jdu2600-API-To-ETW/ntoskrnl.exe.csv

1	Function	ProviderGuid	ProviderSymbol	ReghandleSymbol	WriteFunction	EventDescriptorSymbol	Id	Version	Channel	Level	Opcode	Task	Keyword	ContainingFunction	CallDepth	ExportedCallDepth	CallPath
2	NtFsControlFile	c4e507b1-7224-4737-bde0-ced9284e7073	AttackSurfaceMonitor		_tlgWriteTransfer	Ast.IoctlCalled	-	-	11	5	0	-	0x200000000000	IopXxxControlFile	2	0	[NtFsControlFile->IopXxxControlFile]
3	NtFsControlFile	fae10392-f0af-4ac0-b8ff-9f4d920c3cdf	SecurityMitigationsProviderGuid	EtwSecurityMitigationsRegHandle	EtwWrite	MITIGATION_AUDIT_PROHIBIT_FSCTL_SYSTEM_CALLS	35	0	16	0	0	18	0x8000000000000000	EtwpTimLogMitigationForProcess	3	0	[NtFsControlFile->IopXxxControlFile->EtwpTimLogMitigationForProcess]
4	NtFsControlFile	fae10392-f0af-4ac0-b8ff-9f4d920c3cdf	SecurityMitigationsProviderGuid	EtwSecurityMitigationsRegHandle	EtwWrite	MITIGATION_ENFORCE_PROHIBIT_FSCTL_SYSTEM_CALLS	36	0	16	3	0	18	0x8000000000000000	EtwpTimLogMitigationForProcess	3	0	[NtFsControlFile->IopXxxControlFile->EtwpTimLogMitigationForProcess]
5	NtFsControlFile	7614521c-4d0b-4341-bfc9-873082c0f1d3	KernelGeneral		_tlgWriteTransfer	GenericMitigationForProcess	-	-	11	5	0	-	0x200000000000	EtwpTimLogMitigationForProcess	3	0	[NtFsControlFile->IopXxxControlFile->EtwpTimLogMitigationForProcess]
6	NtOpenEvent	f39412d1-c9fd-5e79-8a82-9c9cbd8ca809	Microsoft.Windows.Kernel.ObjectManager		_tlgWriteTransfer	SymlinkTraversalBlocked	-	-	11	5	0	-	0x400000000000	ObpParseSymbolicLinkEx	5	0	[NtOpenEvent->ObOpenObjectByName->ObOpenObjectByNameEx->ObpLookupObjectName->ObpParseSymbolicLinkEx]
7	NtQuerySystemInformation	a9fdf37b-d72d-4051-a3cd-d422103ce079	Microsoft.Windows.Kernel.SysEnv		_tlgWriteTransfer	FirmwareTableAccessDenied	-	-	11	5	0	-	0x200000000000	ExpGetSystemFirmwareTableInformation	3	0	[NtQuerySystemInformation->ExpQuerySystemInformation->ExpGetSystemFirmwareTableInformation]
8	NtQuerySystemInformation	Windows Kernel Trace	MEMINFO	MEMORY	EtwTraceKernelEvent	MM_STATS								MmLogQueryCombineStats	4	0	[NtQuerySystemInformation->ExpQuerySystemInformation->PfQuerySuperfetchInformation->MmLogQueryCombineStats]
9	NtOpenKey	f39412d1-c9fd-5e79-8a82-9c9cbd8ca809	Microsoft.Windows.Kernel.ObjectManager		_tlgWriteTransfer	SymlinkTraversalBlocked	-	-	11	5	0	-	0x400000000000	ObpParseSymbolicLinkEx	5	0	[NtOpenKey->CmOpenKey->ObOpenObjectByNameEx->ObpLookupObjectName->ObpParseSymbolicLinkEx]
10	NtOpenKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		EtwWriteEx									CmpThreadInfoLogStack	5	0	[NtOpenKey->CmOpenKey->CmpUnlockRegistry->CmpRecordRegistryLockRelease->CmpThreadInfoLogStack]
11	NtPowerInformation	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWrite	POP_ETW_EVENT_SESSION_DISPLAY_OFF	149	0	16	4	0	185	0x4000400000000404	PopDiagTraceSessionDisplayStateChange	2	0	[NtPowerInformation->PopDiagTraceSessionDisplayStateChange]
12	NtPowerInformation	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWrite	POP_ETW_EVENT_SESSION_DISPLAY_ON	150	0	16	4	0	186	0x4000400000000404	PopDiagTraceSessionDisplayStateChange	2	0	[NtPowerInformation->PopDiagTraceSessionDisplayStateChange]
13	NtPowerInformation	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWrite	POP_ETW_ADPM_SESSION_CLOSED	401	0	16	4	0	110	0x4000000000000404	PopDiagTraceSessionStates	2	0	[NtPowerInformation->PopDiagTraceSessionStates]
14	NtPowerInformation	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWrite	POP_ETW_ADPM_SESSION_CREATED	400	0	16	4	0	109	0x4000000000000404	PopDiagTraceSessionStates	2	0	[NtPowerInformation->PopDiagTraceSessionStates]
15	NtPowerInformation	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWrite	POP_ETW_EVENT_SUSPENDAPP	16	0	16	4	1	37	0x4000000000000808	PopDiagTraceAppPowerMessage	2	0	[NtPowerInformation->PopDiagTraceAppPowerMessage]
16	NtPowerInformation	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWrite	POP_ETW_EVENT_SUSPENDAPP_END	17	0	16	4	2	37	0x4000000000000808	PopDiagTraceAppPowerMessageEnd	2	0	[NtPowerInformation->PopDiagTraceAppPowerMessageEnd]
17	NtPowerInformation	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWrite	POP_ETW_EVENT_SUSPENDSERVICE	18	0	16	4	1	38	0x4000000000000808	PopDiagTraceServiceNotification	2	0	[NtPowerInformation->PopDiagTraceServiceNotification]
18	NtPowerInformation	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWrite	POP_ETW_EVENT_SUSPENDSERVICE_END	19	0	16	4	2	38	0x4000000000000808	PopDiagTraceServiceNotification	2	0	[NtPowerInformation->PopDiagTraceServiceNotification]
19	NtPowerInformation	63bca7a1-77ec-4ea7-95d0-98d3f0c0ebf7	Microsoft.Windows.Kernel.Power		_tlgWriteTransfer	SpoilBatteryEstimation	-	-	11	5	0	-	0x0	PopSpoilBatteryEstimate	3	0	[NtPowerInformation->PopUpdateConsoleDisplayState->PopSpoilBatteryEstimate]
20	NtPowerInformation	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWrite	POP_ETW_EVENT_CONSOLE_DISPLAY_STATE	135	0	16	4	0	275	0x4000200000000404	PopDiagTraceConsoleDisplayState	3	0	[NtPowerInformation->PopUpdateConsoleDisplayState->PopDiagTraceConsoleDisplayState]
21	NtPowerInformation	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWrite	POP_ETW_EVENT_BASIC_BRIGHTNESS_ENGINE_OFF	520	0	8	4	0	218	0x8000400000000404	PopDiagTraceEventNoPayload	3	0	[NtPowerInformation->PopPowerInformationInternal->PopDiagTraceEventNoPayload]
22	NtPowerInformation	63bca7a1-77ec-4ea7-95d0-98d3f0c0ebf7	Microsoft.Windows.Kernel.Power		_tlgWriteTransfer	PopFanReadFanNoiseInfo	-	-	11	2	0	-	0x0	PopFanReadFanNoiseInfo	3	0	[NtPowerInformation->PopPowerInformationInternal->PopFanReadFanNoiseInfo]
23	NtPowerInformation	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWrite	POP_ETW_EVENT_ADAPTIVE_SESSION_STATE	576	1	16	4	0	279	0x4000000000000004	PopAdaptiveGetSessionStateUnsafe	3	0	[NtPowerInformation->PopPowerInformationInternal->PopAdaptiveGetSessionStateUnsafe]
24	NtPowerInformation	63bca7a1-77ec-4ea7-95d0-98d3f0c0ebf7	Microsoft.Windows.Kernel.Power		_tlgWriteTransfer	PopDiagTraceExternalDisplayState	-	-	11	5	0	-	0x0	PopUpdateExternalDisplayState	3	0	[NtPowerInformation->PopPowerInformationInternal->PopUpdateExternalDisplayState]
25	NtPowerInformation	63bca7a1-77ec-4ea7-95d0-98d3f0c0ebf7	Microsoft.Windows.Kernel.Power		_tlgWriteTransfer	SleepReliabilityDetailedDiag	-	-	11	5	0	-	0x400000000000	PopDiagTraceSleepReliabilityDiagConfigUpdate	3	0	[NtPowerInformation->PopPowerInformationInternal->PopDiagTraceSleepReliabilityDiagConfigUpdate]
26	NtPowerInformation	63bca7a1-77ec-4ea7-95d0-98d3f0c0ebf7	Microsoft.Windows.Kernel.Power		_tlgWriteEx	PlRegisterPowerPlaneStatus	-	-	11	5	0	-	0x0	PopPlRegisterPowerPlane	3	0	[NtPowerInformation->PopPowerInformationInternal->PopPlRegisterPowerPlane]
27	NtPowerInformation	Windows Kernel Trace	POWER	POWER	EtwTraceKernelEvent	PO_SESSION_CALLOUT								PopDispatchStateCallout	3	0	[NtPowerInformation->PoPowerOffMonitor->PopDispatchStateCallout]
28	NtPowerInformation	Windows Kernel Trace	POWER	POWER	EtwTraceKernelEvent	PO_SESSION_CALLOUT_RET								PopDispatchStateCallout	3	0	[NtPowerInformation->PoPowerOffMonitor->PopDispatchStateCallout]
29	NtPowerInformation	5e753e4d-2b0d-4451-b8f9-0f1253ca0b44	Microsoft.Windows.Kernel.Ttm		_tlgWriteTransfer	TTM_InitCurrentSession	-	-	11	5	1	-	0x1	TtmiLogInitCurrentSessionStart	3	0	[NtPowerInformation->TtmInitCurrentSession->TtmiLogInitCurrentSessionStart]
30	NtPowerInformation	5e753e4d-2b0d-4451-b8f9-0f1253ca0b44	Microsoft.Windows.Kernel.Ttm		_tlgWriteTransfer	TTM_DeviceAssignmentPolicySet	-	-	11	5	0	-	0x1	TtmiLogSessionDeviceAssignmentPolicySet	3	0	[NtPowerInformation->TtmInitCurrentSession->TtmiLogSessionDeviceAssignmentPolicySet]
31	NtPowerInformation	5e753e4d-2b0d-4451-b8f9-0f1253ca0b44	Microsoft.Windows.Kernel.Ttm		_tlgWriteTransfer	TTM_Error	-	-	11	5	0	-	0x2	TtmiLogError	3	0	[NtPowerInformation->TtmInitCurrentSession->TtmiLogError]
32	NtPowerInformation	5e753e4d-2b0d-4451-b8f9-0f1253ca0b44	Microsoft.Windows.Kernel.Ttm		_tlgWriteTransfer	TTM_InitCurrentSession	-	-	11	5	2	-	0x1	TtmiLogInitCurrentSessionStop	3	0	[NtPowerInformation->TtmInitCurrentSession->TtmiLogInitCurrentSessionStop]
33	NtPowerInformation	63bca7a1-77ec-4ea7-95d0-98d3f0c0ebf7	Microsoft.Windows.Kernel.Power		_tlgWriteTransfer	PowerSettingChangeRegistration	-	-	11	5	0	-	0x400000000000	PopDiagTracePowerSettingRegistration	3	0	[NtPowerInformation->PopGetSettingNotificationName->PopDiagTracePowerSettingRegistration]
34	NtPowerInformation	63bca7a1-77ec-4ea7-95d0-98d3f0c0ebf7	Microsoft.Windows.Kernel.Power		_tlgWriteTransfer	MonitorOnWithLidClosed	-	-	11	5	0	-	0x400000000000	PopDiagTraceMonitorOnWithLidClosed	3	0	[NtPowerInformation->PopMonitorInvocation->PopDiagTraceMonitorOnWithLidClosed]
35	NtPowerInformation	63bca7a1-77ec-4ea7-95d0-98d3f0c0ebf7	Microsoft.Windows.Kernel.Power		_tlgWriteTransfer	InputSuppressionMonitorOnRequestUserInput	-	-	11	5	0	-	0x400000000000	PopTraceMonitorOnRequestUserInput	3	0	[NtPowerInformation->PopMonitorInvocation->PopTraceMonitorOnRequestUserInput]
36	NtPowerInformation	5e753e4d-2b0d-4451-b8f9-0f1253ca0b44	Microsoft.Windows.Kernel.Ttm		_tlgWriteTransfer	TTM_CleanupCurrentSession	-	-	11	5	2	-	0x1	TtmiLogCleanupCurrentSessionStop	3	0	[NtPowerInformation->TtmCleanupCurrentSession->TtmiLogCleanupCurrentSessionStop]
37	NtPowerInformation	5e753e4d-2b0d-4451-b8f9-0f1253ca0b44	Microsoft.Windows.Kernel.Ttm		_tlgWriteTransfer	TTM_CleanupCurrentSession	-	-	11	5	1	-	0x1	TtmiLogCleanupCurrentSessionStart	3	0	[NtPowerInformation->TtmCleanupCurrentSession->TtmiLogCleanupCurrentSessionStart]
38	NtOpenTimer	f39412d1-c9fd-5e79-8a82-9c9cbd8ca809	Microsoft.Windows.Kernel.ObjectManager		_tlgWriteTransfer	SymlinkTraversalBlocked	-	-	11	5	0	-	0x400000000000	ObpParseSymbolicLinkEx	5	0	[NtOpenTimer->ObOpenObjectByName->ObOpenObjectByNameEx->ObpLookupObjectName->ObpParseSymbolicLinkEx]
39	NtModifyDriverEntry	a9fdf37b-d72d-4051-a3cd-d422103ce079	Microsoft.Windows.Kernel.SysEnv		_tlgWriteTransfer	GetVariable	-	-	11	5	0	-	0x200000000000	IoGetEnvironmentVariableEx	3	0	[NtModifyDriverEntry->ExpSetDriverEntry->IoGetEnvironmentVariableEx]
40	NtModifyDriverEntry	a9fdf37b-d72d-4051-a3cd-d422103ce079	Microsoft.Windows.Kernel.SysEnv		_tlgWriteTransfer	SetVariable	-	-	11	5	0	-	0x200000000000	IoSetEnvironmentVariableEx	3	0	[NtModifyDriverEntry->ExpSetDriverEntry->IoSetEnvironmentVariableEx]
41	NtTerminateProcess	e02a841c-75a3-4fa7-afc8-ae09cf9b7f23	KernelAuditApiCallsGuid	EtwApiCallsProvRegHandle	EtwWrite	KERNEL_AUDIT_API_TERMINATEPROCESS	2	0	0	4	0	0	0x0	PspLogAuditTerminateRemoteProcessEvent	2	0	[NtTerminateProcess->PspLogAuditTerminateRemoteProcessEvent]
42	NtTerminateProcess	Windows Kernel Trace	PROCESS	PROCESS	EtwTraceKernelEvent	PROCESS_TERMINATE								EtwTraceProcessTerminate	3	0	[NtTerminateProcess->PspTerminateProcess->EtwTraceProcessTerminate]
43	NtDeviceIoControlFile	c4e507b1-7224-4737-bde0-ced9284e7073	AttackSurfaceMonitor		_tlgWriteTransfer	Ast.IoctlCalled	-	-	11	5	0	-	0x200000000000	IopXxxControlFile	2	0	[NtDeviceIoControlFile->IopXxxControlFile]
