-BAEB-B2AF4690BC87" + }, + { + "providerName": "Microsoft-Windows-USB-UCMUCSICX", + "providerGuid": "569D11AA-5068-5EE5-DA22-CE541C0B1481" + }, + { + "providerName": "Microsoft-Windows-USB-UCX", + "providerGuid": "36DA592D-E43A-4E28-AF6F-4BC57C5A11E8" + }, + { + "providerName": "Microsoft-Windows-USB-USB4DeviceRouter-EventLogs", + "providerGuid": "D07E8C3F-78FB-4C22-B77C-2203D00BFDF3" + }, + { + "providerName": "Microsoft-Windows-USB-USBHUB", + "providerGuid": "7426A56B-E2D5-4B30-BDEF-B31815C1A74A" + }, + { + "providerName": "Microsoft-Windows-USB-USBHUB3", + "providerGuid": "AC52AD17-CC01-4F85-8DF5-4DCE4333C99B" + }, + { + "providerName": "Microsoft-Windows-USB-USBPORT", + "providerGuid": "C88A4EF5-D048-4013-9408-E04B7DB2814A" + }, + { + "providerName": "Microsoft-Windows-USB-USBXHCI", + "providerGuid": "30E1D284-5D88-459C-83FD-6345B39B19EC" + }, + { + "providerName": "Microsoft-Windows-User Device Registration", + "providerGuid": "23B8D46B-67DD-40A3-B636-D43E50552C6D" + }, + { + "providerName": "Microsoft-Windows-User Profiles General", + "providerGuid": "DB00DFB6-29F9-4A9C-9B3B-1F4F9E7D9770" + }, + { + "providerName": "Microsoft-Windows-User Profiles Service", + "providerGuid": "89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845" + }, + { + "providerName": "Microsoft-Windows-User-ControlPanel", + "providerGuid": "319122A9-1485-4E48-AF35-7DB2D93B8AD2" + }, + { + "providerName": "Microsoft-Windows-User-Diagnostic", + "providerGuid": "305FC87B-002A-5E26-D297-60223012CA9C" + }, + { + "providerName": "Microsoft-Windows-User-Loader", + "providerGuid": "B059B83F-D946-4B13-87CA-4292839DC2F2" + }, + { + "providerName": "Microsoft-Windows-UserAccountControl", + "providerGuid": "2683B597-3CCA-410A-97FE-6F7EE3D09B94" + }, + { + "providerName": "Microsoft-Windows-UserDataAccess-CallHistoryClient", + "providerGuid": "F5988ABB-323A-4098-8A34-85A3613D4638" + }, + { + "providerName": "Microsoft-Windows-UserDataAccess-CEMAPI", + "providerGuid": "83A9277A-D2FC-4B34-BF81-8CEB4407824F" + }, + { + "providerName": "Microsoft-Windows-UserDataAccess-PimIndexMaintenance", + "providerGuid": "99C66BA7-5A97-40D5-AA01-8A07FB3DB292" + }, + { + "providerName": "Microsoft-Windows-UserDataAccess-Poom", + "providerGuid": "0BD19909-EB6F-4B16-8074-6DCE803F091D" + }, + { + "providerName": "Microsoft-Windows-UserDataAccess-UnifiedStore", + "providerGuid": "56F519AB-9DF6-4345-8491-A4BA21AC825B" + }, + { + "providerName": "Microsoft-Windows-UserDataAccess-UserDataApis", + "providerGuid": "B9B2DE3C-3FBD-4F42-8FF7-33C3BAD35FD4" + }, + { + "providerName": "Microsoft-Windows-UserDataAccess-UserDataService", + "providerGuid": "FB19EE2C-0D22-4A2E-969E-DD41AE0CE1A9" + }, + { + "providerName": "Microsoft-Windows-UserDataAccess-UserDataUtils", + "providerGuid": "D1F688BF-012F-4AEC-A38C-E7D4649F8CD2" + }, + { + "providerName": "Microsoft-Windows-UserModePowerService", + "providerGuid": "CE8DEE0B-D539-4000-B0F8-77BED049C590" + }, + { + "providerName": "Microsoft-Windows-UserPnp", + "providerGuid": "96F4A050-7E31-453C-88BE-9634F4E02139" + }, + { + "providerName": "Microsoft-Windows-UserSettingsBackup-BackupUnitProcessor", + "providerGuid": "DC84BBF4-CDED-56EF-BF3B-E2051D5589D5" + }, + { + "providerName": "Microsoft-Windows-UserSettingsBackup-EarlyDownloader", + "providerGuid": "C675305E-51BD-5DA6-08B4-D4CB88D198F0" + }, + { + "providerName": "Microsoft-Windows-UserSettingsBackup-Orchestrator", + "providerGuid": "47AE8351-B61A-51D1-0AD0-9D870C38F53A" + }, + { + "providerName": "Microsoft-Windows-UxInit", + "providerGuid": "4154A29C-40D9-445F-8D65-24DA473E8F65" + }, + { + "providerName": "Microsoft-Windows-UxTheme", + "providerGuid": "422088E6-CD0C-4F99-BD0B-6985FA290BDF" + }, + { + "providerName": "Microsoft-Windows-VDRVROOT", + "providerGuid": "E4480490-85B6-11DD-AD8B-0800200C9A66" + }, + { + "providerName": "Microsoft-Windows-VerifyHardwareSecurity", + "providerGuid": "F3F53C76-B06D-4F15-B412-61164A0D2B73" + }, + { + "providerName": "Microsoft-Windows-VHDMP", + "providerGuid": "E2816346-87F4-4F85-95C3-0C79409AA89D" + }, + { + "providerName": "Microsoft-Windows-Video-For-Windows", + "providerGuid": "712ABB2D-D806-4B42-9682-26DA01D8B307" + }, + { + "providerName": "Microsoft-Windows-VIRTDISK", + "providerGuid": "4D20DF22-E177-4514-A369-F1759FEEDEB3" + }, + { + "providerName": "Microsoft-Windows-VolumeControl", + "providerGuid": "07DE7879-1C96-41CE-AFBD-C659A0E8E643" + }, + { + "providerName": "Microsoft-Windows-VolumeSnapshot-Driver", + "providerGuid": "67FE2216-727A-40CB-94B2-C02211EDB34A" + }, + { + "providerName": "Microsoft-Windows-VPN-Client", + "providerGuid": "3C088E51-65BE-40D1-9B90-62BFEC076737" + }, + { + "providerName": "Microsoft-Windows-VWiFi", + "providerGuid": "314B2B0D-81EE-4474-B6E0-C2AAEC0DDBDE" + }, + { + "providerName": "Microsoft-Windows-WABSyncProvider", + "providerGuid": "17F14A23-551D-40CC-A086-E4194D64ED4C" + }, + { + "providerName": "Microsoft-Windows-Wallet", + "providerGuid": "6ED11B00-C1B5-48CB-AECC-FF72EBEFBAE8" + }, + { + "providerName": "Microsoft-Windows-Watchdog-Events", + "providerGuid": "70E74DD8-39DB-5F6F-6FD1-F5581B29E834" + }, + { + "providerName": "Microsoft-Windows-Wcmsvc", + "providerGuid": "67D07935-283A-4791-8F8D-FA9117F3E6F2" + }, + { + "providerName": "Microsoft-Windows-WCN-Config-Registrar", + "providerGuid": "C100BECF-D33A-4A4B-BF23-BBEF4663D017" + }, + { + "providerName": "Microsoft-Windows-WCN-Config-Registrar-Secure", + "providerGuid": "C100BECC-D33A-4A4B-BF23-BBEF4663D017" + }, + { + "providerName": "Microsoft-Windows-WCNWiz", + "providerGuid": "E8AA5402-26A1-455E-A21B-F240ED62D155" + }, + { + "providerName": "Microsoft-Windows-WDAG-PolicyEvaluator-CSP", + "providerGuid": "64A98C25-9E00-404E-84AD-6700DFE02529" + }, + { + "providerName": "Microsoft-Windows-WDAG-PolicyEvaluator-GP", + "providerGuid": "E53DF8BA-367A-4406-98D5-709FFB169681" + }, + { + "providerName": "Microsoft-Windows-WebAuth", + "providerGuid": "DB6972B6-DDDF-4820-84B1-2ED6AC0B96E5" + }, + { + "providerName": "Microsoft-Windows-WebAuthN", + "providerGuid": "3AE1EA61-C002-47FB-B06C-4022A8C98929" + }, + { + "providerName": "Microsoft-Windows-WebcamExperience", + "providerGuid": "9E12CEB1-E3FF-46AD-A0AA-11738B122D20" + }, + { + "providerName": "Microsoft-Windows-WebdavClient-LookupServiceTrigger", + "providerGuid": "22B6D684-FA63-4578-87C9-EFFCBE6643C7" + }, + { + "providerName": "Microsoft-Windows-WebDeploy", + "providerGuid": "AB77E98E-0138-4C77-8BFB-DECD33EDFE3C" + }, + { + "providerName": "Microsoft-Windows-WebIO", + "providerGuid": "50B3E73C-9370-461D-BB9F-26F32D68887D" + }, + { + "providerName": "Microsoft-Windows-WebServices", + "providerGuid": "E04FE2E0-C6CF-4273-B59D-5C97C9C374A4" + }, + { + "providerName": "Microsoft-Windows-Websocket-Protocol-Component", + "providerGuid": "CBA5F63C-E2CF-4B36-8305-BDE1311924FC" + }, + { + "providerName": "Microsoft-Windows-WEPHOSTSVC", + "providerGuid": "D5F7235B-48E2-4E9C-92FE-0E4950ABA9E8" + }, + { + "providerName": "Microsoft-Windows-WER-Diag", + "providerGuid": "AD8AA069-A01B-40A0-BA40-948D1D8DEDC5" + }, + { + "providerName": "Microsoft-Windows-WER-PayloadHealth", + "providerGuid": "4AFDDFDE-002D-51AC-C109-C3B7897858D0" + }, + { + "providerName": "Microsoft-Windows-WER-SystemErrorReporting", + "providerGuid": "ABCE23E7-DE45-4366-8631-84FA6C525952" + }, + { + "providerName": "Microsoft-Windows-WerKernel", + "providerGuid": "87A623F0-8DB5-5C11-7C80-A2EBBCBE5189" + }, + { + "providerName": "Microsoft-Windows-WFP", + "providerGuid": "0C478C5B-0351-41B1-8C58-4A6737DA32E3" + }, + { + "providerName": "Microsoft-Windows-WHEA-Logger", + "providerGuid": "C26C4F3C-3F66-4E99-8F8A-39405CFED220" + }, + { + "providerName": "Microsoft-Windows-WiFiDisplay", + "providerGuid": "712880E9-7813-41A3-8E4C-E4E0C4F6580A" + }, + { + "providerName": "Microsoft-Windows-WiFiHotspotService", + "providerGuid": "814182FE-58F7-11E1-853C-78E7D1CA7337" + }, + { + "providerName": "Microsoft-Windows-WiFiNetworkManager", + "providerGuid": "E5C16D49-2464-4382-BB20-97A4B5465DB9" + }, + { + "providerName": "Microsoft-Windows-Win32k", + "providerGuid": "8C416C79-D49B-4F01-A467-E56D3AA8234C" + }, + { + "providerName": "Microsoft-Windows-Windeploy", + "providerGuid": "75EBC33E-C8AE-4F93-9CA1-683A53E20CB6" + }, + { + "providerName": "Microsoft-Windows-Windows Defender", + "providerGuid": "11CD958A-C507-4EF3-B3F2-5FD9DFBD2C78" + }, + { + "providerName": "Microsoft-Windows-Windows Firewall With Advanced Security", + "providerGuid": "D1BC9AFF-2ABF-4D71-9146-ECB2A986EB85" + }, + { + "providerName": "Microsoft-Windows-WindowsBackup", + "providerGuid": "01979C6A-42FA-414C-B8AA-EEE2C8202018" + }, + { + "providerName": "Microsoft-Windows-WindowsColorSystem", + "providerGuid": "D53270E3-C8CF-4707-958A-DAD20C90073C" + }, + { + "providerName": "Microsoft-Windows-WindowsSystemAssessmentTool", + "providerGuid": "11A75546-3234-465E-BEC8-2D301CB501AC" + }, + { + "providerName": "Microsoft-Windows-WindowsToGo-StartupOptions", + "providerGuid": "2E6CB42E-161D-413B-A6C1-84CA4C1E5890" + }, + { + "providerName": "Microsoft-Windows-WindowsUIImmersive", + "providerGuid": "74827CBB-1E0F-45A2-8523-C605866D2F22" + }, + { + "providerName": "Microsoft-Windows-WindowsUpdateClient", + "providerGuid": "945A8954-C147-4ACD-923F-40C45405A658" + }, + { + "providerName": "Microsoft-Windows-WinHttp", + "providerGuid": "7D44233D-3055-4B9C-BA64-0D47CA40A232" + }, + { + "providerName": "Microsoft-Windows-WinHttp-Diagnostics", + "providerGuid": "64DE121B-5F08-5853-AB48-7758F2EA2DD3" + }, + { + "providerName": "Microsoft-Windows-WinHttp-Pca", + "providerGuid": "D071CE03-0D7B-5B27-E817-B9C12961934E" + }, + { + "providerName": "Microsoft-Windows-WinINet", + "providerGuid": "43D1A55C-76D6-4F7E-995C-64C711E5CAFE" + }, + { + "providerName": "Microsoft-Windows-WinINet-Capture", + "providerGuid": "A70FF94F-570B-4979-BA5C-E59C9FEAB61B" + }, + { + "providerName": "Microsoft-Windows-WinINet-Config", + "providerGuid": "5402E5EA-1BDD-4390-82BE-E108F1E634F5" + }, + { + "providerName": "Microsoft-Windows-WinINet-Pca", + "providerGuid": "4860EA43-3F05-5FB8-20CE-7BA346A44747" + }, + { + "providerName": "Microsoft-Windows-Wininit", + "providerGuid": "206F6DEA-D3C5-4D10-BC72-989F03C8B84B" + }, + { + "providerName": "Microsoft-Windows-Winlogon", + "providerGuid": "DBE9B383-7CF3-4331-91CC-A3CB16A3B538" + }, + { + "providerName": "Microsoft-Windows-WinMDE", + "providerGuid": "77549803-7BB1-418B-A98E-F2E22F35A873" + }, + { + "providerName": "Microsoft-Windows-WinML", + "providerGuid": "C8517E09-BEA2-5BB6-BEF3-50B4C91C431E" + }, + { + "providerName": "Microsoft-Windows-WinNat", + "providerGuid": "66C07ECD-6667-43FC-93F8-05CF07F446EC" + }, + { + "providerName": "Microsoft-Windows-WinREAgent", + "providerGuid": "1F7A6C55-5532-573B-35B7-2107E43A6EF5" + }, + { + "providerName": "Microsoft-Windows-WinRM", + "providerGuid": "A7975C8F-AC13-49F1-87DA-5A984A4AB417" + }, + { + "providerName": "Microsoft-Windows-WinRT-Error", + "providerGuid": "A86F8471-C31D-4FBC-A035-665D06047B03" + }, + { + "providerName": "Microsoft-Windows-Winsock-AFD", + "providerGuid": "E53C6823-7BB8-44BB-90DC-3F86090D48A6" + }, + { + "providerName": "Microsoft-Windows-Winsock-NameResolution", + "providerGuid": "55404E71-4DB9-4DEB-A5F5-8F86E46DDE56" + }, + { + "providerName": "Microsoft-Windows-Winsock-Sockets", + "providerGuid": "BDE46AEA-2357-51FE-7367-D5296F530BD1" + }, + { + "providerName": "Microsoft-Windows-Winsock-SQM", + "providerGuid": "093DA50C-0BB9-4D7D-B95C-3BB9FCDA5EE8" + }, + { + "providerName": "Microsoft-Windows-Winsock-WS2HELP", + "providerGuid": "D5C25F9A-4D47-493E-9184-40DD397A004D" + }, + { + "providerName": "Microsoft-Windows-Winsrv", + "providerGuid": "9D55B53D-449B-4824-A637-24F9D69AA02F" + }, + { + "providerName": "Microsoft-Windows-Wired-AutoConfig", + "providerGuid": "B92CF7FD-DC10-4C6B-A72D-1613BF25E597" + }, + { + "providerName": "Microsoft-Windows-WLAN-AutoConfig", + "providerGuid": "9580D7DD-0379-4658-9870-D5BE7D52D6DE" + }, + { + "providerName": "Microsoft-Windows-WLAN-Driver", + "providerGuid": "DAA6A96B-F3E7-4D4D-A0D6-31A350E6A445" + }, + { + "providerName": "Microsoft-Windows-WlanDlg", + "providerGuid": "D4AFA0DC-4DD1-40AF-AFCE-CB0D0E6736A7" + }, + { + "providerName": "Microsoft-Windows-WlanPref", + "providerGuid": "CA5BA219-C0D4-4EFA-9CEB-72AFF92672B0" + }, + { + "providerName": "Microsoft-Windows-WLGPA", + "providerGuid": "46098845-8A94-442D-9095-366A6BCFEFA9" + }, + { + "providerName": "Microsoft-Windows-wmbclass", + "providerGuid": "12D25187-6C0D-4783-AD3A-84CAA135ACFD" + }, + { + "providerName": "Microsoft-Windows-Wmbclass-Opn", + "providerGuid": "A42FE227-A7BF-4483-A502-6BCDA428CD96" + }, + { + "providerName": "Microsoft-Windows-WMI", + "providerGuid": "1EDEEE53-0AFE-4609-B846-D8C0B2075B1F" + }, + { + "providerName": "Microsoft-Windows-WMI-Activity", + "providerGuid": "1418EF04-B0B4-4623-BF7E-D74AB47BBDAA" + }, + { + "providerName": "Microsoft-Windows-WMP", + "providerGuid": "F3F14FF3-7B80-4868-91D0-D77E497B025E" + }, + { + "providerName": "Microsoft-Windows-WMP-Setup_WM", + "providerGuid": "0D759F0F-CFF9-4902-8867-EB9E29D7A98B" + }, + { + "providerName": "Microsoft-Windows-WMPDMCUI", + "providerGuid": "3F9E07BD-0E26-4241-A5A5-28CAFA150A75" + }, + { + "providerName": "Microsoft-Windows-WMPNSS-PublicAPI", + "providerGuid": "614696C9-85AF-4E64-B389-D2C0DB4FF87B" + }, + { + "providerName": "Microsoft-Windows-WMPNSS-Service", + "providerGuid": "6A2DC7C1-930A-4FB5-BB44-80B30AEBED6C" + }, + { + "providerName": "Microsoft-Windows-WMPNSSUI", + "providerGuid": "7C314E58-8246-47D1-8F7A-4049DC543E0B" + }, + { + "providerName": "Microsoft-Windows-wmvdecod", + "providerGuid": "55BACC9F-9AC0-46F5-968A-A5A5DD024F8A" + }, + { + "providerName": "Microsoft-Windows-WMVENCOD", + "providerGuid": "313B0545-BF9C-492E-9173-8DE4863B8573" + }, + { + "providerName": "Microsoft-Windows-WorkFolders", + "providerGuid": "34A3697E-0F10-4E48-AF3C-F869B5BABEBB" + }, + { + "providerName": "Microsoft-Windows-Workplace Join", + "providerGuid": "76AB12D5-C986-4E60-9D7C-2A092B284CDD" + }, + { + "providerName": "Microsoft-Windows-WPD-API", + "providerGuid": "31569DCF-9C6F-4B8E-843A-B7C1CC7FFCBA" + }, + { + "providerName": "Microsoft-Windows-WPD-CompositeClassDriver", + "providerGuid": "355C44FE-0C8E-4BF8-BE28-8BC7B5A42720" + }, + { + "providerName": "Microsoft-Windows-WPD-MTPBT", + "providerGuid": "92AB58D3-F351-4AF5-9C72-D52F36EE2C92" + }, + { + "providerName": "Microsoft-Windows-WPD-MTPClassDriver", + "providerGuid": "21B7C16E-C5AF-4A69-A74A-7245481C1B97" + }, + { + "providerName": "Microsoft-Windows-WPD-MTPIP", + "providerGuid": "C374D21E-69B2-4CD7-9A25-62187C5A5619" + }, + { + "providerName": "Microsoft-Windows-WPD-MTPUS", + "providerGuid": "DCFC4489-9CE0-403C-99DF-A05422C60898" + }, + { + "providerName": "Microsoft-Windows-WPDClassInstaller", + "providerGuid": "AD5162D8-DAF0-4A25-88A7-01CBEB33902E" + }, + { + "providerName": "Microsoft-Windows-WSC-SRV", + "providerGuid": "5857D6CA-9732-4454-809B-2A87B70881F8" + }, + { + "providerName": "Microsoft-Windows-WUSA", + "providerGuid": "09608C12-C1DA-4104-A6FE-B959CF57560A" + }, + { + "providerName": "Microsoft-Windows-WWAN-MM-EVENTS", + "providerGuid": "7839BB2A-2EA3-4ECA-A00F-B558BA678BEC" + }, + { + "providerName": "Microsoft-Windows-WWAN-NDISUIO-EVENTS", + "providerGuid": "B3EEE223-D0A9-40CD-ADFC-50F1888138AB" + }, + { + "providerName": "Microsoft-Windows-WWAN-SVC-EVENTS", + "providerGuid": "3CB40AAA-1145-4FB8-B27B-7E30F0454316" + }, + { + "providerName": "Microsoft-Windows-WwanClient_0ca4cac9670d3ec454b4175eb8aa80b3", + "providerGuid": "0CA4CAC9-670D-3EC4-54B4-175EB8AA80B3" + }, + { + "providerName": "Microsoft-Windows-WwanProtDim_e72a6a5d74743941a6fa83201a9f8ef4", + "providerGuid": "E72A6A5D-7474-3941-A6FA-83201A9F8EF4" + }, + { + "providerName": "Microsoft-Windows-XAML", + "providerGuid": "531A35AB-63CE-4BCF-AA98-F88C7A89E455" + }, + { + "providerName": "Microsoft-Windows-XAML-Diagnostics", + "providerGuid": "59E7A714-73A4-4147-B47E-0957048C75C4" + }, + { + "providerName": "Microsoft-Windows-XAudio2", + "providerGuid": "1EE3ABDB-C1FC-4B43-9E56-11064ABBA866" + }, + { + "providerName": "Microsoft-Windows-XWizards", + "providerGuid": "777BA8FE-2498-4875-933A-3067DE883070" + }, + { + "providerName": "Microsoft-Windows-ZTDNS", + "providerGuid": "8507CD07-F18B-54F0-B871-23C43A5BF118" + }, + { + "providerName": "Microsoft-Windows-ZTHELPER", + "providerGuid": "40E3FC75-59E8-5443-47CB-A1E1B197FDE0" + }, + { + "providerName": "Microsoft-Windows-ZTraceMaps", + "providerGuid": "B865B57B-BDDA-4E1D-A2C8-ADFA69FE6AB9" + }, + { + "providerName": "Microsoft-WindowsAzure-Diagnostics", + "providerGuid": "9148C98F-152C-44D3-A496-26350C475D74" + }, + { + "providerName": "Microsoft-WindowsAzure-Status", + "providerGuid": "9E3B8BEE-15EB-444B-A692-BAB4546644F2" + }, + { + "providerName": "Microsoft-WindowsPhone-ConfigManager2", + "providerGuid": "2F94E1CC-A8C5-4FE7-A1C3-53D7BDA8E73E" + }, + { + "providerName": "Microsoft-WindowsPhone-CoreMessaging", + "providerGuid": "922CDCF3-6123-42DA-A877-1A24F23E39C5" + }, + { + "providerName": "Microsoft-WindowsPhone-CoreUIComponents", + "providerGuid": "A0B7550F-4E9A-4F03-AD41-B8042D06A2F7" + }, + { + "providerName": "Microsoft-WindowsPhone-Ufx", + "providerGuid": "E98EBDBF-3058-4784-8521-47860B1D2B8E" + }, + { + "providerName": "Microsoft-WindowsPhone-UfxSynopsys", + "providerGuid": "49B12C7C-4BD5-4F93-BB75-30FCE739600B" + }, + { + "providerName": "Microsoft.Windows.HyperV.GpupVDev", + "providerGuid": "C3A331B2-AF4F-5472-FD2F-4313035C4E77" + }, + { + "providerName": "Microsoft.Windows.HyperV.VmIcCore", + "providerGuid": "E5EA3CA6-5EB0-597D-504A-2FD09CCDEFDA" + }, + { + "providerName": "Microsoft.Windows.ResourceManager", + "providerGuid": "4180C4F7-E238-5519-338F-EC214F0B49AA" + }, + { + "providerName": "Microsoft_SideCar", + "providerGuid": "1DB28F2E-8F80-4027-8C5A-A11F7F10F62D" + }, + { + "providerName": "MMC", + "providerGuid": "9C88041D-349D-4647-8BFD-2C0A167BFE58" + }, + { + "providerName": "Mobility Center Performance Trace", + "providerGuid": "8A8B5246-6EB6-4339-8B59-B0085B9F4890" + }, + { + "providerName": "Mobility Center Trace", + "providerGuid": "082DFF20-F430-11D9-8CD6-0800200C9A66" + }, + { + "providerName": "Mount Manager Trace", + "providerGuid": "467C1914-37F0-4C7D-B6DB-5CD7DFE7BD5E" + }, + { + "providerName": "MSADCE.1", + "providerGuid": "76DBA919-5A36-FC80-2CAD-3185532B7CB1" + }, + { + "providerName": "MSADCF.1", + "providerGuid": "101C0E21-EBBA-A60A-EC3D-58797788928A" + }, + { + "providerName": "MSADCO.1", + "providerGuid": "5C6CE734-1B3E-705E-C2AB-B272D99AAF8F" + }, + { + "providerName": "MSADDS.1", + "providerGuid": "13CD7F92-5BAA-8C7C-3D72-B69FAC139A46" + }, + { + "providerName": "MSADOX.1", + "providerGuid": "6C770D53-0441-AFD4-DCAB-1D89155FECFC" + }, + { + "providerName": "MSDADIAG.ETW", + "providerGuid": "8B98D3F2-3CC6-0B9C-6651-9649CCE5C752" + }, + { + "providerName": "MSDAPRST.1", + "providerGuid": "64A552E0-6C60-B907-E59C-10F1DFF76B0D" + }, + { + "providerName": "MSDAREM.1", + "providerGuid": "564F1E24-FC86-28E1-74F8-5CA0D950BEE0" + }, + { + "providerName": "MSDART.1", + "providerGuid": "CEB7253C-BB96-9DFE-51D1-53D966D0CF8B" + }, + { + "providerName": "MSDASQL_1", + "providerGuid": "B6501BA0-C61A-C4E6-6FA2-A4E7F8C8E7A0" + }, + { + "providerName": "MSDATL3.1", + "providerGuid": "87B93A44-1F73-EC83-7261-2DFC972D9B1E" + }, + { + "providerName": "msiscsi_iScsi", + "providerGuid": "1BABEFB4-59CB-49E5-9698-FD38AC830A91" + }, + { + "providerName": "MUI Resource Trace", + "providerGuid": "D3DE60B2-A663-45D5-9826-A0A5949D2CB0" + }, + { + "providerName": "Native WIFI Filter Driver Trace", + "providerGuid": "D905AC1C-65E7-4242-99EA-FE66A8355DF8" + }, + { + "providerName": "Native WIFI MSM Trace", + "providerGuid": "D905AC1D-65E7-4242-99EA-FE66A8355DF8" + }, + { + "providerName": "NetJoin", + "providerGuid": "9741FD4E-3757-479F-A3C6-FC49F6D5EDD0" + }, + { + "providerName": "Network Location Awareness Trace", + "providerGuid": "1AC55562-D4FF-4BC5-8EF3-A18E07C4668E" + }, + { + "providerName": "Network Profile Manager", + "providerGuid": "D9131565-E1DD-4C9E-A728-951999C2ADB5" + }, + { + "providerName": "NisDrvWFP Provider", + "providerGuid": "49D6AD7B-52C4-4F79-A164-4DCD908391E4" + }, + { + "providerName": "Ntfs", + "providerGuid": "DD70BC80-EF44-421B-8AC3-CD31DA613A4E" + }, + { + "providerName": "Ntfs_NtfsLog", + "providerGuid": "B2FC00C4-2941-4D11-983B-B16E8AA4E25D" + }, + { + "providerName": "NTLM Security Protocol", + "providerGuid": "C92CF544-91B3-4DC0-8E11-C580339A0BF8" + }, + { + "providerName": "ODBC.1", + "providerGuid": "F34765F6-A1BE-4B9D-1400-B8A12921F704" + }, + { + "providerName": "ODBCBCP.1", + "providerGuid": "932B59F1-90C2-D8BA-0956-3975C344AE2B" + }, + { + "providerName": "OfficeAirSpace", + "providerGuid": "F562BB8E-422D-4B5C-B20E-90D710F7D11C" + }, + { + "providerName": "OfficeLoggingLiblet", + "providerGuid": "F50D9315-E17E-43C1-8370-3EDF6CC057BE" + }, + { + "providerName": "OLEDB.1", + "providerGuid": "0DD082C4-66F2-271F-74BA-2BF1F9F65C66" + }, + { + "providerName": "OpenSSH", + "providerGuid": "C4B57D35-0636-4BC3-A262-370F249F9802" + }, + { + "providerName": "PNPX AssocDB Trace", + "providerGuid": "7311AD03-18D6-45AC-9B08-B020BDD6A590" + }, + { + "providerName": "Portable Device Connectivity API Trace", + "providerGuid": "02FE721A-0725-469E-A26D-37B3C09FAAC1" + }, + { + "providerName": "PowerShellCore", + "providerGuid": "F90714A8-5509-434A-BF6D-B1624C8A19A2" + }, + { + "providerName": "PrintFilterPipelineSvc_ObjectsGuid", + "providerGuid": "AEFE45F4-8548-42B4-B1C8-25673B07AD8B" + }, + { + "providerName": "Refsv1WppTrace", + "providerGuid": "6D2FD9C5-8BD8-4A5D-8AA8-01E5C3B2AE23" + }, + { + "providerName": "RefsWppTrace", + "providerGuid": "740F3C34-57DF-4BAD-8EEA-72AC69AD5DF5" + }, + { + "providerName": "RmClient_RestartManager", + "providerGuid": "0888E5EF-9B98-4695-979D-E92CE4247224" + }, + { + "providerName": "RowsetHelper.1", + "providerGuid": "74A75B02-36D8-EDE6-D10E-95B691503408" + }, + { + "providerName": "RSS Platform Backgroundsync Perf Trace", + "providerGuid": "CA1CF55C-9E49-4AD3-8038-39CB6F66AF11" + }, + { + "providerName": "RSS Platform Backgroundsync Trace", + "providerGuid": "F59D1D86-CC03-4736-BC9C-4C7936871B3D" + }, + { + "providerName": "RSS