Log Name:      System
Source:        Service Control Manager
Date:          14/11/2018 12:00:48 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Diagnostic System Host service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:30:48.354731500Z" />
    <EventRecordID>25429</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="296" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Diagnostic System Host</Data>
    <Data Name="param2">stopped</Data>
    <Binary>570064006900530079007300740065006D0048006F00730074002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:53:13 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Microsoft .NET Framework NGEN v4.0.30319_X86 service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:23:13.473532600Z" />
    <EventRecordID>25428</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="2352" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Microsoft .NET Framework NGEN v4.0.30319_X86</Data>
    <Data Name="param2">stopped</Data>
    <Binary>63006C0072005F006F007000740069006D0069007A006100740069006F006E005F00760034002E0030002E00330030003300310039005F00330032002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:52:22 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Windows Modules Installer service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:22:22.133842400Z" />
    <EventRecordID>25427</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1552" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Modules Installer</Data>
    <Data Name="param2">stopped</Data>
    <Binary>540072007500730074006500640049006E007300740061006C006C00650072002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:52:21 PM
Event ID:      7040
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      user-PC
Description:
The start type of the Windows Modules Installer service was changed from auto start to demand start.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7040</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:22:21.525441300Z" />
    <EventRecordID>25426</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1552" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="param1">Windows Modules Installer</Data>
    <Data Name="param2">auto start</Data>
    <Data Name="param3">demand start</Data>
    <Data Name="param4">TrustedInstaller</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:52:20 PM
Event ID:      7040
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      user-PC
Description:
The start type of the Windows Modules Installer service was changed from demand start to auto start.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7040</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:22:20.542639600Z" />
    <EventRecordID>25425</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1552" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="param1">Windows Modules Installer</Data>
    <Data Name="param2">demand start</Data>
    <Data Name="param3">auto start</Data>
    <Data Name="param4">TrustedInstaller</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:51:19 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Microsoft .NET Framework NGEN v4.0.30319_X64 service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:21:19.452932300Z" />
    <EventRecordID>25424</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1552" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Microsoft .NET Framework NGEN v4.0.30319_X64</Data>
    <Data Name="param2">stopped</Data>
    <Binary>63006C0072005F006F007000740069006D0069007A006100740069006F006E005F00760034002E0030002E00330030003300310039005F00360034002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:50:53 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Windows Installer service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:20:53.213686200Z" />
    <EventRecordID>25423</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="716" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Installer</Data>
    <Data Name="param2">stopped</Data>
    <Binary>6D00730069007300650072007600650072002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:50:20 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Application Experience service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:20:20.516028800Z" />
    <EventRecordID>25422</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1552" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Application Experience</Data>
    <Data Name="param2">stopped</Data>
    <Binary>410065004C006F006F006B00750070005300760063002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:48:00 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Adobe Flash Player Update Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:18:00.802183400Z" />
    <EventRecordID>25421</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="2352" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Adobe Flash Player Update Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>410064006F006200650046006C0061007300680050006C0061007900650072005500700064006100740065005300760063002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:48:00 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Adobe Flash Player Update Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:18:00.802183400Z" />
    <EventRecordID>25420</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1552" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Adobe Flash Player Update Service</Data>
    <Data Name="param2">running</Data>
    <Binary>410064006F006200650046006C0061007300680050006C0061007900650072005500700064006100740065005300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:47:02 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Multimedia Class Scheduler service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:17:02.799281400Z" />
    <EventRecordID>25419</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="2352" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Multimedia Class Scheduler</Data>
    <Data Name="param2">stopped</Data>
    <Binary>4D004D004300530053002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          13/11/2018 11:42:38 PM
Event ID:      18
Task Category: Automatic Updates
Level:         Information
Keywords:      Success,Download
User:          SYSTEM
Computer:      user-PC
Description:
Installation Ready: The following updates are downloaded and ready for installation. This computer is currently scheduled to install these updates on ?Wednesday, ?14 ?November ?2018 at 3:00 AM: 
- 2018-10 Security and Quality Rollup for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 for Windows 7 and Server 2008 R2 for x64 (KB4459922)
- Microsoft .NET Framework 4.7.2 for Windows 7 for x64 (KB4054530)
- 2018-09 Security and Quality Rollup for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 for Windows 7 and Server 2008 R2 for x64 (KB4457918)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>18</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>2</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000000014</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:12:38.132143300Z" />
    <EventRecordID>25418</EventRecordID>
    <Correlation />
    <Execution ProcessID="992" ThreadID="1764" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="schedinstalldate">?Wednesday, ?14 ?November ?2018</Data>
    <Data Name="schedinstalltime">3:00 AM</Data>
    <Data Name="updatelist">
- 2018-10 Security and Quality Rollup for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 for Windows 7 and Server 2008 R2 for x64 (KB4459922)
- Microsoft .NET Framework 4.7.2 for Windows 7 for x64 (KB4054530)
- 2018-09 Security and Quality Rollup for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 for Windows 7 and Server 2008 R2 for x64 (KB4457918)</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          13/11/2018 11:42:38 PM
Event ID:      18
Task Category: Automatic Updates
Level:         Information
Keywords:      Success,Download
User:          SYSTEM