44	NtDeviceIoControlFile	7614521c-4d0b-4341-bfc9-873082c0f1d3	KernelGeneral		_tlgWriteTransfer	GenericMitigationForProcess	-	-	11	5	0	-	0x200000000000	EtwpTimLogMitigationForProcess	3	0	[NtDeviceIoControlFile->IopXxxControlFile->EtwpTimLogMitigationForProcess]
45	NtDeviceIoControlFile	fae10392-f0af-4ac0-b8ff-9f4d920c3cdf	SecurityMitigationsProviderGuid	EtwSecurityMitigationsRegHandle	EtwWrite	MITIGATION_AUDIT_PROHIBIT_FSCTL_SYSTEM_CALLS	35	0	16	0	0	18	0x8000000000000000	EtwpTimLogMitigationForProcess	3	0	[NtDeviceIoControlFile->IopXxxControlFile->EtwpTimLogMitigationForProcess]
46	NtDeviceIoControlFile	fae10392-f0af-4ac0-b8ff-9f4d920c3cdf	SecurityMitigationsProviderGuid	EtwSecurityMitigationsRegHandle	EtwWrite	MITIGATION_ENFORCE_PROHIBIT_FSCTL_SYSTEM_CALLS	36	0	16	3	0	18	0x8000000000000000	EtwpTimLogMitigationForProcess	3	0	[NtDeviceIoControlFile->IopXxxControlFile->EtwpTimLogMitigationForProcess]
47	NtCommitRegistryTransaction	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	CmpCommitPreparedLightWeightTransaction	-	-	11	5	1	-	0x1	CmpCommitPreparedLightWeightTransaction	3	0	[NtCommitRegistryTransaction->CmpCommitLightWeightTransaction->CmpCommitPreparedLightWeightTransaction]
48	NtCommitRegistryTransaction	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	CmpCommitPreparedLightWeightTransaction	-	-	11	5	2	-	0x1	CmpCommitPreparedLightWeightTransaction	3	0	[NtCommitRegistryTransaction->CmpCommitLightWeightTransaction->CmpCommitPreparedLightWeightTransaction]
49	NtCommitRegistryTransaction	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	CmpTransLightWeightRollback	-	-	11	5	1	-	0x1	CmpAbortLightWeightTransaction	3	0	[NtCommitRegistryTransaction->CmpCommitLightWeightTransaction->CmpAbortLightWeightTransaction]
50	NtCommitRegistryTransaction	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	CmpTransLightWeightRollback	-	-	11	5	2	-	0x1	CmpAbortLightWeightTransaction	3	0	[NtCommitRegistryTransaction->CmpCommitLightWeightTransaction->CmpAbortLightWeightTransaction]
51	NtCommitRegistryTransaction	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	CmpPrepareLightWeightTransaction	-	-	11	5	1	-	0x1	CmpPrepareLightWeightTransaction	3	0	[NtCommitRegistryTransaction->CmpCommitLightWeightTransaction->CmpPrepareLightWeightTransaction]
52	NtCommitRegistryTransaction	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	CmpPrepareLightWeightTransaction	-	-	11	5	2	-	0x1	CmpPrepareLightWeightTransaction	3	0	[NtCommitRegistryTransaction->CmpCommitLightWeightTransaction->CmpPrepareLightWeightTransaction]
53	NtSecureConnectPort	f39412d1-c9fd-5e79-8a82-9c9cbd8ca809	Microsoft.Windows.Kernel.ObjectManager		_tlgWriteTransfer	SymlinkTraversalBlocked	-	-	11	5	0	-	0x400000000000	ObpParseSymbolicLinkEx	5	0	[NtSecureConnectPort->AlpcpCreateClientPort->ObReferenceObjectByNameEx->ObpLookupObjectName->ObpParseSymbolicLinkEx]
54	NtSetDriverEntryOrder	a9fdf37b-d72d-4051-a3cd-d422103ce079	Microsoft.Windows.Kernel.SysEnv		_tlgWriteTransfer	SetVariable	-	-	11	5	0	-	0x200000000000	IoSetEnvironmentVariableEx	2	0	[NtSetDriverEntryOrder->IoSetEnvironmentVariableEx]
55	NtSetSystemInformation	a51ee86b-8ea5-454c-9a7d-37b6655a535d	Microsoft.Windows.Kernel.Dump		_tlgWriteTransfer	CrashDumpReconfigured	-	-	11	5	0	-	0x400000000000	IopDumpTraceCrashDumpReconfiguration	3	0	[NtSetSystemInformation->IoConfigureCrashDump->IopDumpTraceCrashDumpReconfiguration]
56	NtSetSystemInformation	17d2a329-4539-5f4d-3435-f510634ce3b9	DumpProvGuid	IopDumpEtwRegHandle	EtwWriteEx	DUMP_EVENT_CRASHDUMP_RECONFIGURED	11	0	16	4	21	2	0x8000000000000000	IopDumpTraceCrashDumpReconfiguration	3	0	[NtSetSystemInformation->IoConfigureCrashDump->IopDumpTraceCrashDumpReconfiguration]
57	NtSetSystemInformation	f7e83426-2b81-58f9-c5d4-f2db6d0ad473	Microsoft.Windows.Kernel.FeatureConfigurationManager		_tlgWriteTransfer	FeatureConfigurationUpdateCorruptedBuffer	-	-	11	5	0	-	0x400000000001	CmFcManagerUpdateFeatureConfigurations	3	0	[NtSetSystemInformation->CmUpdateFeatureConfiguration->CmFcManagerUpdateFeatureConfigurations]
58	NtSetSystemInformation	f7e83426-2b81-58f9-c5d4-f2db6d0ad473	Microsoft.Windows.Kernel.FeatureConfigurationManager		_tlgWriteTransfer	FeatureConfigurationOverwriteCorruptedBuffer	-	-	11	5	0	-	0x400000000001	CmFcManagerOverwriteFeatureConfigurationSection	3	0	[NtSetSystemInformation->CmUpdateFeatureConfiguration->CmFcManagerOverwriteFeatureConfigurationSection]
59	NtSetSystemInformation	f7e83426-2b81-58f9-c5d4-f2db6d0ad473	Microsoft.Windows.Kernel.FeatureConfigurationManager		_tlgWriteTransfer	UsageSubscriptionUpdateCorruptedBuffer	-	-	11	5	0	-	0x400000000001	CmFcManagerUpdateFeatureUsageSubscriptions	3	0	[NtSetSystemInformation->CmUpdateFeatureUsageSubscription->CmFcManagerUpdateFeatureUsageSubscriptions]
60	NtSetSystemInformation	???			_tlgWriteEx	HvciDriverLoadFail	-	-	11	5	0	-	0x400000000000	MiLogStrongCodeDriverLoadFailure	3	0	[NtSetSystemInformation->MmLoadSystemImageEx->MiLogStrongCodeDriverLoadFailure]
61	NtSetSystemInformation	???			_tlgWriteAgg	NonRetpolineSystemImageLoadedAggregate	-	-	11	5	0	-	0x400000000000	MiLogNonRetpolineImageLoadEvent	4	0	[NtSetSystemInformation->MmLoadSystemImageEx->MiLogRetpolineImageLoadEvents->MiLogNonRetpolineImageLoadEvent]
62	NtSetSystemInformation	0bf2fb94-7b60-4b4d-9766-e82f658df540	KernelShimEngineProvider	KseEtwHandle	EtwWrite	KseShimsApplied	3	1	17	4	0	0	0x4000000000000000	KsepEvntLogShimsApplied	4	0	[NtSetSystemInformation->MmLoadSystemImageEx->KseDriverLoadImage->KsepEvntLogShimsApplied]
63	NtSetSystemInformation	Windows Kernel Trace	PMC_PROFILE	PERFINFO	EtwTraceKernelEvent	PMC_INTERRUPT								EtwpPmcInterrupt	4	0	[NtSetSystemInformation->EtwSetPerformanceTraceInformation->EtwpSetPmcProfileSource->EtwpPmcInterrupt]
64	NtSetSystemInformation	a51ee86b-8ea5-454c-9a7d-37b6655a535d	Microsoft.Windows.Kernel.Dump		_tlgWriteTransfer	CrashDumpDisableFailed	-	-	11	5	0	-	0x400000000000	IopDumpTraceDisableCrashDumpFailure	4	0	[NtSetSystemInformation->IoConfigureCrashDump->IopDisableCrashDump->IopDumpTraceDisableCrashDumpFailure]
65	NtSetSystemInformation	17d2a329-4539-5f4d-3435-f510634ce3b9	DumpProvGuid	IopDumpEtwRegHandle	EtwWriteEx	DUMP_EVENT_CRASHDUMP_DISABLE_FAILED	4	0	16	3	14	2	0x8000000000000000	IopDumpTraceDisableCrashDumpFailure	4	0	[NtSetSystemInformation->IoConfigureCrashDump->IopDisableCrashDump->IopDumpTraceDisableCrashDumpFailure]
66	NtSetSystemInformation	a51ee86b-8ea5-454c-9a7d-37b6655a535d	Microsoft.Windows.Kernel.Dump		_tlgWriteTransfer	CrashDumpDisabled	-	-	11	5	0	-	0x400000000000	IopDumpTraceCrashDumpDisabled	4	0	[NtSetSystemInformation->IoConfigureCrashDump->IopDisableCrashDump->IopDumpTraceCrashDumpDisabled]
67	NtSetSystemInformation	17d2a329-4539-5f4d-3435-f510634ce3b9	DumpProvGuid	IopDumpEtwRegHandle	EtwWriteEx	DUMP_EVENT_CRASHDUMP_DISABLED	10	0	16	4	20	2	0x8000000000000000	IopDumpTraceCrashDumpDisabled	4	0	[NtSetSystemInformation->IoConfigureCrashDump->IopDisableCrashDump->IopDumpTraceCrashDumpDisabled]
68	NtSetSystemInformation	a51ee86b-8ea5-454c-9a7d-37b6655a535d	Microsoft.Windows.Kernel.Dump		_tlgWriteTransfer	CrashDumpLoadDriverFailed	-	-	11	5	0	-	0x400000000000	IopDumpTraceLoadCrashDumpDriverFailure	4	0	[NtSetSystemInformation->IoConfigureCrashDump->IopInitializeCrashDump->IopDumpTraceLoadCrashDumpDriverFailure]
69	NtSetSystemInformation	17d2a329-4539-5f4d-3435-f510634ce3b9	DumpProvGuid	IopDumpEtwRegHandle	EtwWriteEx	DUMP_EVENT_CRASHDUMP_LOAD_DRIVER_FAILED	6	0	16	3	16	2	0x8000000000000000	IopDumpTraceLoadCrashDumpDriverFailure	4	0	[NtSetSystemInformation->IoConfigureCrashDump->IopInitializeCrashDump->IopDumpTraceLoadCrashDumpDriverFailure]
70	NtSetSystemInformation	a51ee86b-8ea5-454c-9a7d-37b6655a535d	Microsoft.Windows.Kernel.Dump		_tlgWriteTransfer	CrashDumpInitializeFailed	-	-	11	5	0	-	0x400000000000	IopDumpTraceInitializeCrashDumpFailure	4	0	[NtSetSystemInformation->IoConfigureCrashDump->IopInitializeCrashDump->IopDumpTraceInitializeCrashDumpFailure]
71	NtSetSystemInformation	17d2a329-4539-5f4d-3435-f510634ce3b9	DumpProvGuid	IopDumpEtwRegHandle	EtwWriteEx	DUMP_EVENT_CRASHDUMP_INITIALIZE_FAILED	5	0	16	3	15	2	0x8000000000000000	IopDumpTraceInitializeCrashDumpFailure	4	0	[NtSetSystemInformation->IoConfigureCrashDump->IopInitializeCrashDump->IopDumpTraceInitializeCrashDumpFailure]
72	NtSetSystemInformation	???			_tlgWriteEx	SessionHotPatchLoadStatus	-	-	11	5	0	-	0x400000000020	MiLogHotPatchOperationStatus	4	0	[NtSetSystemInformation->MmLoadSystemImageEx->MiLoadHotPatch->MiLogHotPatchOperationStatus]
73	NtSetSystemInformation	???			_tlgWriteEx	RegisterHotPatchOperationStatus	-	-	11	5	0	-	0x400000000020	MiLogHotPatchOperationStatus	4	0	[NtSetSystemInformation->MmLoadSystemImageEx->MiLoadHotPatch->MiLogHotPatchOperationStatus]
74	NtSetSystemInformation	???			_tlgWriteEx	ImageHotPatchThreadOperationStatus	-	-	11	5	0	-	0x400000000020	MiLogHotPatchOperationStatus	4	0	[NtSetSystemInformation->MmLoadSystemImageEx->MiLoadHotPatch->MiLogHotPatchOperationStatus]
75	NtSetSystemInformation	???			_tlgWriteEx	ImageHotPatchOperationStatus	-	-	11	5	0	-	0x400000000020	MiLogHotPatchOperationStatus	4	0	[NtSetSystemInformation->MmLoadSystemImageEx->MiLoadHotPatch->MiLogHotPatchOperationStatus]
76	NtSetSystemInformation	???			_tlgWriteEx	SecureKernelHotPatchOperationStatus	-	-	11	5	0	-	0x400000000020	MiLogHotPatchOperationStatus	4	0	[NtSetSystemInformation->MmLoadSystemImageEx->MiLoadHotPatch->MiLogHotPatchOperationStatus]
77	NtSetSystemInformation	???			_tlgWriteEx	KernelHotPatchOperationStatus	-	-	11	5	0	-	0x400000000020	MiLogHotPatchOperationStatus	4	0	[NtSetSystemInformation->MmLoadSystemImageEx->MiLoadHotPatch->MiLogHotPatchOperationStatus]
78	NtSetSystemInformation	Windows Kernel Trace												MiLogPerfMemoryRangeEvent	4	0	[NtSetSystemInformation->MmLoadSystemImageEx->MiMapSystemImageWithLargePage->MiLogPerfMemoryRangeEvent]
79	NtSetSystemInformation	Windows Kernel Trace	MEMORY	MEMORY	EtwTraceKernelEvent	PAGE_RANGE_RELEASE								MiDeleteSystemPagableVm	4	0	[NtSetSystemInformation->MmLoadSystemImageEx->MiMapSystemImageWithLargePage->MiDeleteSystemPagableVm]
80	NtQuerySystemInformationEx	Windows Kernel Trace	MEMINFO	MEMORY	EtwTraceKernelEvent	MM_STATS								MmLogQueryCombineStats	4	0	[NtQuerySystemInformationEx->ExpQuerySystemInformation->PfQuerySuperfetchInformation->MmLogQueryCombineStats]
81	NtQuerySystemInformationEx	a9fdf37b-d72d-4051-a3cd-d422103ce079	Microsoft.Windows.Kernel.SysEnv		_tlgWriteTransfer	FirmwareTableAccessDenied	-	-	11	5	0	-	0x200000000000	ExpGetSystemFirmwareTableInformation	3	0	[NtQuerySystemInformationEx->ExpQuerySystemInformation->ExpGetSystemFirmwareTableInformation]