Platform Perf Trace", + "providerGuid": "2B240425-3141-43EE-931F-EC9F997C7D7E" + }, + { + "providerName": "RSS Platform Trace", + "providerGuid": "8C50FA6E-394E-4B47-B6D1-A880A5F225A2" + }, + { + "providerName": "RuntimeInstaller", + "providerGuid": "417879EB-0EFB-4A9A-87EF-B9B55086AAF1" + }, + { + "providerName": "RuntimeRestServer", + "providerGuid": "EC93ADF0-A939-4E61-B96D-BFA285EBA2D5" + }, + { + "providerName": "SBP2 Port Driver Tracing Provider", + "providerGuid": "6710597F-7319-4AAE-9B85-C8D87136A56B" + }, + { + "providerName": "Schannel", + "providerGuid": "1F678132-5938-4686-9FDC-C8FF68F15C85" + }, + { + "providerName": "SD Bus Trace", + "providerGuid": "3B9E3DA4-70B8-46D3-9EF2-3DDF128BDED8" + }, + { + "providerName": "Security: Kerberos Authentication", + "providerGuid": "6B510852-3583-4E2D-AFFE-A67F9F223438" + }, + { + "providerName": "Security: NTLM Authentication", + "providerGuid": "5BBB6C18-AA45-49B1-A15F-085F7ED0AA90" + }, + { + "providerName": "Security: SChannel", + "providerGuid": "37D2C3CD-C5D4-4587-8531-4696C44244C8" + }, + { + "providerName": "Security: TSPkg", + "providerGuid": "6165F3E2-AE38-45D4-9B23-6B4818758BD9" + }, + { + "providerName": "Security: WDigest", + "providerGuid": "FB6A424F-B5D6-4329-B9D5-A975B3A93EAD" + }, + { + "providerName": "Sensor ClassExtension Trace", + "providerGuid": "A1E89BB0-EF73-4980-8C99-DD15F7271D7E" + }, + { + "providerName": "Service Control Manager", + "providerGuid": "555908D1-A6D7-4695-8E1E-26931D2012F4" + }, + { + "providerName": "Service Control Manager Trace", + "providerGuid": "EBCCA1C2-AB46-4A1D-8C2A-906C2FF25F39" + }, + { + "providerName": "ServiceRuntime", + "providerGuid": "3A867E2E-2C45-4B6C-9654-D7575E57F3CF" + }, + { + "providerName": "SQLOLEDB_1", + "providerGuid": "C5BFFE2E-9D87-D568-A09E-08FC83D0C7C2" + }, + { + "providerName": "SQLSRV32.1", + "providerGuid": "4B647745-F438-0A42-F870-5DBD29949C99" + }, + { + "providerName": "TCPIP Service Trace", + "providerGuid": "EB004A05-9B1A-11D4-9123-0050047759BC" + }, + { + "providerName": "Telemetry", + "providerGuid": "7C203661-7420-49DE-B8E0-7CC5878EBED0" + }, + { + "providerName": "TerminalServer-MediaFoundationPlugin", + "providerGuid": "4199EE71-D55D-47D7-9F57-34A1D5B2C904" + }, + { + "providerName": "Thread Pool", + "providerGuid": "C861D0E2-A2C1-4D36-9F9C-970BAB943A12" + }, + { + "providerName": "TPM", + "providerGuid": "1B6B0772-251B-4D42-917D-FACA166BC059" + }, + { + "providerName": "TransparentInstaller", + "providerGuid": "747C00B6-F0B4-438C-8B48-F3E5D7ED38A2" + }, + { + "providerName": "TS Client ActiveX Control Trace", + "providerGuid": "DAA6CAF5-6678-43F8-A6FE-B40EE096E06E" + }, + { + "providerName": "TS Client Trace", + "providerGuid": "0C51B20C-F755-48A8-8123-BF6DA2ADC727" + }, + { + "providerName": "TS Rdp Init Trace", + "providerGuid": "C127C1A8-6CEB-11DA-8BDE-F66BAD1E3F3A" + }, + { + "providerName": "TS RDP Shell Trace", + "providerGuid": "BFA655DC-6C51-11DA-8BDE-F66BAD1E3F3A" + }, + { + "providerName": "TS Rdp Sound End Point Trace", + "providerGuid": "5A966D1C-6B48-11DA-8BDE-F66BAD1E3F3A" + }, + { + "providerName": "UMB Trace", + "providerGuid": "96AB095A-9519-4F5C-81EE-C510B0A45463" + }, + { + "providerName": "UmBus Driver Trace", + "providerGuid": "F9BE9C98-10DB-4318-BB61-CB0DDEA08BF7" + }, + { + "providerName": "UMDF - Driver Manager Trace", + "providerGuid": "485E7DEA-0A80-11D8-AD15-505054503030" + }, + { + "providerName": "UMDF - Framework Trace", + "providerGuid": "485E7DE9-0A80-11D8-AD15-505054503030" + }, + { + "providerName": "UMDF - Host Process Trace", + "providerGuid": "485E7DF0-0A80-11D8-AD15-505054503030" + }, + { + "providerName": "UMDF - Lpc Driver Trace", + "providerGuid": "485E7DED-0A80-11D8-AD15-505054503030" + }, + { + "providerName": "UMDF - Lpc Trace", + "providerGuid": "485E7DEF-0A80-11D8-AD15-505054503030" + }, + { + "providerName": "UMDF - Platform Library Trace", + "providerGuid": "485E7DE8-0A80-11D8-AD15-505054503030" + }, + { + "providerName": "UMDF - Reflector Trace", + "providerGuid": "485E7DEE-0A80-11D8-AD15-505054503030" + }, + { + "providerName": "UMDF - Test Trace", + "providerGuid": "485E7DEB-0A80-11D8-AD15-505054503030" + }, + { + "providerName": "UMDF - WDF Core", + "providerGuid": "485E7DE9-0A80-11D8-AD15-505054503030" + }, + { + "providerName": "UMPass Driver Trace", + "providerGuid": "FF9E2BDD-0E24-437C-84BE-7CFCAE635808" + }, + { + "providerName": "USB Storage Driver Tracing Provider", + "providerGuid": "72FB9358-A9B3-41E0-AE41-E8DECA41E3A8" + }, + { + "providerName": "User-mode PnP Manager Trace", + "providerGuid": "A676B545-4CFB-4306-A067-502D9A0F2220" + }, + { + "providerName": "User32", + "providerGuid": "B0AA8734-56F7-41CC-B2F4-DE228E98B946" + }, + { + "providerName": "Volsnap", + "providerGuid": "CB017CD2-1F37-4E65-82BC-3E91F6A37559" + }, + { + "providerName": "VSS tracing provider", + "providerGuid": "9138500E-3648-4EDB-AA4C-859E9F7B7C38" + }, + { + "providerName": "Windows Connect Now", + "providerGuid": "C100BECE-D33A-4A4B-BF23-BBEF4663D017" + }, + { + "providerName": "Windows Defender Firewall API", + "providerGuid": "28C9F48F-D244-45A8-842F-DC9FBC9B6E92" + }, + { + "providerName": "Windows Defender Firewall API - GP", + "providerGuid": "0EFF663F-8B6E-4E6D-8182-087A8EAA29CB" + }, + { + "providerName": "Windows Defender Firewall Driver", + "providerGuid": "D5E09122-D0B2-4235-ADC1-C89FAAAF1069" + }, + { + "providerName": "Windows Defender Firewall NetShell Plugin", + "providerGuid": "28C9F48F-D244-45A8-842F-DC9FBC9B6E94" + }, + { + "providerName": "Windows