Computer:      user-PC
Description:
Installation Ready: The following updates are downloaded and ready for installation. This computer is currently scheduled to install these updates on ?Wednesday, ?14 ?November ?2018 at 3:00 AM: 
- 2018-10 Security and Quality Rollup for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 for Windows 7 and Server 2008 R2 for x64 (KB4459922)
- Microsoft .NET Framework 4.7.2 for Windows 7 for x64 (KB4054530)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>18</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>2</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000000014</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:12:38.132143300Z" />
    <EventRecordID>25417</EventRecordID>
    <Correlation />
    <Execution ProcessID="992" ThreadID="1764" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="schedinstalldate">?Wednesday, ?14 ?November ?2018</Data>
    <Data Name="schedinstalltime">3:00 AM</Data>
    <Data Name="updatelist">
- 2018-10 Security and Quality Rollup for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 for Windows 7 and Server 2008 R2 for x64 (KB4459922)
- Microsoft .NET Framework 4.7.2 for Windows 7 for x64 (KB4054530)</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          13/11/2018 11:42:38 PM
Event ID:      18
Task Category: Automatic Updates
Level:         Information
Keywords:      Success,Download
User:          SYSTEM
Computer:      user-PC
Description:
Installation Ready: The following updates are downloaded and ready for installation. This computer is currently scheduled to install these updates on ?Wednesday, ?14 ?November ?2018 at 3:00 AM: 
- 2018-10 Security and Quality Rollup for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 for Windows 7 and Server 2008 R2 for x64 (KB4459922)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>18</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>2</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000000014</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:12:38.132143300Z" />
    <EventRecordID>25416</EventRecordID>
    <Correlation />
    <Execution ProcessID="992" ThreadID="1764" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="schedinstalldate">?Wednesday, ?14 ?November ?2018</Data>
    <Data Name="schedinstalltime">3:00 AM</Data>
    <Data Name="updatelist">
- 2018-10 Security and Quality Rollup for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 for Windows 7 and Server 2008 R2 for x64 (KB4459922)</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          13/11/2018 11:42:20 PM
Event ID:      28
Task Category: Windows Update Agent
Level:         Information
Keywords:      State
User:          SYSTEM
Computer:      user-PC
Description:
Automatic Updates is now resumed.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>28</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>16</Opcode>
    <Keywords>0x8000000000000080</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:12:20.578139300Z" />
    <EventRecordID>25415</EventRecordID>
    <Correlation />
    <Execution ProcessID="992" ThreadID="1764" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:42:20 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Windows Error Reporting Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:12:20.527136400Z" />
    <EventRecordID>25414</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="3944" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Error Reporting Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>5700650072005300760063002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:41:49 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Windows Modules Installer service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:11:49.532363600Z" />
    <EventRecordID>25413</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1732" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Modules Installer</Data>
    <Data Name="param2">running</Data>
    <Binary>540072007500730074006500640049006E007300740061006C006C00650072002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:40:16 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The MediaPortal 2 Server Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:10:16.460040100Z" />
    <EventRecordID>25412</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="3944" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">MediaPortal 2 Server Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>4D00500032002D005300650072007600650072002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:40:10 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The MediaPortal 2 Server Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:10:10.373692000Z" />
    <EventRecordID>25411</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="2352" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">MediaPortal 2 Server Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>4D00500032002D005300650072007600650072002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:40:04 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The MediaPortal 2 Server Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:10:04.308345100Z" />
    <EventRecordID>25410</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="2352" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">MediaPortal 2 Server Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>4D00500032002D005300650072007600650072002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:39:58 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The MediaPortal 2 Server Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:09:58.236997900Z" />
    <EventRecordID>25409</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="3944" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">MediaPortal 2 Server Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>4D00500032002D005300650072007600650072002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:39:52 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The MediaPortal 2 Server Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:09:52.178651300Z" />
    <EventRecordID>25408</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="3944" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">MediaPortal 2 Server Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>4D00500032002D005300650072007600650072002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:39:46 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The MediaPortal 2 Server Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:09:46.099303600Z" />
    <EventRecordID>25407</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="3700" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">MediaPortal 2 Server Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>4D00500032002D005300650072007600650072002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:39:40 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The MediaPortal 2 Server Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:09:40.038957000Z" />
    <EventRecordID>25406</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="3700" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">MediaPortal 2 Server Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>4D00500032002D005300650072007600650072002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:39:15 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Multimedia Class Scheduler service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:09:15.419949700Z" />
    <EventRecordID>25405</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="3700" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Multimedia Class Scheduler</Data>
    <Data Name="param2">running</Data>
    <Binary>4D004D004300530053002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:39:13 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The MediaPortal 2 Server Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:09:13.360746100Z" />