82	NtSetSystemEnvironmentValueEx	a9fdf37b-d72d-4051-a3cd-d422103ce079	Microsoft.Windows.Kernel.SysEnv		_tlgWriteTransfer	SetVariable	-	-	11	5	0	-	0x200000000000	IoSetEnvironmentVariableEx	3	0	[NtSetSystemEnvironmentValueEx->ExpSetFirmwareEnvironmentVariable->IoSetEnvironmentVariableEx]
83	NtCreateSection	Windows Kernel Trace	PERF_0x20400001	MEMORY	EtwTraceKernelEvent	PFMAPPED_SECTION_CREATE								MiLogSectionCreate	5	0	[NtCreateSection->MiCreateSectionCommon->MiCreateSection->MiCreatePagingFileMap->MiLogSectionCreate]
84	NtCreateSection	Windows Kernel Trace	PERF_0x20400001	MEMORY	EtwTraceKernelEvent	PFMAPPED_SECTION_DELETE								MiLogSectionCreate	5	0	[NtCreateSection->MiCreateSectionCommon->MiCreateSection->MiCreatePagingFileMap->MiLogSectionCreate]
85	NtUnloadKey2	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		EtwWriteEx									CmpThreadInfoLogStack	4	0	[NtUnloadKey2->CmUnloadKey->CmpIsRegistryLockAcquired->CmpThreadInfoLogStack]
86	NtUnloadKey2	f39412d1-c9fd-5e79-8a82-9c9cbd8ca809	Microsoft.Windows.Kernel.ObjectManager		_tlgWriteTransfer	SymlinkTraversalBlocked	-	-	11	5	0	-	0x400000000000	ObpParseSymbolicLinkEx	5	0	[NtUnloadKey2->CmUnloadKey->ObReferenceObjectByNameEx->ObpLookupObjectName->ObpParseSymbolicLinkEx]
87	NtCreateJobObject	Windows Kernel Trace												EtwTraceJob	2	0	[NtCreateJobObject->EtwTraceJob]
88	NtCreateJobObject	22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716	PsProvGuid	EtwpPsProvRegHandle	EtwWrite	JobTerminate	14	0	16	4	2	14	0x8000000000000400	EtwpPsProvTraceJob	3	0	[NtCreateJobObject->EtwTraceJob->EtwpPsProvTraceJob]
89	NtCreateJobObject	22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716	PsProvGuid	EtwpPsProvRegHandle	EtwWrite	JobStart	13	0	16	4	1	13	0x8000000000000400	EtwpPsProvTraceJob	3	0	[NtCreateJobObject->EtwTraceJob->EtwpPsProvTraceJob]
90	NtDeleteKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		EtwWriteEx									CmpThreadInfoLogStack	3	0	[NtDeleteKey->CmpIsRegistryLockAcquired->CmpThreadInfoLogStack]
91	NtDeleteKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	AddLogContainer	-	-	11	5	0	-	0x1	CmpTransWriteLog	4	0	[NtDeleteKey->CmDeleteKey->CmAddLogForAction->CmpTransWriteLog]
92	NtTerminateJobObject	Windows Kernel Trace	PERF_0x80000	JOB	EtwTraceKernelEvent	JOB_TERMINATE								EtwTraceJob	2	0	[NtTerminateJobObject->EtwTraceJob]
93	NtTerminateJobObject	22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716	PsProvGuid	EtwpPsProvRegHandle	EtwWrite	JobTerminate	14	0	16	4	2	14	0x8000000000000400	EtwpPsProvTraceJob	3	0	[NtTerminateJobObject->EtwTraceJob->EtwpPsProvTraceJob]
94	NtTerminateJobObject	22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716	PsProvGuid	EtwpPsProvRegHandle	EtwWrite	JobStart	13	0	16	4	1	13	0x8000000000000400	EtwpPsProvTraceJob	3	0	[NtTerminateJobObject->EtwTraceJob->EtwpPsProvTraceJob]
95	NtCreateKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		EtwWriteEx									CmpThreadInfoLogStack	5	0	[NtCreateKey->CmCreateKey->CmpUnlockRegistry->CmpRecordRegistryLockRelease->CmpThreadInfoLogStack]
96	NtUnloadKeyEx	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		EtwWriteEx									CmpThreadInfoLogStack	4	0	[NtUnloadKeyEx->CmUnloadKey->CmpIsRegistryLockAcquired->CmpThreadInfoLogStack]
97	NtUnloadKeyEx	f39412d1-c9fd-5e79-8a82-9c9cbd8ca809	Microsoft.Windows.Kernel.ObjectManager		_tlgWriteTransfer	SymlinkTraversalBlocked	-	-	11	5	0	-	0x400000000000	ObpParseSymbolicLinkEx	5	0	[NtUnloadKeyEx->CmUnloadKey->ObReferenceObjectByNameEx->ObpLookupObjectName->ObpParseSymbolicLinkEx]
98	NtSetInformationThread	Windows Kernel Trace	THREAD	THREAD	EtwTraceKernelEvent	PERFINFO_LOG_TYPE_0x548								EtwTraceThreadSetName	2	0	[NtSetInformationThread->EtwTraceThreadSetName]
99	NtSetInformationThread	22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716	PsProvGuid	EtwpPsProvRegHandle	EtwWriteEx	ThreadWorkOnBehalfUpdate	21	0	16	4	0	18	0x8000000000002000	EtwTraceThreadWorkOnBehalfUpdate	3	0	[NtSetInformationThread->PspRevertContainerImpersonation->EtwTraceThreadWorkOnBehalfUpdate]
100	NtSetInformationThread	Windows Kernel Trace	PRIORITY	THREAD	EtwTraceKernelEvent	THREAD_SET_IO_PRIORITY								EtwTracePriority	3	0	[NtSetInformationThread->PsSetIoPriorityThread->EtwTracePriority]
101	NtTraceControl	b675ec37-bdb6-4648-bc92-f3fdc74d3ca2	EventTracingProvGuid	EtwpEventTracingProvRegHandle	EtwWrite	ETW_EVENT_PROVIDER_REGISTER	8	0	17	5	16	3	0x4000000000000220	EtwpEventWriteTemplateSessAndProv	3	0	[NtTraceControl->EtwpRegisterUMProvider->EtwpEventWriteTemplateSessAndProv]
102	NtTraceControl	b675ec37-bdb6-4648-bc92-f3fdc74d3ca2	EventTracingProvGuid	EtwpEventTracingProvRegHandle	EtwWrite	ETW_EVENT_SET_TRAITS_FAILED	28	0	16	2	25	3	0x8000000000000a20	EtwpEventWriteRegistrationStatus	3	0	[NtTraceControl->EtwpSetProviderTraitsUm->EtwpEventWriteRegistrationStatus]
103	NtTraceControl	b675ec37-bdb6-4648-bc92-f3fdc74d3ca2	EventTracingProvGuid	EtwpEventTracingProvRegHandle	EtwWrite	ETW_EVENT_DEBUG_LOOKUP_FAILED	32	0	16	3	0	3	0x8000000000000030	EtwpEventWriteDebugLookupFailed	4	0	[NtTraceControl->EtwpTrackProviderBinary->EtwpProviderArrivalCallback->EtwpEventWriteDebugLookupFailed]
104	NtTraceControl	b675ec37-bdb6-4648-bc92-f3fdc74d3ca2	EventTracingProvGuid	EtwpEventTracingProvRegHandle	EtwWrite	ETW_EVENT_PROVIDER_ENABLED	14	1	17	5	18	3	0x4000000000000420	EtwpEventWriteProviderEnabled	3	0	[NtTraceControl->EtwpEnableGuid->EtwpEventWriteProviderEnabled]
105	NtTraceControl	b675ec37-bdb6-4648-bc92-f3fdc74d3ca2	EventTracingProvGuid	EtwpEventTracingProvRegHandle	EtwWrite	ETW_EVENT_PROVIDER_DISABLED	15	0	17	5	19	3	0x4000000000000420	EtwpEventWriteProviderEnabled	3	0	[NtTraceControl->EtwpEnableGuid->EtwpEventWriteProviderEnabled]
106	NtTraceControl	7614521c-4d0b-4341-bfc9-873082c0f1d3	KernelGeneral		_tlgWriteTransfer	KernelCallbackTiming	-	-	11	5	0	-	0x200000000800	EtwpSendDataBlock	3	0	[NtTraceControl->EtwpEnableGuid->EtwpSendDataBlock]
107	NtTraceControl	b675ec37-bdb6-4648-bc92-f3fdc74d3ca2	EventTracingProvGuid	EtwpEventTracingProvRegHandle	EtwWrite	ETW_EVENT_CAPTURE_STATE	42	0	17	5	27	3	0x4000000000000120	EtwpEventWriteCaptureState	3	0	[NtTraceControl->EtwpEnableGuid->EtwpEventWriteCaptureState]
108	NtTraceControl	b675ec37-bdb6-4648-bc92-f3fdc74d3ca2	EventTracingProvGuid	EtwpEventTracingProvRegHandle	EtwWrite	ETW_EVENT_GROUP_JOIN	29	0	17	5	26	3	0x4000000000000a20	EtwpAddRegEntryToGroup	4	0	[NtTraceControl->EtwpSetProviderTraitsUm->EtwpSetProviderTraitsCommon->EtwpAddRegEntryToGroup]
109	NtTraceControl	b675ec37-bdb6-4648-bc92-f3fdc74d3ca2	EventTracingProvGuid	EtwpEventTracingProvRegHandle	EtwWrite	ETW_EVENT_PROVIDER_ACCESS_DENIED	30	0	17	5	0	3	0x4000000000000220	EtwpEventWriteProviderAccessCheckStatus	4	0	[NtTraceControl->EtwpEnableGuid->EtwpIsRegEntryAllowed->EtwpEventWriteProviderAccessCheckStatus]
110	NtFlushKey	70eb4f03-c1de-4f73-a051-33d13d5413bd	RegistryProvGuid	EtwpRegTraceHandle	EtwWrite									CmpFlushHive	2	0	[NtFlushKey->CmpFlushHive]
111	NtFlushKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	HiveFlush	-	-	11	4	1	-	0x0	CmpFlushHive	2	0	[NtFlushKey->CmpFlushHive]
112	NtFlushKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	HiveFlushControlDataGenerated	-	-	11	4	0	-	0x0	CmpFlushHive	2	0	[NtFlushKey->CmpFlushHive]
113	NtFlushKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	HiveFlush	-	-	11	4	2	-	0x0	CmpFlushHive	2	0	[NtFlushKey->CmpFlushHive]
114	NtFlushKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		EtwWriteEx									CmpThreadInfoLogStack	3	0	[NtFlushKey->CmpIsRegistryLockAcquired->CmpThreadInfoLogStack]
115	NtFlushKey	70eb4f03-c1de-4f73-a051-33d13d5413bd	RegistryProvGuid	EtwpRegTraceHandle	EtwWrite									CmpWaitOnHiveWriteQueue	3	0	[NtFlushKey->CmpFlushHive->CmpWaitOnHiveWriteQueue]
116	NtFlushKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	HiveFlushPhase	-	-	11	4	1	-	0x0	CmpLogFlushPhaseStart	3	0	[NtFlushKey->CmpFlushHive->CmpLogFlushPhaseStart]
117	NtFlushKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	LogFileSwap	-	-	11	5	0	-	0x0	HvSwapLogFiles	3	0	[NtFlushKey->CmpFlushHive->HvSwapLogFiles]
118	NtFlushKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	HiveFlushPhase	-	-	11	4	2	-	0x0	CmpLogFlushPhaseEnd	3	0	[NtFlushKey->CmpFlushHive->CmpLogFlushPhaseEnd]
119	NtReplaceKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	NtReplaceKeyFailed	-	-	11	5	0	-	0x400000000000	NtReplaceKey	1	0	[NtReplaceKey]
120	NtReplaceKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	NtReplaceKeySucceeded	-	-	11	5	0	-	0x400000000000	NtReplaceKey	1	0	[NtReplaceKey]
121	NtAllocateVirtualMemoryEx	f4e1897c-bb5d-5668-f1d8-040f4d8dd344	ThreatIntProviderGuid	EtwThreatIntProvRegHandle	EtwWrite									EtwTiLogAllocExecVm	5	0	[NtAllocateVirtualMemoryEx->MmAllocateVirtualMemory->MiAllocateVirtualMemoryCommon->MiAllocateVirtualMemory->EtwTiLogAllocExecVm]
122	NtGetEnvironmentVariableEx	a9fdf37b-d72d-4051-a3cd-d422103ce079	Microsoft.Windows.Kernel.SysEnv		_tlgWriteTransfer	GetVariable	-	-	11	5	0	-	0x200000000000	IoGetEnvironmentVariableEx	2	0	[NtGetEnvironmentVariableEx->IoGetEnvironmentVariableEx]
123	NtSetTimerResolution	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWrite	POP_ETW_EVENT_TIME_RESOLUTION_REQUEST_RUNDOWN	97	1	16	4	0	94	0x4000000000004004	PoTraceSystemTimerResolution	2	0	[NtSetTimerResolution->PoTraceSystemTimerResolution]
124	NtSetTimerResolution	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWrite	POP_ETW_EVENT_STRS	63	2	16	4	0	69	0x4000000000004004	PoTraceSystemTimerResolution	2	0	[NtSetTimerResolution->PoTraceSystemTimerResolution]
125	NtSetTimerResolution	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWrite	POP_ETW_EVENT_TIME_RESOLUTION_STACK_RUNDOWN	110	0	16	4	0	104	0x4000000000000004	PoTraceSystemTimerResolution	2	0	[NtSetTimerResolution->PoTraceSystemTimerResolution]
126	NtSetTimerResolution	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWriteEx	POP_ETW_EVENT_TIME_RESOLUTION_UPDATE	95	0	16	4	0	92	0x4000000000004004	PoTraceSystemTimerResolutionUpdate	3	0	[NtSetTimerResolution->ExpUpdateTimerResolution->PoTraceSystemTimerResolutionUpdate]
127	NtModifyBootEntry	a9fdf37b-d72d-4051-a3cd-d422103ce079	Microsoft.Windows.Kernel.SysEnv		_tlgWriteTransfer	SetVariable	-	-	11	5	0	-	0x200000000000	IoSetEnvironmentVariableEx	3	0	[NtModifyBootEntry->ExpSetBootEntry->IoSetEnvironmentVariableEx]
128	NtModifyBootEntry	a9fdf37b-d72d-4051-a3cd-d422103ce079	Microsoft.Windows.Kernel.SysEnv		_tlgWriteTransfer	GetVariable	-	-	11	5	0	-	0x200000000000	IoGetEnvironmentVariableEx	3	0	[NtModifyBootEntry->ExpSetBootEntry->IoGetEnvironmentVariableEx]
129	NtCreateSectionEx	Windows Kernel Trace	PERF_0x20400001	MEMORY	EtwTraceKernelEvent	PFMAPPED_SECTION_CREATE								MiLogSectionCreate	5	0	[NtCreateSectionEx->MiCreateSectionCommon->MiCreateSection->MiCreatePagingFileMap->MiLogSectionCreate]
130	NtCreateSectionEx	Windows Kernel Trace	PERF_0x20400001	MEMORY	EtwTraceKernelEvent	PFMAPPED_SECTION_DELETE								MiLogSectionCreate	5	0	[NtCreateSectionEx->MiCreateSectionCommon->MiCreateSection->MiCreatePagingFileMap->MiLogSectionCreate]