Defender Firewall Service", + "providerGuid": "5EEFEBDB-E90C-423A-8ABF-0241E7C5B87D" + }, + { + "providerName": "Windows Error Reporting", + "providerGuid": "0EAD09BD-2157-539A-8D6D-C87F95B64D70" + }, + { + "providerName": "Windows Kernel Trace", + "providerGuid": "9E814AAD-3204-11D2-9A82-006008A86939" + }, + { + "providerName": "Windows Media Player Trace", + "providerGuid": "A9C1A3B7-54F3-4724-ADCE-58BC03E3BC78" + }, + { + "providerName": "Windows NetworkItemFactory Trace", + "providerGuid": "D2A60D61-0F87-4673-A86C-9C461457FE27" + }, + { + "providerName": "Windows Notification Facility Provider", + "providerGuid": "42695762-EA50-497A-9068-5CBBB35E0B95" + }, + { + "providerName": "Windows Remote Management Trace", + "providerGuid": "04C6E16D-B99F-4A3A-9B3E-B8325BBC781E" + }, + { + "providerName": "Windows Wininit Trace", + "providerGuid": "C2BA06E2-F7CE-44AA-9E7E-62652CDEFE97" + }, + { + "providerName": "Windows Winlogon Trace", + "providerGuid": "D451642C-63A6-11D7-9720-00B0D03E0347" + }, + { + "providerName": "Windows-ApplicationModel-Store-SDK", + "providerGuid": "FF79A477-C45F-4A52-8AE0-2B324346D4E4" + }, + { + "providerName": "WindowsAzure-GuestAgent-Diagnostic", + "providerGuid": "DE49CBBE-8388-4C87-8310-2F9EC1338BDE" + }, + { + "providerName": "WindowsAzure-GuestAgent-Metrics", + "providerGuid": "FFF0196F-EE4C-4EAF-9AA5-776F622DEB4F" + }, + { + "providerName": "WindowsAzure-GuestAgent-Status", + "providerGuid": "69B669B9-4AF8-4C50-BDC4-6006FA76E975" + }, + { + "providerName": "WindowsAzureGuestAgent", + "providerGuid": "3000B92B-CA8B-4269-90EA-C4185EE09E92" + }, + { + "providerName": "WINSATAPI_ETW_PROVIDER", + "providerGuid": "617853D6-728B-4B59-8A78-C3A9A5EADE92" + }, + { + "providerName": "winsrvext", + "providerGuid": "2B9537F0-4A90-557B-1313-D0CE2827A94A" + }, + { + "providerName": "Wireless Client Trace", + "providerGuid": "8A3CF0B5-E0BC-450B-AE4B-61728FFA1D58" + }, + { + "providerName": "WLAN AutoConfig Trace", + "providerGuid": "0C5A3172-2248-44FD-B9A6-8389CB1DC56A" + }, + { + "providerName": "WLAN Diagnostics Trace", + "providerGuid": "637A0F36-DFF5-4B2F-83DD-B106C1C725E2" + }, + { + "providerName": "WLAN Dialog Trace", + "providerGuid": "520319A9-B932-4EC7-943C-61E560939101" + }, + { + "providerName": "WLAN Extensibility Trace", + "providerGuid": "E2EB5B52-08B1-4391-B670-F58317376247" + }, + { + "providerName": "WMI_Tracing", + "providerGuid": "1FF6B227-2CA7-40F9-9A66-980EADAA602E" + }, + { + "providerName": "WMI_Tracing_Client_Operations", + "providerGuid": "8E6B6962-AB54-4335-8229-3255B919DD0E" + }, + { + "providerName": "WMP Network Sharing API", + "providerGuid": "8ED60A3A-8C12-49C5-A518-FDF451BC10FC" + }, + { + "providerName": "WMP Network Sharing Service", + "providerGuid": "A7EB57F6-145E-4F18-BD75-DBBF6F7E23A7" + }, + { + "providerName": "WMP Network Sharing Taskbar", + "providerGuid": "D804A67F-4C25-43C1-896F-89FF78B3A911" + }, + { + "providerName": "WPD API Trace", + "providerGuid": "C3C5D8AF-2FD5-4500-A8E7-379C2D0BBE2E" + }, + { + "providerName": "WPD Bluetooth MTP Emumerator Driver Trace", + "providerGuid": "4B6EFB94-30EA-49A7-BB29-E9ED9DCE67DA" + }, + { + "providerName": "WPD BusEnumService Trace", + "providerGuid": "0381564E-D5CB-4E48-AB35-BE24389B0F59" + }, + { + "providerName": "WPD ClassExtension Trace", + "providerGuid": "A0A352C5-B8EC-41E9-9936-8452C1C0A6CF" + }, + { + "providerName": "WPD ClassInstaller Trace", + "providerGuid": "45350D79-4497-42F1-BD1B-83587575B91A" + }, + { + "providerName": "WPD FSDriver Trace", + "providerGuid": "1311095B-B9FF-497A-8560-2F43CA5438E4" + }, + { + "providerName": "WPD MTPDriver Trace", + "providerGuid": "97496DDA-C211-4FFE-B1B1-68E6E98EBC38" + }, + { + "providerName": "WPD ShellExtension Trace", + "providerGuid": "A42C7BD1-5AF3-4B32-9BC6-B85EB31D3F4A" + }, + { + "providerName": "WPD ShellServiceObject Trace", + "providerGuid": "1AB5AC29-037F-43A1-9484-78C9DB61F869" + }, + { + "providerName": "WPD Types Trace", + "providerGuid": "58E8F67D-29E9-456C-B23D-C6489E341BB0" + }, + { + "providerName": "WPD WiaCompat Trace", + "providerGuid": "B809F4FF-3023-473C-971B-AB594429EA57" + }, + { + "providerName": "WPD WMDMCompat Trace", + "providerGuid": "17ABF473-982C-4D0E-B502-3A59D89E71DE" + }, + { + "providerName": "WSAT_TraceProvider", + "providerGuid": "7F3FE630-462B-47C5-AB07-67CA84934ABD" + }, + { + "providerName": "Wudfx02000_KmdfTraceGuid", + "providerGuid": "485E7DE9-0A80-11D8-AD15-505054503030" + }, + { + "providerName": "XWizard Framework", + "providerGuid": "777BA8FF-2498-4875-933A-3067DE883070" + } + ] +} \ No newline at end of file diff --git a/internal/uvm/etw/provider_map.go b/internal/uvm/etw/provider_map.go new file mode 100644 index 0000000000..a647ae1f72 --- /dev/null +++ b/internal/uvm/etw/provider_map.go @@ -0,0 +1,279 @@ +package etw + +import ( + "embed" + "encoding/base64" + "encoding/json" + "fmt" + "strings" + "sync" +) + +//go:embed etw-map.json +//go:embed default-logsources.json + +var etwFS embed.FS +var listFS embed.FS + +const ( + EtwMapFileName = "etw-map.json" + DefaultLogSourcesFile = "default-logsources.json" +) + +var ( + onceLists sync.Once + onceListMap sync.Once + defaultLogSources LogSourcesInfo + defaultLogSourcesWithMap LogSourcesInfo +) + +var ( + onceProvider sync.Once + nameToGUID map[string]string // STATIC + guidToName map[string]string // STATIC +) + +// Log Sources JSON structure +type LogSourcesInfo struct { + LogConfig LogConfig `json:"LogConfig"` +} + +type LogConfig struct { + Sources []Source `json:"sources"` +} + +type