131	NtAssignProcessToJobObject	Windows Kernel Trace	PERF_0x80000	JOB	EtwTraceKernelEvent	JOB_ASSIGN_PROCESS								EtwTraceJobAssignProcess	2	0	[NtAssignProcessToJobObject->EtwTraceJobAssignProcess]
132	NtEnumerateBootEntries	a9fdf37b-d72d-4051-a3cd-d422103ce079	Microsoft.Windows.Kernel.SysEnv		_tlgWriteTransfer	EnumerateVariables	-	-	11	5	0	-	0x200000000000	IoEnumerateEnvironmentVariablesEx	2	0	[NtEnumerateBootEntries->IoEnumerateEnvironmentVariablesEx]
133	NtDeleteValueKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		EtwWriteEx									CmpThreadInfoLogStack	3	0	[NtDeleteValueKey->CmpIsRegistryLockAcquired->CmpThreadInfoLogStack]
134	NtDeleteValueKey	Windows Kernel Trace	REG_HIVE	REGISTRY	EtwTraceKernelEvent	REG_HIVE_DIRTY								HvpMarkDirty	4	0	[NtDeleteValueKey->CmDeleteValueKey->HvpMarkCellDirty->HvpMarkDirty]
135	NtDeleteValueKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	AddLogContainer	-	-	11	5	0	-	0x1	CmpTransWriteLog	4	0	[NtDeleteValueKey->CmDeleteValueKey->CmAddLogForAction->CmpTransWriteLog]
136	NtMapViewOfSection	f4e1897c-bb5d-5668-f1d8-040f4d8dd344	ThreatIntProviderGuid	EtwThreatIntProvRegHandle	EtwWrite		29888	1	64	1	0	0	0x140017490	EtwTiLogMapExecView	2	0	[NtMapViewOfSection->EtwTiLogMapExecView]
137	NtMapViewOfSection	f4e1897c-bb5d-5668-f1d8-040f4d8dd344	ThreatIntProviderGuid	EtwThreatIntProvRegHandle	EtwWrite		29840	1	64	1	0	0	0x1400174b0	EtwTiLogMapExecView	2	0	[NtMapViewOfSection->EtwTiLogMapExecView]
138	NtLoadDriver	???		PnpEtwHandle	EtwWrite	KMPnPEvt_DriverLoad_Start	212	0	20	4	1	212	0x400000000002020	PnpDiagnosticTraceObject	5	0	[NtLoadDriver->IopLoadDriverImage->IopLoadUnloadDriver->IopLoadDriver->PnpDiagnosticTraceObject]
139	NtLoadDriver	???		PnpEtwHandle	EtwWrite	KMPnPEvt_DriverInit_Start	226	0	20	4	1	226	0x400000000020020	PnpDiagnosticTraceObject	5	0	[NtLoadDriver->IopLoadDriverImage->IopLoadUnloadDriver->IopLoadDriver->PnpDiagnosticTraceObject]
140	NtLoadDriver	f4e1897c-bb5d-5668-f1d8-040f4d8dd344	ThreatIntProviderGuid	EtwThreatIntProvRegHandle	EtwWrite	THREATINT_DRIVER_OBJECT_LOAD	29	1	16	4	0	10	0x8000000040000000	EtwTiLogDriverObjectLoad	5	0	[NtLoadDriver->IopLoadDriverImage->IopLoadUnloadDriver->IopLoadDriver->EtwTiLogDriverObjectLoad]
141	NtLoadDriver	???		PnpEtwHandle	EtwWrite	KMPnPEvt_DriverInit_Stop	227	0	20	4	2	226	0x400000000020020	PnpDiagnosticTraceObjectWithStatus	5	0	[NtLoadDriver->IopLoadDriverImage->IopLoadUnloadDriver->IopLoadDriver->PnpDiagnosticTraceObjectWithStatus]
142	NtSetInformationKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		EtwWriteEx									CmpThreadInfoLogStack	3	0	[NtSetInformationKey->CmpIsRegistryLockAcquired->CmpThreadInfoLogStack]
143	NtSetInformationKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	AddLogContainer	-	-	11	5	0	-	0x1	CmpTransWriteLog	4	0	[NtSetInformationKey->CmSetLastWriteTimeKey->CmAddLogForAction->CmpTransWriteLog]
144	NtSetInformationKey	Windows Kernel Trace	REG_HIVE	REGISTRY	EtwTraceKernelEvent	REG_HIVE_DIRTY								HvpMarkDirty	4	0	[NtSetInformationKey->CmSetLastWriteTimeKey->HvpMarkCellDirty->HvpMarkDirty]
145	NtTraceEvent	b675ec37-bdb6-4648-bc92-f3fdc74d3ca2	EventTracingProvGuid	EtwpEventTracingProvRegHandle	EtwWriteEx	ETW_EVENT_LOST_WPP_EVENT	33	0	0	2	0	11	0x40	EtwpTraceLostWppEvent	3	0	[NtTraceEvent->EtwpTraceMessageVa->EtwpTraceLostWppEvent]
146	NtTraceEvent	a68ca8b7-004f-d7b6-a698-07e2de0f1f5d	KernelProvGuid	EtwKernelProvRegHandle	EtwWrite	AccessCheckLog	14	0	0	2	0	0	0x20	SeLogAccessFailure	4	0	[NtTraceEvent->EtwTraceRaw->EtwpReserveTraceBuffer->SeLogAccessFailure]
147	NtEnumerateValueKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteAgg									CmpBounceContextStart	2	0	[NtEnumerateValueKey->CmpBounceContextStart]
148	NtEnumerateValueKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		EtwWriteEx									CmpThreadInfoLogStack	3	0	[NtEnumerateValueKey->CmpIsRegistryLockAcquired->CmpThreadInfoLogStack]
149	NtDeleteDriverEntry	a9fdf37b-d72d-4051-a3cd-d422103ce079	Microsoft.Windows.Kernel.SysEnv		_tlgWriteTransfer	SetVariable	-	-	11	5	0	-	0x200000000000	IoSetEnvironmentVariableEx	2	0	[NtDeleteDriverEntry->IoSetEnvironmentVariableEx]
150	NtDeleteDriverEntry	a9fdf37b-d72d-4051-a3cd-d422103ce079	Microsoft.Windows.Kernel.SysEnv		_tlgWriteTransfer	GetVariable	-	-	11	5	0	-	0x200000000000	IoGetEnvironmentVariableEx	2	0	[NtDeleteDriverEntry->IoGetEnvironmentVariableEx]
151	NtShutdownSystem	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWrite	POP_ETW_EVENT_POSTSLEEP_NOTIFICATION	107	1	8	4	0	102	0x8000000000000444	PopDiagTracePostSleepNotification	4	0	[NtShutdownSystem->NtSetSystemPowerState->PopTransitionSystemPowerStateEx->PopDiagTracePostSleepNotification]
152	NtShutdownSystem	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWrite	POP_ETW_EVENT_MTRR_CHANGED	137	0	8	2	0	276	0x8000000000000404	PopDiagTraceMtrrError	4	0	[NtShutdownSystem->NtSetSystemPowerState->PopTransitionSystemPowerStateEx->PopDiagTraceMtrrError]
153	NtShutdownSystem	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWrite	POP_ETW_EVENT_HIBERNATE_STATUS	34	0	16	4	0	45	0x4000000000002c0c	PopDiagTraceHibernateErrorStatus	4	0	[NtShutdownSystem->NtSetSystemPowerState->PopTransitionSystemPowerStateEx->PopDiagTraceHibernateErrorStatus]
154	NtShutdownSystem	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWrite	POP_ETW_EVENT_PRESLEEP_NOTIFICATION3	42	3	8	4	0	64	0x8000000000000404	PopDiagTracePreSleepNotification	4	0	[NtShutdownSystem->NtSetSystemPowerState->PopTransitionSystemPowerStateEx->PopDiagTracePreSleepNotification]
155	NtShutdownSystem	Windows Kernel Trace	POWER	POWER	EtwTraceKernelEvent	SET_POWER_ACTION								PopExecutePowerAction	4	0	[NtShutdownSystem->NtSetSystemPowerState->PopTransitionSystemPowerStateEx->PopExecutePowerAction]
156	NtShutdownSystem	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWrite	POP_ETW_EVENT_KERNEL_QUERY_ALLOWED	61	0	16	4	0	67	0x4000000000002404	PopDiagTraceKernelQueriesAllowed	4	0	[NtShutdownSystem->NtSetSystemPowerState->PopTransitionSystemPowerStateEx->PopDiagTraceKernelQueriesAllowed]
157	NtShutdownSystem	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWrite	POP_ETW_EVENT_STATE_TRANSITION_FAILURE	579	0	16	4	0	282	0x4000000000000004	PopDiagTraceStateTransitionFailurePoint	4	0	[NtShutdownSystem->NtSetSystemPowerState->PopTransitionSystemPowerStateEx->PopDiagTraceStateTransitionFailurePoint]
158	NtShutdownSystem	63bca7a1-77ec-4ea7-95d0-98d3f0c0ebf7	Microsoft.Windows.Kernel.Power		_tlgWriteTransfer	StateTransitionFailure	-	-	11	5	0	-	0x800000000000	PopDiagTraceStateTransitionFailurePoint	4	0	[NtShutdownSystem->NtSetSystemPowerState->PopTransitionSystemPowerStateEx->PopDiagTraceStateTransitionFailurePoint]
159	NtShutdownSystem	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWriteEx	POP_ETW_EVENT_S3FWSTATS_RESUME	131	0	8	4	0	33	0x8000000000000404	PopDiagTraceFirmwareS3Stats	4	0	[NtShutdownSystem->NtSetSystemPowerState->PopTransitionSystemPowerStateEx->PopDiagTraceFirmwareS3Stats]
160	NtShutdownSystem	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWriteEx	POP_ETW_EVENT_S3FWSTATS_SUSPEND	130	0	8	4	0	33	0x8000000000000404	PopDiagTraceFirmwareS3Stats	4	0	[NtShutdownSystem->NtSetSystemPowerState->PopTransitionSystemPowerStateEx->PopDiagTraceFirmwareS3Stats]
161	NtShutdownSystem	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWriteEndScenario	POP_ETW_EVENT_GRACEFULSHUTDOWN_STOP	48	0	16	4	2	48	0x4000000000000009	PopGracefulShutdown	4	0	[NtShutdownSystem->NtSetSystemPowerState->PopTransitionSystemPowerStateEx->PopGracefulShutdown]
162	NtShutdownSystem	???		BapdWriteEtwEvents	EtwWriteEx									BapdWriteEtwEvents	5	0	[NtShutdownSystem->NtSetSystemPowerState->PopTransitionSystemPowerStateEx->PopBootLoaderTraceProcess->BapdWriteEtwEvents]
163	NtShutdownSystem	???			EtwWrite	BOOT_FW_BOOT_PERF_DATA	30	0	8	4	0	21	0x8000000000000000	BapdRecordFirmwareBootStats	5	0	[NtShutdownSystem->NtSetSystemPowerState->PopTransitionSystemPowerStateEx->PopBootLoaderTraceProcess->BapdRecordFirmwareBootStats]
164	NtShutdownSystem	23b76a75-ce4f-56ef-f903-c3a2d6ae3f6b	Microsoft.Windows.Kernel.BootEnvironment		_tlgWriteTransfer	FirmwareBootData	-	-	11	4	0	-	0x400000000000	BapdRecordFirmwareBootStats	5	0	[NtShutdownSystem->NtSetSystemPowerState->PopTransitionSystemPowerStateEx->PopBootLoaderTraceProcess->BapdRecordFirmwareBootStats]
165	NtShutdownSystem	63bca7a1-77ec-4ea7-95d0-98d3f0c0ebf7	Microsoft.Windows.Kernel.Power		_tlgWriteTransfer	ThermalZonePassiveHistogram	-	-	11	5	0	-	0x400000000000	PopTraceThermalZonePassiveHistogram	5	0	[NtShutdownSystem->NtSetSystemPowerState->PopTransitionSystemPowerStateEx->PopThermalSxEntry->PopTraceThermalZonePassiveHistogram]
166	NtShutdownSystem	63bca7a1-77ec-4ea7-95d0-98d3f0c0ebf7	Microsoft.Windows.Kernel.Power		_tlgWriteTransfer	ThermalZoneActiveActivity	-	-	11	5	0	-	0x400000000000	PopTraceThermalZoneActiveActivity	5	0	[NtShutdownSystem->NtSetSystemPowerState->PopTransitionSystemPowerStateEx->PopThermalSxEntry->PopTraceThermalZoneActiveActivity]
167	NtShutdownSystem	Windows Kernel Trace	POWER	POWER	EtwTraceKernelEvent	SET_DEVICES_STATE								PoBroadcastSystemState	5	0	[NtShutdownSystem->NtSetSystemPowerState->PopTransitionSystemPowerStateEx->PopSetDevicesSystemState->PoBroadcastSystemState]
168	NtShutdownSystem	Windows Kernel Trace	POWER	POWER	EtwTraceKernelEvent	SET_DEVICES_STATE_RET								PoBroadcastSystemState	5	0	[NtShutdownSystem->NtSetSystemPowerState->PopTransitionSystemPowerStateEx->PopSetDevicesSystemState->PoBroadcastSystemState]
169	NtShutdownSystem	63bca7a1-77ec-4ea7-95d0-98d3f0c0ebf7	Microsoft.Windows.Kernel.Power		_tlgWriteTransfer	PopFanUpdateStatistics_UpdateBucket	-	-	11	5	0	-	0x0	PopFanUpdateStatistics	5	0	[NtShutdownSystem->NtSetSystemPowerState->PopTransitionSystemPowerStateEx->PopFanSxEntry->PopFanUpdateStatistics]
170	NtShutdownSystem	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWrite	POP_ETW_EVENT_EXECUTE_POWER_ACTION	555	1	16	4	0	257	0x4000000000000004	PopDiagTraceExecutePowerAction	5	0	[NtShutdownSystem->NtSetSystemPowerState->PopTransitionSystemPowerStateEx->PopExecutePowerAction->PopDiagTraceExecutePowerAction]
171	NtShutdownSystem	63bca7a1-77ec-4ea7-95d0-98d3f0c0ebf7	Microsoft.Windows.Kernel.Power		_tlgWriteTransfer	ExecutePowerAction	-	-	11	5	0	-	0x800000000000	PopDiagTraceExecutePowerAction	5	0	[NtShutdownSystem->NtSetSystemPowerState->PopTransitionSystemPowerStateEx->PopExecutePowerAction->PopDiagTraceExecutePowerAction]
172	NtShutdownSystem	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWriteEx	POP_ETW_EVENT_SHUTDOWN_ACTION	109	0	8	4	0	103	0x8000400000000404	PopDiagTraceShutdownAction	5	0	[NtShutdownSystem->NtSetSystemPowerState->PopTransitionSystemPowerStateEx->PopExecutePowerAction->PopDiagTraceShutdownAction]
173	NtShutdownSystem	63bca7a1-77ec-4ea7-95d0-98d3f0c0ebf7	Microsoft.Windows.Kernel.Power		_tlgWriteTransfer	DozeToS4Deferral	-	-	11	5	0	-	0x400000000000	PopDiagTraceDozeDeferralDecision	5	0	[NtShutdownSystem->NtSetSystemPowerState->PopTransitionSystemPowerStateEx->PopDeferDoze->PopDiagTraceDozeDeferralDecision]
174	NtShutdownSystem	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWrite	POP_ETW_EVENT_PRESLEEP_CALLBACKS_START	68	0	16	4	33	56	0x4000000000000808	PopDiagTraceEventNoPayload	5	0	[NtShutdownSystem->NtSetSystemPowerState->PopTransitionSystemPowerStateEx->PopNotifyCallbacksPreSleep->PopDiagTraceEventNoPayload]
175	NtShutdownSystem	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWrite	POP_ETW_EVENT_PRESLEEP_CALLBACKS_STOP	69	0	16	4	34	56	0x4000000000000808	PopDiagTraceEventNoPayload	5	0	[NtShutdownSystem->NtSetSystemPowerState->PopTransitionSystemPowerStateEx->PopNotifyCallbacksPreSleep->PopDiagTraceEventNoPayload]
176	NtShutdownSystem	63bca7a1-77ec-4ea7-95d0-98d3f0c0ebf7	Microsoft.Windows.Kernel.Power		_tlgWriteTransfer	SpoilBatteryEstimation	-	-	11	5	0	-	0x0	PopSpoilBatteryEstimate	5	0	[NtShutdownSystem->NtSetSystemPowerState->PopTransitionSystemPowerStateEx->PopSpoilEstimatesOnPowerStateTransitionWorker->PopSpoilBatteryEstimate]
177	NtShutdownSystem	63bca7a1-77ec-4ea7-95d0-98d3f0c0ebf7	Microsoft.Windows.Kernel.Power		_tlgWriteTransfer	OSStateChange	-	-	11	5	0	-	0x800000000000	PopTransitionTelemetryOsState	5	0	[NtShutdownSystem->NtSetSystemPowerState->PopTransitionSystemPowerStateEx->PopNotifyTelemetryOsState->PopTransitionTelemetryOsState]
178	NtProtectVirtualMemory	f4e1897c-bb5d-5668-f1d8-040f4d8dd344	ThreatIntProviderGuid	EtwThreatIntProvRegHandle	EtwWrite									EtwTiLogProtectExecVm	2	0	[NtProtectVirtualMemory->EtwTiLogProtectExecVm]
179	NtSaveKeyEx	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	UnsupportedOperation	-	-	11	5	0	-	0x0	CmpLogUnsupportedOperation	3	0	[NtSaveKeyEx->CmSaveKey->CmpLogUnsupportedOperation]
180	NtSaveKeyEx	70eb4f03-c1de-4f73-a051-33d13d5413bd	RegistryProvGuid	EtwpRegTraceHandle	EtwWrite									CmpTraceHiveSaveStop	3	0	[NtSaveKeyEx->CmSaveKey->CmpTraceHiveSaveStop]
181	NtSaveKeyEx	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		EtwWriteEx									CmpThreadInfoLogStack	3	0	[NtSaveKeyEx->CmpIsRegistryLockAcquired->CmpThreadInfoLogStack]
182	NtSaveKeyEx	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	UnsupportedOperation(Aggregate)	-	-	11	5	0	-	0x400000000000	CmpSendUnsupportedOperationTelemetryEvent	4	0	[NtSaveKeyEx->CmSaveKey->CmpLogUnsupportedOperation->CmpSendUnsupportedOperationTelemetryEvent]
183	NtSaveKeyEx	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	HiveSelfHealed	-	-	11	5	0	-	0x400000000000	CmpCreateHive	4	0	[NtSaveKeyEx->CmSaveKey->CmpCreateTemporaryHive->CmpCreateHive]
184	NtSetTimer	Windows Kernel Trace	TIMER	PERFINFO	EtwTraceKernelEvent	KTIMER2_SET								KiTraceSetTimer2	5	0	[NtSetTimer->ExpSetTimer->ExpSetTimerObject2->KeSetTimer2->KiTraceSetTimer2]
185	NtSetSystemTime	a68ca8b7-004f-d7b6-a698-07e2de0f1f5d	KernelProvGuid	EtwKernelProvRegHandle	EtwWrite	KernelSystemTimeChange	1	4	8	4	0	5	0x8000000000000010	EtwTraceSystemTimeChange	3	0	[NtSetSystemTime->PoNotifySystemTimeSet->EtwTraceSystemTimeChange]
186	NtSetSystemTime	7614521c-4d0b-4341-bfc9-873082c0f1d3	KernelGeneral		_tlgWriteTransfer	SystemTimeChange	-	-	11	5	0	-	0x400000000000	EtwTraceSystemTimeChange	3	0	[NtSetSystemTime->PoNotifySystemTimeSet->EtwTraceSystemTimeChange]
187	NtSetSystemTime	8944a53c-a561-4e53-a0c6-d565414745fc	KernelExecutive		_tlgWriteTransfer	RefreshTimeZoneInfoQueryFail	-	-	11	5	0	-	0x0	ExpLogRefreshTimeZoneInformationQueryFail	3	0	[NtSetSystemTime->ExpRefreshTimeZoneInformation->ExpLogRefreshTimeZoneInformationQueryFail]
188	NtSetSystemTime	8944a53c-a561-4e53-a0c6-d565414745fc	KernelExecutive		_tlgWriteTransfer	RefreshTimeZoneInfoCutoverFail	-	-	11	5	0	-	0x0	ExpLogRefreshTimeZoneInformationCutoverFail	3	0	[NtSetSystemTime->ExpRefreshTimeZoneInformation->ExpLogRefreshTimeZoneInformationCutoverFail]
189	NtSetSystemTime	8944a53c-a561-4e53-a0c6-d565414745fc	KernelExecutive		_tlgWriteTransfer	RefreshTimeZoneInfoSuccess	-	-	11	5	0	-	0x0	ExpLogRefreshTimeZoneInformationSuccess	3	0	[NtSetSystemTime->ExpRefreshTimeZoneInformation->ExpLogRefreshTimeZoneInformationSuccess]
190	NtSetSystemTime	a68ca8b7-004f-d7b6-a698-07e2de0f1f5d	KernelProvGuid	EtwKernelProvRegHandle	EtwWrite	KernelTimeZoneInformationRefresh	24	0	8	4	0	11	0x8000000000000010	EtwTraceTimeZoneInformationRefresh	3	0	[NtSetSystemTime->ExpRefreshTimeZoneInformation->EtwTraceTimeZoneInformationRefresh]
191	NtSetSystemTime	7614521c-4d0b-4341-bfc9-873082c0f1d3	KernelGeneral		_tlgWriteTransfer	TimeZoneInformationRefresh	-	-	11	5	0	-	0x0	EtwTraceTimeZoneInformationRefresh	3	0	[NtSetSystemTime->ExpRefreshTimeZoneInformation->EtwTraceTimeZoneInformationRefresh]
192	NtSetSystemTime	a68ca8b7-004f-d7b6-a698-07e2de0f1f5d	KernelProvGuid	EtwKernelProvRegHandle	EtwWrite	KernelTimeZoneBiasChange	22	0	8	4	0	8	0x8000000000000010	EtwTraceTimeZoneBiasChange	3	0	[NtSetSystemTime->ExpRefreshTimeZoneInformation->EtwTraceTimeZoneBiasChange]
193	NtSetSystemTime	7614521c-4d0b-4341-bfc9-873082c0f1d3	KernelGeneral		_tlgWriteTransfer	TimeZoneBiasChange	-	-	11	5	0	-	0x400000000000	EtwTraceTimeZoneBiasChange	3	0	[NtSetSystemTime->ExpRefreshTimeZoneInformation->EtwTraceTimeZoneBiasChange]
194	NtSetSystemTime	Windows Kernel Trace												KiTraceSetTimer	4	0	[NtSetSystemTime->ExpRefreshTimeZoneInformation->KiSetTimerEx->KiTraceSetTimer]
195	NtLoadKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteAgg	CmLoadKeySucceeded(Aggregate)	-	-	11	5	0	-	0x400000000008	CmLoadKey	4	0	[NtLoadKey->NtLoadKeyEx->CmLoadDifferencingKey->CmLoadKey]
196	NtLoadKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteAgg	CmLoadKeyFailedNoInfo(Aggregate)	-	-	11	5	0	-	0x400000000000	CmLoadKey	4	0	[NtLoadKey->NtLoadKeyEx->CmLoadDifferencingKey->CmLoadKey]
197	NtLoadKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteAgg	CmLoadKeyFailed(Aggregate)	-	-	11	5	0	-	0x400000000008	CmLoadKey	4	0	[NtLoadKey->NtLoadKeyEx->CmLoadDifferencingKey->CmLoadKey]
198	NtLoadKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	CmLoadKeyFailed	-	-	11	5	0	-	0x8	CmLoadKey	4	0	[NtLoadKey->NtLoadKeyEx->CmLoadDifferencingKey->CmLoadKey]
199	NtLoadKey	70eb4f03-c1de-4f73-a051-33d13d5413bd	RegistryProvGuid	EtwpRegTraceHandle	EtwWrite									CmpTraceHiveLoadStop	4	0	[NtLoadKey->NtLoadKeyEx->CmLoadDifferencingKey->CmpTraceHiveLoadStop]
200	NtLoadKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		EtwWriteEx									CmpThreadInfoLogStack	5	0	[NtLoadKey->NtLoadKeyEx->CmLoadDifferencingKey->CmpIsRegistryLockAcquired->CmpThreadInfoLogStack]
201	NtLoadKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	HiveLoadErrorDetected	-	-	11	5	0	-	0x0	SetFailureLocation	5	0	[NtLoadKey->NtLoadKeyEx->CmLoadDifferencingKey->CmLoadKey->SetFailureLocation]
202	NtLoadKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	HiveLoadAppHiveImpersonationRequired	-	-	11	5	0	-	0x400000000008	CmpCmdHiveOpen	5	0	[NtLoadKey->NtLoadKeyEx->CmLoadDifferencingKey->CmLoadKey->CmpCmdHiveOpen]
203	NtCreateProcessEx	Windows Kernel Trace	SESSION	MEMORY	EtwTraceKernelEvent	CREATE_SESSION								MiSessionCreate	5	0	[NtCreateProcessEx->PspCreateProcess->PspAllocateProcess->MmInitializeProcessAddressSpace->MiSessionCreate]
204	NtLoadKeyEx	70eb4f03-c1de-4f73-a051-33d13d5413bd	RegistryProvGuid	EtwpRegTraceHandle	EtwWrite									CmpTraceHiveLoadStart	3	0	[NtLoadKeyEx->CmLoadDifferencingKey->CmpTraceHiveLoadStart]
205	NtLoadKeyEx	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	CmLoadKeyFailed	-	-	11	5	0	-	0x8	CmLoadKey	3	0	[NtLoadKeyEx->CmLoadDifferencingKey->CmLoadKey]
206	NtLoadKeyEx	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteAgg	CmLoadKeySucceeded(Aggregate)	-	-	11	5	0	-	0x400000000008	CmLoadKey	3	0	[NtLoadKeyEx->CmLoadDifferencingKey->CmLoadKey]
207	NtLoadKeyEx	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteAgg	CmLoadKeyFailedNoInfo(Aggregate)	-	-	11	5	0	-	0x400000000000	CmLoadKey	3	0	[NtLoadKeyEx->CmLoadDifferencingKey->CmLoadKey]
208	NtLoadKeyEx	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteAgg	CmLoadKeyFailed(Aggregate)	-	-	11	5	0	-	0x400000000008	CmLoadKey	3	0	[NtLoadKeyEx->CmLoadDifferencingKey->CmLoadKey]
209	NtLoadKeyEx	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		EtwWriteEx									CmpThreadInfoLogStack	4	0	[NtLoadKeyEx->CmLoadDifferencingKey->CmpIsRegistryLockAcquired->CmpThreadInfoLogStack]
210	NtLoadKeyEx	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	HiveLoadAppHiveImpersonationRequired	-	-	11	5	0	-	0x400000000008	CmpCmdHiveOpen	4	0	[NtLoadKeyEx->CmLoadDifferencingKey->CmLoadKey->CmpCmdHiveOpen]
211	NtLoadKeyEx	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	HiveLoadErrorDetected	-	-	11	5	0	-	0x0	SetFailureLocation	4	0	[NtLoadKeyEx->CmLoadDifferencingKey->CmLoadKey->SetFailureLocation]
212	NtQueryBootEntryOrder	a9fdf37b-d72d-4051-a3cd-d422103ce079	Microsoft.Windows.Kernel.SysEnv		_tlgWriteTransfer	GetVariable	-	-	11	5	0	-	0x200000000000	IoGetEnvironmentVariableEx	2	0	[NtQueryBootEntryOrder->IoGetEnvironmentVariableEx]
213	NtEnumerateDriverEntries	a9fdf37b-d72d-4051-a3cd-d422103ce079	Microsoft.Windows.Kernel.SysEnv		_tlgWriteTransfer	EnumerateVariables	-	-	11	5	0	-	0x200000000000	IoEnumerateEnvironmentVariablesEx	2	0	[NtEnumerateDriverEntries->IoEnumerateEnvironmentVariablesEx]
214	NtUnloadKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		EtwWriteEx									CmpThreadInfoLogStack	4	0	[NtUnloadKey->CmUnloadKey->CmpIsRegistryLockAcquired->CmpThreadInfoLogStack]
215	NtUnloadKey	f39412d1-c9fd-5e79-8a82-9c9cbd8ca809	Microsoft.Windows.Kernel.ObjectManager		_tlgWriteTransfer	SymlinkTraversalBlocked	-	-	11	5	0	-	0x400000000000	ObpParseSymbolicLinkEx	5	0	[NtUnloadKey->CmUnloadKey->ObReferenceObjectByNameEx->ObpLookupObjectName->ObpParseSymbolicLinkEx]
216	NtSetTimerEx	Windows Kernel Trace	TIMER	PERFINFO	EtwTraceKernelEvent	KTIMER2_SET								KiTraceSetTimer2	5	0	[NtSetTimerEx->ExpSetTimer->ExpSetTimerObject2->KeSetTimer2->KiTraceSetTimer2]
217	NtOpenThread	e02a841c-75a3-4fa7-afc8-ae09cf9b7f23	KernelAuditApiCallsGuid	EtwApiCallsProvRegHandle	EtwWrite	KERNEL_AUDIT_API_OPENTHREAD	6	0	0	4	0	0	0x0	PsOpenThread	2	0	[NtOpenThread->PsOpenThread]
218	NtOpenThread	c59673d8-b796-58df-fbf8-a70bad656dca	Microsoft.Windows.Kernel.ProcessSubsystem		_tlgWriteTransfer	ThreadOpenFailedForForcedAccessCheck	-	-	11	5	0	-	0x400000000000	PsOpenThread	2	0	[NtOpenThread->PsOpenThread]
219	NtEnumerateKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteAgg									CmpBounceContextStart	2	0	[NtEnumerateKey->CmpBounceContextStart]
220	NtEnumerateKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		EtwWriteEx									CmpThreadInfoLogStack	3	0	[NtEnumerateKey->CmpIsRegistryLockAcquired->CmpThreadInfoLogStack]