Source struct { + Type string `json:"type"` + Providers []EtwProvider `json:"providers"` +} + +type EtwProvider struct { + ProviderName string `json:"providerName,omitempty"` + ProviderGuid string `json:"providerGuid,omitempty"` + Level string `json:"level,omitempty"` + Keywords string `json:"keywords,omitempty"` +} + +// ETW - Map JSON structure +type EtwInfo struct { + EtwMap []EtwProviderMap `json:"EtwProviderMap"` +} + +type EtwProviderMap struct { + ProviderName string `json:"providerName"` + ProviderGuid string `json:"providerGuid"` +} + +// NormalizeGuid takes a GUID string in various formats and normalizes it to the standard 8-4-4-4-12 format with uppercase letters. It returns an error if the input string is not a valid GUID. +func NormalizeGuid(in string) (string, error) { + s := strings.TrimSpace(in) + s = strings.TrimPrefix(s, "{") + s = strings.TrimSuffix(s, "}") + s = strings.TrimSpace(s) + + compact := strings.ReplaceAll(s, "-", "") + if len(compact) != 32 { + return "", fmt.Errorf("GUID %q has invalid length after normalization (%d, want 32 hex chars)", in, len(compact)) + } + + for i := 0; i < len(compact); i++ { + c := compact[i] + isHex := (c >= '0' && c <= '9') || + (c >= 'a' && c <= 'f') || + (c >= 'A' && c <= 'F') + if !isHex { + return "", fmt.Errorf("GUID %q contains non-hex character %q", in, c) + } + } + + compact = strings.ToUpper(compact) + return compact[0:8] + "-" + + compact[8:12] + "-" + + compact[12:16] + "-" + + compact[16:20] + "-" + + compact[20:32], nil +} + +// LoadEtwMap loads the ETW provider name to GUID mapping from the embedded JSON file. It returns two maps, one for name to GUID and another for GUID to name. If there is an error in loading or parsing the file, it returns empty maps and the error. +func LoadEtwMap() (map[string]string, map[string]string, error) { + onceProvider.Do(func() { + b, err := etwFS.ReadFile(EtwMapFileName) + if err != nil { + return + } + + var cfg EtwInfo + if err := json.Unmarshal(b, &cfg); err != nil { + return + } + + n2g := make(map[string]string) + g2n := make(map[string]string) + + for _, p := range cfg.EtwMap { + name := strings.TrimSpace(p.ProviderName) + guid, err := NormalizeGuid(p.ProviderGuid) + if name == "" || err != nil { + // skip invalid entries + continue + } + + // Duplicate check + if _, ok := n2g[name]; ok { + // skip if already exists + continue + } + if _, ok := g2n[guid]; ok { + // skip if already exists + continue + } + + n2g[name] = guid + g2n[guid] = name + } + + nameToGUID = n2g + guidToName = g2n + + }) + + return nameToGUID, guidToName, nil +} + +// GetDefaultLogSources returns the default log sources from the embedded json file. If there is an error in loading or parsing the file, it returns an empty LogSourcesInfo struct and the error. +func GetDefaultLogSources() (LogSourcesInfo, error) { + onceLists.Do(func() { + + allList, err := listFS.ReadFile(DefaultLogSourcesFile) + if err != nil { + return + } + + if err := json.Unmarshal(allList, &defaultLogSources); err != nil { + return + } + }) + return defaultLogSources, nil +} + +// GetDefaultLogSourcesWithMappedGuid returns the default log sources with provider GUIDs included in the providers. If there is an error in loading the default log sources or the ETW map, it returns the default log sources without GUIDs. +func GetDefaultLogSourcesWithMappedGuid() (LogSourcesInfo, error) { + onceListMap.Do(func() { + _, err := GetDefaultLogSources() + if err != nil { + return + } + + var logConfig LogConfig + for _, src := range defaultLogSources.LogConfig.Sources { + var source Source + source.Type = src.Type + for _, provider := range src.Providers { + var etwProvider EtwProvider + etwProvider.Keywords = provider.Keywords + etwProvider.Level = provider.Level + etwProvider.ProviderName = provider.ProviderName + etwProvider.ProviderGuid = GetProviderGuidFromName(provider.ProviderName) + source.Providers = append(src.Providers, etwProvider) + } + + logConfig.Sources = append(logConfig.Sources, source) + } + + defaultLogSourcesWithMap.LogConfig = logConfig + }) + return defaultLogSourcesWithMap, nil +} + +// GetProviderGuidFromName returns the provider guid for a given provider name. If the provider name is not found in the map, it returns an empty string. +func GetProviderGuidFromName(providerName string) string { + LoadEtwMap() + return nameToGUID[providerName] +} + +// GetProviderNameFromGuid returns the provider name for a given provider guid. If the provider guid is not found in the map, it returns an empty string. +func GetProviderNameFromGuid(providerGuid string) string { + LoadEtwMap() + return guidToName[providerGuid] +} + +// Updates the user provided log sources with the default log sources based on the configuration and returns the updated log sources as a base64 encoded json string. If there is an error in the process, it returns the original user provided log sources string. +func UpdateEncodedLogSources(base64EncodedJsonLogConfig string, useDefaultLogSources bool, includeGuids bool) string { + + var resultLogCfg LogSourcesInfo + if useDefaultLogSources { + if includeGuids { + resultLogCfg, _ = GetDefaultLogSourcesWithMappedGuid() + } else { + resultLogCfg, _ = GetDefaultLogSources() + } + } + + if base64EncodedJsonLogConfig != "" { + jsonBytes, err := base64.StdEncoding.DecodeString(base64EncodedJsonLogConfig) + if err == nil { + var userLogConfig LogSourcesInfo + if err := json.Unmarshal(jsonBytes, &userLogConfig); err == nil { + + resultSrcMap := make(map[string]Source) + + // Add all defaults in map + for _, source := range resultLogCfg.LogConfig.Sources { + resultSrcMap[source.Type] = source + } + + for _, source := range userLogConfig.LogConfig.Sources { + if destSrc, ok := resultSrcMap[source.Type]; ok { + // then update the source's providers + for _, srcProvider := range source.Providers { + if includeGuids { + if srcProvider.ProviderGuid == "" { + srcProvider.ProviderGuid = GetProviderGuidFromName(srcProvider.ProviderName) + } + } else { + // If Include GUIDs is false, then + // We still include GUIDs if that is the only identity present. Only when both Name and GUID is provided for a ETW provider, we + // check if the provided GUID is valid and remove it if we can fetch the same from our well known list of guids by using the name + // This is because the sidecar-GCS prefers verification of log providers by name against the policy. + if srcProvider.ProviderName != "" && srcProvider.ProviderGuid != "" { + guid, _ := NormalizeGuid(srcProvider.ProviderGuid) + if strings.EqualFold(guid, GetProviderGuidFromName(srcProvider.ProviderName)) { + srcProvider.ProviderGuid = "" + } else { + srcProvider.ProviderGuid = guid + } + } + } + destSrc.Providers = append(destSrc.Providers, srcProvider) + + } + resultSrcMap[source.Type] = destSrc + + } else { + resultSrcMap[source.Type] = source + } + + } + + var logSources []Source + for _, src := range resultSrcMap { + logSources = append(logSources, src) + } + + resultLogCfg.LogConfig.Sources = logSources + } + } + } + + if len(resultLogCfg.LogConfig.Sources) == 0 { + return "" + } + + jsonBytes, err := json.Marshal(resultLogCfg) + if err != nil { + return base64EncodedJsonLogConfig + } + + encodedCfg := base64.StdEncoding.EncodeToString(jsonBytes) + return encodedCfg +} diff --git a/internal/uvm/log_wcow.go b/internal/uvm/log_wcow.go index 5a74bf34c9..c018d372cc 100644 --- a/internal/uvm/log_wcow.go +++ b/internal/uvm/log_wcow.go @@ -9,6 +9,7 @@ import ( "github.com/Microsoft/hcsshim/internal/gcs/prot" "github.com/Microsoft/hcsshim/internal/log" "github.com/Microsoft/hcsshim/internal/protocol/guestrequest" + "github.com/Microsoft/hcsshim/internal/uvm/etw" ) func (uvm *UtilityVM) StartLogForwarding(ctx context.Context) error { @@ -62,9 +63,20 @@ func (uvm *UtilityVM) SetLogSources(ctx context.Context) error { wcaps := gcs.GetWCOWCapabilities(uvm.gc.Capabilities()) if wcaps != nil && wcaps.IsLogForwardingSupported() { // Make a call to the GCS to set the ETW providers + + var settings string + if uvm.disableDefaultLogSources { + // Determines the log sources to be set based on the configuration. If default log sources are enabled, + // we only include them along with user specified log sources. + // For confidential WCOw, we skip the adding guids to the log sources as the sidecar-GCS will verify the + // allowed log sources against policy and append the necessary GUIDs to the ones allowed. Rest are dropped. + // For non-confidential WCOW, we include the GUIDs in the log sources as the hcsshim communicates directly with the inboxGCS. + settings = etw.UpdateEncodedLogSources(uvm.logSources, !uvm.disableDefaultLogSources, !uvm.HasConfidentialPolicy()) + } + req := guestrequest.LogForwardServiceRPCRequest{ RPCType: guestrequest.RPCModifyServiceSettings, - Settings: uvm.logSources, + Settings: settings, } err := uvm.gc.ModifyServiceSettings(ctx, prot.LogForwardService, req) if err != nil { diff --git a/internal/uvm/types.go b/internal/uvm/types.go index a5fbb8014b..3eaa6a94ed 100644 --- a/internal/uvm/types.go +++ b/internal/uvm/types.go @@ -144,8 +144,9 @@ type UtilityVM struct { blockCIMMounts map[string]*UVMMountedBlockCIMs blockCIMMountLock sync.Mutex - forwardLogs bool // Indicates whether to forward logs from the UVM to the host - logSources string // ETW providers to enable for log forwarding + forwardLogs bool // Indicates whether to forward logs from the UVM to the host + disableDefaultLogSources bool // Specifies whether addition of default list of ETW providers should be disabled + logSources string // ETW providers to enable for log forwarding } func (uvm *UtilityVM) ScratchEncryptionEnabled() bool { diff --git a/pkg/annotations/annotations.go b/pkg/annotations/annotations.go index ef35d6c325..29be5f58c1 100644 --- a/pkg/annotations/annotations.go +++ b/pkg/annotations/annotations.go @@ -466,12 +466,15 @@ const ( // // Would be encoded as: // - // "io.microsoft.virtualmachine.wcow.logsources" = + // "io.microsoft.virtualmachine.forwardlogs.sources" = // "eyJsb2dDb25maWciOnsic291cmNlcyI6W3sidHlwZSI6IkVUVyIsInByb3ZpZGVycyI6W3sicHJvdmlkZXJHdWlkIjoiODBDRTUwREUtRDI2NC00NTgxLTk1MEQtQUJBREVFRTBEMzQwIiwicHJvdmlkZXJOYW1lIjoiTWljcm9zb2Z0LldpbmRvd3MuSHlwZXJWLkNvbXB1dGUiLCJsZXZlbCI6IkluZm9ybWF0aW9uIn1dfV19fQ==" - LogSources = "io.microsoft.virtualmachine.wcow.logsources" + LogSources = "io.microsoft.virtualmachine.forwardlogs.sources" - // ForwardLogs specifies whether to forward logs to the host or not. - ForwardLogs = "io.microsoft.virtualmachine.wcow.forwardlogs" + // Specifies whether to disable forwarding logs to the host or not. Defaults to false for (non-confidential) WCOW, meaning logs will be forwarded to the host if LogSources is set. And true for confidential containers, meaning logs will not be forwarded to the host by default. + DisableForwardLogs = "io.microsoft.virtualmachine.forwardlogs.disable" + + // Specifies whether to disable default providers or not. Defaults to true. + DisableDefaultLogSources = "io.microsoft.virtualmachine.forwardlogs.defaultsources.disable" ) // LCOW uVM annotations.