221	NtAddDriverEntry	a9fdf37b-d72d-4051-a3cd-d422103ce079	Microsoft.Windows.Kernel.SysEnv		_tlgWriteTransfer	SetVariable	-	-	11	5	0	-	0x200000000000	IoSetEnvironmentVariableEx	3	0	[NtAddDriverEntry->ExpSetDriverEntry->IoSetEnvironmentVariableEx]
222	NtAddDriverEntry	a9fdf37b-d72d-4051-a3cd-d422103ce079	Microsoft.Windows.Kernel.SysEnv		_tlgWriteTransfer	GetVariable	-	-	11	5	0	-	0x200000000000	IoGetEnvironmentVariableEx	3	0	[NtAddDriverEntry->ExpSetDriverEntry->IoGetEnvironmentVariableEx]
223	NtAddBootEntry	a9fdf37b-d72d-4051-a3cd-d422103ce079	Microsoft.Windows.Kernel.SysEnv		_tlgWriteTransfer	SetVariable	-	-	11	5	0	-	0x200000000000	IoSetEnvironmentVariableEx	3	0	[NtAddBootEntry->ExpSetBootEntry->IoSetEnvironmentVariableEx]
224	NtAddBootEntry	a9fdf37b-d72d-4051-a3cd-d422103ce079	Microsoft.Windows.Kernel.SysEnv		_tlgWriteTransfer	GetVariable	-	-	11	5	0	-	0x200000000000	IoGetEnvironmentVariableEx	3	0	[NtAddBootEntry->ExpSetBootEntry->IoGetEnvironmentVariableEx]
225	NtSetBootOptions	a9fdf37b-d72d-4051-a3cd-d422103ce079	Microsoft.Windows.Kernel.SysEnv		_tlgWriteTransfer	SetVariable	-	-	11	5	0	-	0x200000000000	IoSetEnvironmentVariableEx	2	0	[NtSetBootOptions->IoSetEnvironmentVariableEx]
226	NtOpenKeyTransactedEx	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		EtwWriteEx									CmpThreadInfoLogStack	5	0	[NtOpenKeyTransactedEx->CmOpenKey->CmpLockRegistry->CmpRecordRegistryLockAcquire->CmpThreadInfoLogStack]
227	NtQuerySystemEnvironmentValueEx	a9fdf37b-d72d-4051-a3cd-d422103ce079	Microsoft.Windows.Kernel.SysEnv		_tlgWriteTransfer	GetVariable	-	-	11	5	0	-	0x200000000000	IoGetEnvironmentVariableEx	3	0	[NtQuerySystemEnvironmentValueEx->ExpGetFirmwareEnvironmentVariable->IoGetEnvironmentVariableEx]
228	NtCreateUserProcess	22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716	PsProvGuid	EtwpPsProvRegHandle	EtwWrite	PfSnEvt_PrefetchMetadata_Start	3	1	16	4	1	3	0x8000000000000020	EtwpPsProvTraceThread	4	0	[NtCreateUserProcess->PspInsertThread->EtwTraceThread->EtwpPsProvTraceThread]
229	NtCreateUserProcess	22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716	PsProvGuid	EtwpPsProvRegHandle	EtwWrite	ThreadStop	4	1	16	4	2	4	0x8000000000000020	EtwpPsProvTraceThread	4	0	[NtCreateUserProcess->PspInsertThread->EtwTraceThread->EtwpPsProvTraceThread]
230	NtCreateUserProcess	Windows Kernel Trace												EtwpEnumerateAddressSpace	4	0	[NtCreateUserProcess->PspInsertThread->EtwTraceProcess->EtwpEnumerateAddressSpace]
231	NtCreateUserProcess	2839ff94-8f12-4e1b-82e3-af7af77a450f	KernelProcess		_tlgWriteTransfer	ProcessStarted	-	-	11	5	0	-	0x3	EtwpWriteProcessStarted	4	0	[NtCreateUserProcess->PspInsertThread->EtwTraceProcess->EtwpWriteProcessStarted]
232	NtCreateUserProcess	Windows Kernel Trace	SESSION	MEMORY	EtwTraceKernelEvent	CREATE_SESSION								MiSessionCreate	4	0	[NtCreateUserProcess->PspAllocateProcess->MmInitializeProcessAddressSpace->MiSessionCreate]
233	NtCreateUserProcess	Windows Kernel Trace												MiLogKernelStackEvent	5	0	[NtCreateUserProcess->PspAllocateThread->KeInitThread->MmCreateKernelStack->MiLogKernelStackEvent]
234	NtCreateUserProcess	Windows Kernel Trace	PERF_0x80000	JOB	EtwTraceKernelEvent	JOB_ASSIGN_PROCESS								EtwTraceJobAssignProcess	4	0	[NtCreateUserProcess->PspInsertThread->PspAssignProcessToJobList->EtwTraceJobAssignProcess]
235	NtCreateUserProcess	22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716	PsProvGuid	EtwpPsProvRegHandle	EtwWrite	ProcessStart	1	3	16	4	1	1	0x8000000000000010	EtwpPsProvTraceProcess	5	0	[NtCreateUserProcess->PspInsertThread->EtwTraceProcess->EtwpWriteProcessEvent->EtwpPsProvTraceProcess]
236	NtCreateUserProcess	22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716	PsProvGuid	EtwpPsProvRegHandle	EtwWrite	ProcessStop	2	2	16	4	2	2	0x8000000000000010	EtwpPsProvTraceProcess	5	0	[NtCreateUserProcess->PspInsertThread->EtwTraceProcess->EtwpWriteProcessEvent->EtwpPsProvTraceProcess]
237	NtCreateUserProcess	22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716	PsProvGuid	EtwpPsProvRegHandle	EtwWrite	ProcessRundown	15	1	16	4	0	15	0x8000000000000010	EtwpPsProvTraceProcess	5	0	[NtCreateUserProcess->PspInsertThread->EtwTraceProcess->EtwpWriteProcessEvent->EtwpPsProvTraceProcess]
238	NtCreateUserProcess	Windows Kernel Trace	LOADER	IMAGE	EtwTraceKernelEvent	IMAGE_UNLOAD								EtwpTraceImageUnload	5	0	[NtCreateUserProcess->PspInsertThread->EtwTraceProcess->EtwpEnumerateAddressSpace->EtwpTraceImageUnload]
239	NtCreateUserProcess	Windows Kernel Trace	PROCESS	PROCESS	EtwTraceKernelEvent	PROCESS_TERMINATE								EtwTraceProcessTerminate	4	0	[NtCreateUserProcess->PsTerminateProcess->PspTerminateProcess->EtwTraceProcessTerminate]
240	NtCreateUserProcess	fae10392-f0af-4ac0-b8ff-9f4d920c3cdf	SecurityMitigationsProviderGuid	EtwSecurityMitigationsRegHandle	EtwWrite	MITIGATION_AUDIT_PROHIBIT_CHILD_PROCESS_CREATION	3	0	16	0	0	2	0x8000000000000000	EtwTimLogProhibitChildProcessCreation	5	0	[NtCreateUserProcess->PspAllocateProcess->PspInitializeProcessSecurity->SeSubProcessToken->EtwTimLogProhibitChildProcessCreation]
241	NtCreateUserProcess	fae10392-f0af-4ac0-b8ff-9f4d920c3cdf	SecurityMitigationsProviderGuid	EtwSecurityMitigationsRegHandle	EtwWrite	MITIGATION_ENFORCE_PROHIBIT_CHILD_PROCESS_CREATION	4	0	16	3	0	2	0x8000000000000000	EtwTimLogProhibitChildProcessCreation	5	0	[NtCreateUserProcess->PspAllocateProcess->PspInitializeProcessSecurity->SeSubProcessToken->EtwTimLogProhibitChildProcessCreation]
242	NtCreateUserProcess	2839ff94-8f12-4e1b-82e3-af7af77a450f	KernelProcess		_tlgWriteTransfer	DeniedTokenCreation	-	-	11	5	0	-	0x200000000001	EtwTimLogProhibitChildProcessCreation	5	0	[NtCreateUserProcess->PspAllocateProcess->PspInitializeProcessSecurity->SeSubProcessToken->EtwTimLogProhibitChildProcessCreation]
243	NtCreateUserProcess	7614521c-4d0b-4341-bfc9-873082c0f1d3	KernelGeneral		_tlgWriteTransfer	ProhibitChildProcessCreation	-	-	11	5	0	-	0x400000000000	EtwTimLogProhibitChildProcessCreation	5	0	[NtCreateUserProcess->PspAllocateProcess->PspInitializeProcessSecurity->SeSubProcessToken->EtwTimLogProhibitChildProcessCreation]
244	NtCreateUserProcess	Windows Kernel Trace	PERF_0x20400001	MEMORY	EtwTraceKernelEvent	PFMAPPED_SECTION_CREATE								MiLogSectionCreate	5	0	[NtCreateUserProcess->MmCreateSpecialImageSection->MiCreateSection->MiCreatePagingFileMap->MiLogSectionCreate]
245	NtCreateUserProcess	Windows Kernel Trace	PERF_0x20400001	MEMORY	EtwTraceKernelEvent	PFMAPPED_SECTION_DELETE								MiLogSectionCreate	5	0	[NtCreateUserProcess->MmCreateSpecialImageSection->MiCreateSection->MiCreatePagingFileMap->MiLogSectionCreate]
246	NtQueryInformationJobObject	Windows Kernel Trace												EtwTraceJobSetQuery	2	0	[NtQueryInformationJobObject->EtwTraceJobSetQuery]
247	NtOpenProcessTokenEx	f39412d1-c9fd-5e79-8a82-9c9cbd8ca809	Microsoft.Windows.Kernel.ObjectManager		_tlgWriteTransfer	SymlinkTraversalBlocked	-	-	11	5	0	-	0x400000000000	ObpParseSymbolicLinkEx	5	0	[NtOpenProcessTokenEx->ObpCreateHandle->ObpInsertOrLocateNamedObject->ObpLookupObjectName->ObpParseSymbolicLinkEx]
248	NtAlpcOpenSenderProcess	e02a841c-75a3-4fa7-afc8-ae09cf9b7f23	KernelAuditApiCallsGuid	EtwApiCallsProvRegHandle	EtwWrite	KERNEL_AUDIT_API_OPENPROCESS	5	0	0	4	0	0	0x0	PsOpenProcess	2	0	[NtAlpcOpenSenderProcess->PsOpenProcess]
249	NtAlpcOpenSenderProcess	c59673d8-b796-58df-fbf8-a70bad656dca	Microsoft.Windows.Kernel.ProcessSubsystem		_tlgWriteTransfer	ProcessOpenFailedForForcedAccessCheck	-	-	11	5	0	-	0x400000000000	PsOpenProcess	2	0	[NtAlpcOpenSenderProcess->PsOpenProcess]
250	NtSetInformationJobObject	22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716	PsProvGuid	EtwpPsProvRegHandle	EtwWrite	PsIoRateControlStart	19	2	16	4	1	17	0x8000000000001000	PspSetJobIoRateControl	2	0	[NtSetInformationJobObject->PspSetJobIoRateControl]
251	NtSetInformationJobObject	22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716	PsProvGuid	EtwpPsProvRegHandle	EtwWrite	PsIoRateControlStop	20	2	16	4	2	17	0x8000000000001000	PspSetJobIoRateControl	2	0	[NtSetInformationJobObject->PspSetJobIoRateControl]
252	NtSetInformationJobObject	Windows Kernel Trace												EtwTraceJobSetQuery	2	0	[NtSetInformationJobObject->EtwTraceJobSetQuery]
253	NtSetIntervalProfile	Windows Kernel Trace	PROFILING	PERFINFO	EtwTraceKernelEvent	SAMPLED_PROFILE_SET_INTERVAL								KeSetIntervalProfile	2	0	[NtSetIntervalProfile->KeSetIntervalProfile]
254	NtQueryEnvironmentVariableInfoEx	a9fdf37b-d72d-4051-a3cd-d422103ce079	Microsoft.Windows.Kernel.SysEnv		_tlgWriteTransfer	QueryVariables	-	-	11	5	0	-	0x200000000000	IoQueryEnvironmentVariableInfoEx	2	0	[NtQueryEnvironmentVariableInfoEx->IoQueryEnvironmentVariableInfoEx]
255	NtOpenProcess	e02a841c-75a3-4fa7-afc8-ae09cf9b7f23	KernelAuditApiCallsGuid	EtwApiCallsProvRegHandle	EtwWrite	KERNEL_AUDIT_API_OPENPROCESS	5	0	0	4	0	0	0x0	PsOpenProcess	2	0	[NtOpenProcess->PsOpenProcess]
256	NtOpenProcess	c59673d8-b796-58df-fbf8-a70bad656dca	Microsoft.Windows.Kernel.ProcessSubsystem		_tlgWriteTransfer	ProcessOpenFailedForForcedAccessCheck	-	-	11	5	0	-	0x400000000000	PsOpenProcess	2	0	[NtOpenProcess->PsOpenProcess]
257	NtSetInformationProcess	22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716	PsProvGuid	EtwpPsProvRegHandle	EtwWriteEx	ProcessInPrivateSet	27	0	16	4	0	20	0x8000000000000010	EtwTraceProcessSetInPrivateMode	2	0	[NtSetInformationProcess->EtwTraceProcessSetInPrivateMode]
258	NtSetInformationProcess	Windows Kernel Trace	PRIORITY	THREAD	EtwTraceKernelEvent	THREAD_SET_PAGE_PRIORITY								EtwTracePriority	3	0	[NtSetInformationProcess->PsSetPagePriorityThread->EtwTracePriority]
259	NtSetInformationProcess	???			_tlgWriteEx	WsEmptyControl	-	-	11	5	0	-	0x10	MiLogWsEmptyControl	3	0	[NtSetInformationProcess->MmProcessWorkingSetControl->MiLogWsEmptyControl]
260	NtSetInformationProcess	1dd9b8c9-e078-4075-b9de-4e5125071a18	MSTelCov		_tlgWriteTransfer	CovNew	-	-	11	5	0	-	0x2	EtwpCoverageRecord	3	0	[NtSetInformationProcess->EtwSetProcessTelemetryCoverage->EtwpCoverageRecord]
261	NtSetInformationProcess	1dd9b8c9-e078-4075-b9de-4e5125071a18	MSTelCov		_tlgWriteTransfer	Cov	-	-	11	5	0	-	0x1	EtwpCoverageRecord	3	0	[NtSetInformationProcess->EtwSetProcessTelemetryCoverage->EtwpCoverageRecord]
262	NtRollbackRegistryTransaction	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	CmpTransLightWeightRollback	-	-	11	5	1	-	0x1	CmpAbortLightWeightTransaction	3	0	[NtRollbackRegistryTransaction->CmpRollbackLightWeightTransaction->CmpAbortLightWeightTransaction]
263	NtRollbackRegistryTransaction	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	CmpTransLightWeightRollback	-	-	11	5	2	-	0x1	CmpAbortLightWeightTransaction	3	0	[NtRollbackRegistryTransaction->CmpRollbackLightWeightTransaction->CmpAbortLightWeightTransaction]
264	NtSaveKey	70eb4f03-c1de-4f73-a051-33d13d5413bd	RegistryProvGuid	EtwpRegTraceHandle	EtwWrite									CmpTraceHiveSaveStart	4	0	[NtSaveKey->NtSaveKeyEx->CmSaveKey->CmpTraceHiveSaveStart]
265	NtSaveKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	UnsupportedOperation	-	-	11	5	0	-	0x0	CmpLogUnsupportedOperation	4	0	[NtSaveKey->NtSaveKeyEx->CmSaveKey->CmpLogUnsupportedOperation]
266	NtSaveKey	70eb4f03-c1de-4f73-a051-33d13d5413bd	RegistryProvGuid	EtwpRegTraceHandle	EtwWrite									CmpTraceHiveSaveTreeCopied	4	0	[NtSaveKey->NtSaveKeyEx->CmSaveKey->CmpTraceHiveSaveTreeCopied]
267	NtSaveKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		EtwWriteEx									CmpThreadInfoLogStack	4	0	[NtSaveKey->NtSaveKeyEx->CmpIsRegistryLockAcquired->CmpThreadInfoLogStack]
268	NtSaveKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	UnsupportedOperation(Aggregate)	-	-	11	5	0	-	0x400000000000	CmpSendUnsupportedOperationTelemetryEvent	5	0	[NtSaveKey->NtSaveKeyEx->CmSaveKey->CmpLogUnsupportedOperation->CmpSendUnsupportedOperationTelemetryEvent]
269	NtSaveKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	HiveSelfHealed	-	-	11	5	0	-	0x400000000000	CmpCreateHive	5	0	[NtSaveKey->NtSaveKeyEx->CmSaveKey->CmpCreateTemporaryHive->CmpCreateHive]
270	NtOpenKeyEx	f39412d1-c9fd-5e79-8a82-9c9cbd8ca809	Microsoft.Windows.Kernel.ObjectManager		_tlgWriteTransfer	SymlinkTraversalBlocked	-	-	11	5	0	-	0x400000000000	ObpParseSymbolicLinkEx	5	0	[NtOpenKeyEx->CmOpenKey->ObOpenObjectByNameEx->ObpLookupObjectName->ObpParseSymbolicLinkEx]
271	NtOpenKeyEx	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		EtwWriteEx									CmpThreadInfoLogStack	5	0	[NtOpenKeyEx->CmOpenKey->CmpLockRegistry->CmpRecordRegistryLockAcquire->CmpThreadInfoLogStack]
272	NtSystemDebugControl	a4d16fc5-d1cf-4d72-a055-25f3eb02a70e	Microsoft.Windows.Kernel.LiveDump		_tlgWriteTransfer	CaptureDumpStarted	-	-	11	5	1	-	0x400000000000	IoCaptureLiveDump	3	0	[NtSystemDebugControl->DbgkCaptureLiveKernelDump->IoCaptureLiveDump]
273	NtSystemDebugControl	a4d16fc5-d1cf-4d72-a055-25f3eb02a70e	Microsoft.Windows.Kernel.LiveDump		_tlgWriteTransfer	WriteDumpDataEnded	-	-	11	5	0	-	0x400000000000	IoCaptureLiveDump	3	0	[NtSystemDebugControl->DbgkCaptureLiveKernelDump->IoCaptureLiveDump]
274	NtSystemDebugControl	a4d16fc5-d1cf-4d72-a055-25f3eb02a70e	Microsoft.Windows.Kernel.LiveDump		_tlgWriteTransfer	CaptureDumpEnded	-	-	11	5	2	-	0x400000000000	IoCaptureLiveDump	3	0	[NtSystemDebugControl->DbgkCaptureLiveKernelDump->IoCaptureLiveDump]
275	NtSystemDebugControl	bef2aa8e-81cd-11e2-a7bb-5eac6188709b	LiveDumpProvGuid	IopLiveDumpEtwRegHandle	EtwWrite	LIVEDUMP_EVENT_MEMORY_PRESSURE_ABORT	5	0	16	4	22	1	0x8000000000000000	IoCaptureLiveDump	3	0	[NtSystemDebugControl->DbgkCaptureLiveKernelDump->IoCaptureLiveDump]
276	NtSystemDebugControl	???			EtwWriteEx	SQM_INCREMENT_DWORD	6	0	0	4	2	0	0x8008000000000000	DbgkpLkmdSqmIncrementDword	3	0	[NtSystemDebugControl->DbgkCaptureLiveDump->DbgkpLkmdSqmIncrementDword]
277	NtSystemDebugControl	bef2aa8e-81cd-11e2-a7bb-5eac6188709b	LiveDumpProvGuid	IopLiveDumpEtwRegHandle	EtwWriteEx	LIVEDUMP_EVENT_CAPTURE_API_START	1	0	16	4	10	1	0x8000000000000000	IopLiveDumpTraceInterfaceStart	4	0	[NtSystemDebugControl->DbgkCaptureLiveKernelDump->IoCaptureLiveDump->IopLiveDumpTraceInterfaceStart]
278	NtSystemDebugControl	bef2aa8e-81cd-11e2-a7bb-5eac6188709b	LiveDumpProvGuid	IopLiveDumpEtwRegHandle	EtwWriteEx	LIVEDUMP_EVENT_WRITE_DEFERRED_DATA_API_START	201	0	16	4	10	4	0x8000000000000000	IopLiveDumpTraceInterfaceStart	4	0	[NtSystemDebugControl->DbgkCaptureLiveKernelDump->IoCaptureLiveDump->IopLiveDumpTraceInterfaceStart]
279	NtSystemDebugControl	bef2aa8e-81cd-11e2-a7bb-5eac6188709b	LiveDumpProvGuid	IopLiveDumpEtwRegHandle	EtwWriteEx	LIVEDUMP_EVENT_DISCARD_DEFERRED_DATA_API_START	251	0	16	4	10	5	0x8000000000000000	IopLiveDumpTraceInterfaceStart	4	0	[NtSystemDebugControl->DbgkCaptureLiveKernelDump->IoCaptureLiveDump->IopLiveDumpTraceInterfaceStart]
280	NtSystemDebugControl	a4d16fc5-d1cf-4d72-a055-25f3eb02a70e	Microsoft.Windows.Kernel.LiveDump		_tlgWriteTransfer	CaptureDumpMemoryCaptureEnded	-	-	11	5	0	-	0x400000000000	IopLiveDumpCaptureMemoryPages	4	0	[NtSystemDebugControl->DbgkCaptureLiveKernelDump->IoCaptureLiveDump->IopLiveDumpCaptureMemoryPages]
281	NtSystemDebugControl	bef2aa8e-81cd-11e2-a7bb-5eac6188709b	LiveDumpProvGuid	IopLiveDumpEtwRegHandle	EtwWriteEx	LIVEDUMP_EVENT_WRITE_DUMPDATA_TO_FILE_END	4	1	17	4	13	1	0x4000000000000000	IopLiveDumpTraceDumpFileWriteEnd	4	0	[NtSystemDebugControl->DbgkCaptureLiveKernelDump->IoCaptureLiveDump->IopLiveDumpTraceDumpFileWriteEnd]
282	NtSystemDebugControl	bef2aa8e-81cd-11e2-a7bb-5eac6188709b	LiveDumpProvGuid	IopLiveDumpEtwRegHandle	EtwWriteEx	LIVEDUMP_EVENT_WRITE_DEFERRED_DUMPDATA_TO_FILE_END	204	1	17	4	13	4	0x4000000000000000	IopLiveDumpTraceDumpFileWriteEnd	4	0	[NtSystemDebugControl->DbgkCaptureLiveKernelDump->IoCaptureLiveDump->IopLiveDumpTraceDumpFileWriteEnd]
283	NtSystemDebugControl	a4d16fc5-d1cf-4d72-a055-25f3eb02a70e	Microsoft.Windows.Kernel.LiveDump		_tlgWriteTransfer	CaptureDumpMemoryAllocationEnded	-	-	11	5	0	-	0x400000000000	IopLiveDumpAllocAndInitResources	4	0	[NtSystemDebugControl->DbgkCaptureLiveKernelDump->IoCaptureLiveDump->IopLiveDumpAllocAndInitResources]
284	NtSystemDebugControl	bef2aa8e-81cd-11e2-a7bb-5eac6188709b	LiveDumpProvGuid	IopLiveDumpEtwRegHandle	EtwWriteEx	LIVEDUMP_EVENT_WRITE_DUMPDATA_TO_FILE_START	3	0	17	4	12	1	0x4000000000000000	IopLiveDumpTrace	4	0	[NtSystemDebugControl->DbgkCaptureLiveKernelDump->IoCaptureLiveDump->IopLiveDumpTrace]
285	NtSystemDebugControl	bef2aa8e-81cd-11e2-a7bb-5eac6188709b	LiveDumpProvGuid	IopLiveDumpEtwRegHandle	EtwWriteEx	LIVEDUMP_EVENT_CAPTURE_API_END	2	5	17	4	11	1	0x4000000000000000	IopLiveDumpTraceInterfaceEnd	4	0	[NtSystemDebugControl->DbgkCaptureLiveKernelDump->IoCaptureLiveDump->IopLiveDumpTraceInterfaceEnd]
286	NtSystemDebugControl	bef2aa8e-81cd-11e2-a7bb-5eac6188709b	LiveDumpProvGuid	IopLiveDumpEtwRegHandle	EtwWriteEx	LIVEDUMP_EVENT_WRITE_DEFERRED_DATA_API_END	202	5	17	4	11	4	0x4000000000000000	IopLiveDumpTraceInterfaceEnd	4	0	[NtSystemDebugControl->DbgkCaptureLiveKernelDump->IoCaptureLiveDump->IopLiveDumpTraceInterfaceEnd]
287	NtSystemDebugControl	bef2aa8e-81cd-11e2-a7bb-5eac6188709b	LiveDumpProvGuid	IopLiveDumpEtwRegHandle	EtwWriteEx	LIVEDUMP_EVENT_DISCARD_DEFERRED_DATA_API_END	252	5	17	4	11	5	0x4000000000000000	IopLiveDumpTraceInterfaceEnd	4	0	[NtSystemDebugControl->DbgkCaptureLiveKernelDump->IoCaptureLiveDump->IopLiveDumpTraceInterfaceEnd]
288	NtSystemDebugControl	a4d16fc5-d1cf-4d72-a055-25f3eb02a70e	Microsoft.Windows.Kernel.LiveDump		_tlgWriteTransfer	OpenVMMemoryPartitionFailure	-	-	11	5	0	-	0x200000000000	IopLiveDumpOpenVMMemoryPartition	4	0	[NtSystemDebugControl->DbgkCaptureLiveKernelDump->IoCaptureLiveDump->IopLiveDumpOpenVMMemoryPartition]
289	NtQueryBootOptions	a9fdf37b-d72d-4051-a3cd-d422103ce079	Microsoft.Windows.Kernel.SysEnv		_tlgWriteTransfer	GetVariable	-	-	11	5	0	-	0x200000000000	IoGetEnvironmentVariableEx	2	0	[NtQueryBootOptions->IoGetEnvironmentVariableEx]
290	NtSetInformationVirtualMemory	???			_tlgWriteEx	MemoryColdHint	-	-	11	5	0	-	0x40	MiLogNotifyPageHeat	5	0	[NtSetInformationVirtualMemory->MiProcessVaContiguityInformation->MiGetLargePage->MiNotifyPageHeat->MiLogNotifyPageHeat]
291	NtSetInformationVirtualMemory	???			_tlgWriteEx	MemoryHotHint	-	-	11	5	0	-	0x40	MiLogNotifyPageHeat	5	0	[NtSetInformationVirtualMemory->MiProcessVaContiguityInformation->MiGetLargePage->MiNotifyPageHeat->MiLogNotifyPageHeat]
292	NtSetInformationVirtualMemory	Windows Kernel Trace	PERF_0x28000001	MEMORY	EtwTraceKernelEvent	PAGE_ACCESS								MiDemoteCombinedPte	5	0	[NtSetInformationVirtualMemory->MiProcessVaRangesInfoClass->MiWalkVaRange->MiActOnPte->MiDemoteCombinedPte]
293	NtSetInformationVirtualMemory	Windows Kernel Trace	PERF_0x28000001	MEMORY	EtwTraceKernelEvent	PAGE_ACCESS_EX								MiCopyOnWrite	4	0	[NtSetInformationVirtualMemory->MiProcessVaRangesInfoClass->MiWalkVaRange->MiCopyOnWrite]
294	NtUnloadDriver	???		PnpEtwHandle	EtwWrite	KMPnPEvt_DriverUnload_Start	214	0	20	4	1	214	0x400000000004020	PnpDiagnosticTraceObject	3	0	[NtUnloadDriver->IopUnloadDriver->PnpDiagnosticTraceObject]
295	NtUnloadDriver	f4e1897c-bb5d-5668-f1d8-040f4d8dd344	ThreatIntProviderGuid	EtwThreatIntProvRegHandle	EtwWrite	THREATINT_DRIVER_OBJECT_UNLOAD	30	1	16	4	0	10	0x8000000040000000	EtwTiLogDriverObjectUnLoad	3	0	[NtUnloadDriver->IopUnloadDriver->EtwTiLogDriverObjectUnLoad]
296	NtUnloadDriver	???		PnpEtwHandle	EtwWrite	KMPnPEvt_DriverUnload_Stop	215	0	20	4	2	214	0x400000000004020	PnpDiagnosticTrace	4	0	[NtUnloadDriver->IopUnloadDriver->PnpDiagnosticTraceDriverFullInfo->PnpDiagnosticTrace]
297	NtAlpcOpenSenderThread	c59673d8-b796-58df-fbf8-a70bad656dca	Microsoft.Windows.Kernel.ProcessSubsystem		_tlgWriteTransfer	ThreadOpenFailedForForcedAccessCheck	-	-	11	5	0	-	0x400000000000	PsOpenThread	2	0	[NtAlpcOpenSenderThread->PsOpenThread]
298	NtAlpcOpenSenderThread	e02a841c-75a3-4fa7-afc8-ae09cf9b7f23	KernelAuditApiCallsGuid	EtwApiCallsProvRegHandle	EtwWrite	KERNEL_AUDIT_API_OPENTHREAD	6	0	0	4	0	0	0x0	PsOpenThread	2	0	[NtAlpcOpenSenderThread->PsOpenThread]
299	NtManagePartition	d1d93ef7-e1f2-4f45-9943-03d245fe6c00	MemoryProvGuid	EtwpMemoryProvRegHandle	EtwWriteEx	KERNEL_MEM_EVENT_MDL_ALLOCATION	10	0	16	4	0	7	0x8000000000000200	MiAllocatePagesForMdl	4	0	[NtManagePartition->MmManagePartitionMoveMemory->MiAllocatePartitionPhysicalPages->MiAllocatePagesForMdl]
300	NtManagePartition	Windows Kernel Trace	MEMORY	MEMORY	EtwTraceKernelEvent	PAGE_RANGE_ACCESS								MiLogMdlRangeEvent	5	0	[NtManagePartition->MmManagePartitionMoveMemory->MiAllocatePartitionPhysicalPages->MiAllocatePagesForMdl->MiLogMdlRangeEvent]
301	NtManagePartition	17d2a329-4539-5f4d-3435-f510634ce3b9	DumpProvGuid	IopDumpEtwRegHandle	EtwWriteEx	DUMP_EVENT_CRASHDUMP_INITIALIZE_FAILED	5	0	16	3	15	2	0x8000000000000000	IopDumpTraceInitializeCrashDumpFailure	5	0	[NtManagePartition->MiCreatePagingFile->IoInitializeCrashDump->IopInitializeCrashDump->IopDumpTraceInitializeCrashDumpFailure]
302	NtManagePartition	a51ee86b-8ea5-454c-9a7d-37b6655a535d	Microsoft.Windows.Kernel.Dump		_tlgWriteTransfer	CrashDumpInitializeFailed	-	-	11	5	0	-	0x400000000000	IopDumpTraceInitializeCrashDumpFailure	5	0	[NtManagePartition->MiCreatePagingFile->IoInitializeCrashDump->IopInitializeCrashDump->IopDumpTraceInitializeCrashDumpFailure]
303	NtManagePartition	17d2a329-4539-5f4d-3435-f510634ce3b9	DumpProvGuid	IopDumpEtwRegHandle	EtwWriteEx	DUMP_EVENT_CRASHDUMP_LOAD_DRIVER_FAILED	6	0	16	3	16	2	0x8000000000000000	IopDumpTraceLoadCrashDumpDriverFailure	5	0	[NtManagePartition->MiCreatePagingFile->IoInitializeCrashDump->IopInitializeCrashDump->IopDumpTraceLoadCrashDumpDriverFailure]
304	NtManagePartition	a51ee86b-8ea5-454c-9a7d-37b6655a535d	Microsoft.Windows.Kernel.Dump		_tlgWriteTransfer	CrashDumpLoadDriverFailed	-	-	11	5	0	-	0x400000000000	IopDumpTraceLoadCrashDumpDriverFailure	5	0	[NtManagePartition->MiCreatePagingFile->IoInitializeCrashDump->IopInitializeCrashDump->IopDumpTraceLoadCrashDumpDriverFailure]
305	NtNotifyChangeKey	Windows Kernel Trace	REG_NOTIF	REGISTRY	EtwTraceKernelEvent	REG_NOTIF_REGISTER								CmpNotifyChangeKey	3	0	[NtNotifyChangeKey->NtNotifyChangeMultipleKeys->CmpNotifyChangeKey]
306	NtRenameKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	UnsupportedOperation	-	-	11	5	0	-	0x0	CmpLogUnsupportedOperation	3	0	[NtRenameKey->CmRenameKey->CmpLogUnsupportedOperation]
307	NtRenameKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		EtwWriteEx									CmpThreadInfoLogStack	3	0	[NtRenameKey->CmpIsRegistryLockAcquired->CmpThreadInfoLogStack]
308	NtRenameKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	UnsupportedOperation(Aggregate)	-	-	11	5	0	-	0x400000000000	CmpSendUnsupportedOperationTelemetryEvent	4	0	[NtRenameKey->CmRenameKey->CmpLogUnsupportedOperation->CmpSendUnsupportedOperationTelemetryEvent]
309	NtSetValueKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		EtwWriteEx									CmpThreadInfoLogStack	3	0	[NtSetValueKey->CmpIsRegistryLockAcquired->CmpThreadInfoLogStack]
310	NtSetValueKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	AddLogContainer	-	-	11	5	0	-	0x1	CmpTransWriteLog	4	0	[NtSetValueKey->CmSetValueKey->CmAddLogForAction->CmpTransWriteLog]
311	NtSetValueKey	Windows Kernel Trace	REG_HIVE	REGISTRY	EtwTraceKernelEvent	REG_HIVE_DIRTY								HvpMarkDirty	4	0	[NtSetValueKey->CmSetValueKey->HvpMarkCellDirty->HvpMarkDirty]
312	NtCreateKeyTransacted	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		EtwWriteEx									CmpThreadInfoLogStack	5	0	[NtCreateKeyTransacted->CmCreateKey->CmpLockRegistry->CmpRecordRegistryLockAcquire->CmpThreadInfoLogStack]
313	NtQueryValueKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteAgg									NtQueryValueKey	1	0	[NtQueryValueKey]
314	NtCreateSymbolicLinkObject	e02a841c-75a3-4fa7-afc8-ae09cf9b7f23	KernelAuditApiCallsGuid	EtwApiCallsProvRegHandle	EtwWrite	KERNEL_AUDIT_API_CREATESYMBOLICLINKOBJECT	3	0	0	4	0	0	0x0	NtCreateSymbolicLinkObject	1	0	[NtCreateSymbolicLinkObject]
315	NtFreeVirtualMemory	Windows Kernel Trace												MiLogPerfMemoryRangeEvent	5	0	[NtFreeVirtualMemory->MmFreeVirtualMemory->MiFreeVadRange->MiDeleteVad->MiLogPerfMemoryRangeEvent]
316	NtFreeVirtualMemory	Windows Kernel Trace	MEMORY	MEMORY	EtwTraceKernelEvent	PAGE_RELEASE								MiDeletePteRun	5	0	[NtFreeVirtualMemory->MmFreeVirtualMemory->MiDeleteEmptyPageTables->MiDeleteEmptyPageTableTail->MiDeletePteRun]
317	NtDeleteBootEntry	a9fdf37b-d72d-4051-a3cd-d422103ce079	Microsoft.Windows.Kernel.SysEnv		_tlgWriteTransfer	GetVariable	-	-	11	5	0	-	0x200000000000	IoGetEnvironmentVariableEx	2	0	[NtDeleteBootEntry->IoGetEnvironmentVariableEx]
318	NtDeleteBootEntry	a9fdf37b-d72d-4051-a3cd-d422103ce079	Microsoft.Windows.Kernel.SysEnv		_tlgWriteTransfer	SetVariable	-	-	11	5	0	-	0x200000000000	IoSetEnvironmentVariableEx	2	0	[NtDeleteBootEntry->IoSetEnvironmentVariableEx]
319	NtSetBootEntryOrder	a9fdf37b-d72d-4051-a3cd-d422103ce079	Microsoft.Windows.Kernel.SysEnv		_tlgWriteTransfer	SetVariable	-	-	11	5	0	-	0x200000000000	IoSetEnvironmentVariableEx	2	0	[NtSetBootEntryOrder->IoSetEnvironmentVariableEx]
320	NtUnlockVirtualMemory	Windows Kernel Trace	PERF_0x28000001	MEMORY	EtwTraceKernelEvent	PAGE_ACCESS								MiDemoteCombinedPte	2	0	[NtUnlockVirtualMemory->MiDemoteCombinedPte]
321	NtUnlockVirtualMemory	Windows Kernel Trace	PERF_0x28000001	MEMORY	EtwTraceKernelEvent	PFMAPPED_SECTION_DELETE								MiLogCombinedPteDelete	3	0	[NtUnlockVirtualMemory->MiDemoteCombinedPte->MiLogCombinedPteDelete]
322	NtOpenFile	f39412d1-c9fd-5e79-8a82-9c9cbd8ca809	Microsoft.Windows.Kernel.ObjectManager		_tlgWriteTransfer	SymlinkTraversalBlocked	-	-	11	5	0	-	0x400000000000	ObpParseSymbolicLinkEx	5	0	[NtOpenFile->IopCreateFile->ObOpenObjectByNameEx->ObpLookupObjectName->ObpParseSymbolicLinkEx]
323	NtQueryKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteAgg									CmpBounceContextStart	2	0	[NtQueryKey->CmpBounceContextStart]
324	NtQueryKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		EtwWriteEx									CmpThreadInfoLogStack	3	0	[NtQueryKey->CmpIsRegistryLockAcquired->CmpThreadInfoLogStack]
325	NtAllocateVirtualMemory	f4e1897c-bb5d-5668-f1d8-040f4d8dd344	ThreatIntProviderGuid	EtwThreatIntProvRegHandle	EtwWrite									EtwTiLogAllocExecVm	4	0	[NtAllocateVirtualMemory->MiAllocateVirtualMemoryCommon->MiAllocateVirtualMemory->EtwTiLogAllocExecVm]
326	NtAllocateVirtualMemory	???			_tlgWriteEx	ProcessReserveMemFailed	-	-	11	5	0	-	0x400000000000	MiLogReserveVaFailed	5	0	[NtAllocateVirtualMemory->MiAllocateVirtualMemoryCommon->MiAllocateVirtualMemory->MiReserveUserMemory->MiLogReserveVaFailed]
327	NtAllocateVirtualMemory	Windows Kernel Trace	PERF_0x28000001	MEMORY	EtwTraceKernelEvent	PAGE_ACCESS_EX								MiCopyOnWrite	5	0	[NtAllocateVirtualMemory->MiAllocateVirtualMemoryCommon->MiAllocateVirtualMemory->MiSetProtectionOnSection->MiCopyOnWrite]
328	NtOpenJobObject	Windows Kernel Trace	PERF_0x80000	JOB	EtwTraceKernelEvent	JOB_OPEN								EtwTraceJob	2	0	[NtOpenJobObject->EtwTraceJob]
329	NtOpenJobObject	22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716	PsProvGuid	EtwpPsProvRegHandle	EtwWrite	JobTerminate	14	0	16	4	2	14	0x8000000000000400	EtwpPsProvTraceJob	3	0	[NtOpenJobObject->EtwTraceJob->EtwpPsProvTraceJob]
330	NtOpenJobObject	22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716	PsProvGuid	EtwpPsProvRegHandle	EtwWrite	JobStart	13	0	16	4	1	13	0x8000000000000400	EtwpPsProvTraceJob	3	0	[NtOpenJobObject->EtwTraceJob->EtwpPsProvTraceJob]
331	NtRestoreKey	70eb4f03-c1de-4f73-a051-33d13d5413bd	RegistryProvGuid	EtwpRegTraceHandle	EtwWrite									CmpTraceHiveRestoreStart	3	0	[NtRestoreKey->CmRestoreKey->CmpTraceHiveRestoreStart]
332	NtRestoreKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	HiveSelfHealed	-	-	11	5	0	-	0x400000000000	CmpCreateHive	3	0	[NtRestoreKey->CmRestoreKey->CmpCreateHive]
333	NtRestoreKey	70eb4f03-c1de-4f73-a051-33d13d5413bd	RegistryProvGuid	EtwpRegTraceHandle	EtwWrite									CmpTraceHiveRestoreStop	3	0	[NtRestoreKey->CmRestoreKey->CmpTraceHiveRestoreStop]
334	NtRestoreKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	UnsupportedOperation	-	-	11	5	0	-	0x0	CmpLogUnsupportedOperation	3	0	[NtRestoreKey->CmRestoreKey->CmpLogUnsupportedOperation]
335	NtRestoreKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		EtwWriteEx									CmpThreadInfoLogStack	3	0	[NtRestoreKey->CmpIsRegistryLockAcquired->CmpThreadInfoLogStack]
336	NtRestoreKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	HiveReorganizationValidationFailed	-	-	11	5	0	-	0x400000000000	CmpReorganizeHive	4	0	[NtRestoreKey->CmRestoreKey->CmpCreateHive->CmpReorganizeHive]
337	NtRestoreKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	HiveReorganizationResultedInDifferentKeyCount	-	-	11	5	0	-	0x400000000000	CmpReorganizeHive	4	0	[NtRestoreKey->CmRestoreKey->CmpCreateHive->CmpReorganizeHive]
338	NtRestoreKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	HiveReorganized	-	-	11	5	0	-	0x400000000000	CmpReorganizeHive	4	0	[NtRestoreKey->CmRestoreKey->CmpCreateHive->CmpReorganizeHive]
339	NtRestoreKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	HiveReorganizationFailed	-	-	11	5	0	-	0x400000000000	CmpReorganizeHive	4	0	[NtRestoreKey->CmRestoreKey->CmpCreateHive->CmpReorganizeHive]
340	NtRestoreKey	Windows Kernel Trace	REG_HIVE	REGISTRY	EtwTraceKernelEvent	REG_HIVE_INITIALIZE								CmpLogHiveInitializeEvent	4	0	[NtRestoreKey->CmRestoreKey->CmpCreateHive->CmpLogHiveInitializeEvent]
341	NtRestoreKey	Windows Kernel Trace	REG_HIVE	REGISTRY	EtwTraceKernelEvent	REG_HIVE_DIRTY								HvpMarkDirty	4	0	[NtRestoreKey->CmRestoreKey->HvpMarkCellDirty->HvpMarkDirty]
342	NtRestoreKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	UnsupportedOperation(Aggregate)	-	-	11	5	0	-	0x400000000000	CmpSendUnsupportedOperationTelemetryEvent	4	0	[NtRestoreKey->CmRestoreKey->CmpLogUnsupportedOperation->CmpSendUnsupportedOperationTelemetryEvent]
343	NtRestoreKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	HiveReorganizationValidationFailed	-	-	11	5	0	-	0x400000000000	CmpReorganizeHive	4	0	[NtRestoreKey->CmRestoreKey->CmpCreateHive->CmpReorganizeHive]
344	NtRestoreKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	HiveReorganizationResultedInDifferentKeyCount	-	-	11	5	0	-	0x400000000000	CmpReorganizeHive	4	0	[NtRestoreKey->CmRestoreKey->CmpCreateHive->CmpReorganizeHive]
345	NtRestoreKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	HiveReorganized	-	-	11	5	0	-	0x400000000000	CmpReorganizeHive	4	0	[NtRestoreKey->CmRestoreKey->CmpCreateHive->CmpReorganizeHive]
346	NtRestoreKey	e9eaf418-0c07-464c-ad14-a7f353349a00	Microsoft.Windows.Kernel.Registry		_tlgWriteTransfer	HiveReorganizationFailed	-	-	11	5	0	-	0x400000000000	CmpReorganizeHive	4	0	[NtRestoreKey->CmRestoreKey->CmpCreateHive->CmpReorganizeHive]
347	NtAccessCheckAndAuditAlarm	a68ca8b7-004f-d7b6-a698-07e2de0f1f5d	KernelProvGuid	EtwKernelProvRegHandle	EtwWrite	AccessCheckLog	14	0	0	2	0	0	0x20	SeLogAccessFailure	3	0	[NtAccessCheckAndAuditAlarm->SepAccessCheckAndAuditAlarm->SeLogAccessFailure]
348	NtAccessCheckAndAuditAlarm	45eec9e5-4a1b-5446-7ad8-a4ab1313c437	MS_Windows_Security_LPAC_Provider	EtwLpacProvRegHandle	EtwWrite	LpacAccessFailureLog	1	0	16	2	0	1	0x8000000000000000	EtwTraceLpacAccessFailure	4	0	[NtAccessCheckAndAuditAlarm->SepAccessCheckAndAuditAlarm->SepLogLpacAccessFailure->EtwTraceLpacAccessFailure]
349	NtInitiatePowerAction	Windows Kernel Trace	POWER	POWER	EtwTraceKernelEvent	SET_POWER_ACTION								PopExecutePowerAction	2	0	[NtInitiatePowerAction->PopExecutePowerAction]
350	NtInitiatePowerAction	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWrite	POP_ETW_EVENT_NTINITIATEPOWERACTION_API_CALL	187	0	8	4	0	243	0x8000400000000404	PopDiagTracePolicyInitiatePowerActionApiCall	2	0	[NtInitiatePowerAction->PopDiagTracePolicyInitiatePowerActionApiCall]
351	NtInitiatePowerAction	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWriteEx	POP_ETW_EVENT_SHUTDOWN_ACTION	109	0	8	4	0	103	0x8000400000000404	PopDiagTraceShutdownAction	3	0	[NtInitiatePowerAction->PopExecutePowerAction->PopDiagTraceShutdownAction]
352	NtInitiatePowerAction	63bca7a1-77ec-4ea7-95d0-98d3f0c0ebf7	Microsoft.Windows.Kernel.Power		_tlgWriteTransfer	ExecutePowerAction	-	-	11	5	0	-	0x800000000000	PopDiagTraceExecutePowerAction	3	0	[NtInitiatePowerAction->PopExecutePowerAction->PopDiagTraceExecutePowerAction]
353	NtInitiatePowerAction	331c3b3a-2005-44c2-ac5e-77220c37d6b4	POP_ETW_PROVIDER	PopDiagHandle	EtwWrite	POP_ETW_EVENT_EXECUTE_POWER_ACTION	555	1	16	4	0	257	0x4000000000000004	PopDiagTraceExecutePowerAction	3	0	[NtInitiatePowerAction->PopExecutePowerAction->PopDiagTraceExecutePowerAction]