    <EventRecordID>25404</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="3944" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">MediaPortal 2 Server Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>4D00500032002D005300650072007600650072002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:39:07 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The MediaPortal 2 Server Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:09:07.276735400Z" />
    <EventRecordID>25403</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="3944" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">MediaPortal 2 Server Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>4D00500032002D005300650072007600650072002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:39:01 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The MediaPortal 2 Server Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:09:01.208324800Z" />
    <EventRecordID>25402</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1552" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">MediaPortal 2 Server Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>4D00500032002D005300650072007600650072002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:38:55 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The MediaPortal 2 Server Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:08:55.077514000Z" />
    <EventRecordID>25401</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="3944" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">MediaPortal 2 Server Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>4D00500032002D005300650072007600650072002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:38:48 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The MediaPortal 2 Server Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:08:48.962303300Z" />
    <EventRecordID>25400</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="3944" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">MediaPortal 2 Server Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>4D00500032002D005300650072007600650072002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:38:42 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The MediaPortal 2 Server Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:08:42.784692400Z" />
    <EventRecordID>25399</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1732" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">MediaPortal 2 Server Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>4D00500032002D005300650072007600650072002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:38:40 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Windows Error Reporting Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:08:40.179487800Z" />
    <EventRecordID>25398</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1732" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Error Reporting Service</Data>
    <Data Name="param2">running</Data>
    <Binary>5700650072005300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:38:35 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The MediaPortal 2 Server Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:08:35.421479500Z" />
    <EventRecordID>25397</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1732" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">MediaPortal 2 Server Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>4D00500032002D005300650072007600650072002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:38:29 PM
Event ID:      7045
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      user-PC
Description:
A service was installed in the system.

Service Name:  MediaPortal 2 Server Service
Service File Name:  "C:\Program Files (x86)\Team MediaPortal\MP2-Server\MP2-Server.exe"
Service Type:  user mode service
Service Start Type:  auto start
Service Account:  LocalSystem
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7045</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:08:29.103468400Z" />
    <EventRecordID>25396</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1732" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="ServiceName">MediaPortal 2 Server Service</Data>
    <Data Name="ImagePath">"C:\Program Files (x86)\Team MediaPortal\MP2-Server\MP2-Server.exe"</Data>
    <Data Name="ServiceType">user mode service</Data>
    <Data Name="StartType">auto start</Data>
    <Data Name="AccountName">LocalSystem</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:37:10 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Problem Reports and Solutions Control Panel Support service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:07:10.650930600Z" />
    <EventRecordID>25395</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1552" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Problem Reports and Solutions Control Panel Support</Data>
    <Data Name="param2">stopped</Data>
    <Binary>770065007200630070006C0073007500700070006F00720074002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:37:05 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Problem Reports and Solutions Control Panel Support service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:07:05.050520700Z" />
    <EventRecordID>25394</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1552" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Problem Reports and Solutions Control Panel Support</Data>
    <Data Name="param2">running</Data>
    <Binary>770065007200630070006C0073007500700070006F00720074002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:33:13 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Microsoft Software Shadow Copy Provider service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:03:13.592914200Z" />
    <EventRecordID>25393</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1732" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Microsoft Software Shadow Copy Provider</Data>
    <Data Name="param2">stopped</Data>
    <Binary>730077007000720076002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:33:02 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Windows Installer service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:03:02.953695500Z" />
    <EventRecordID>25392</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="3680" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Installer</Data>
    <Data Name="param2">running</Data>
    <Binary>6D00730069007300650072007600650072002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          13/11/2018 11:32:13 PM
Event ID:      28
Task Category: Windows Update Agent
Level:         Information
Keywords:      State
User:          SYSTEM
Computer:      user-PC
Description:
Automatic Updates is now resumed.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>28</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>16</Opcode>
    <Keywords>0x8000000000000080</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:02:13.454808600Z" />
    <EventRecordID>25391</EventRecordID>
    <Correlation />
    <Execution ProcessID="992" ThreadID="1764" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:32:08 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Windows Installer service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:02:08.540799900Z" />
    <EventRecordID>25390</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="3340" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Installer</Data>
    <Data Name="param2">stopped</Data>
    <Binary>6D00730069007300650072007600650072002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:31:27 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Microsoft .NET Framework NGEN v4.0.30319_X86 service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:01:27.731128300Z" />
    <EventRecordID>25389</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="3340" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Microsoft .NET Framework NGEN v4.0.30319_X86</Data>
    <Data Name="param2">running</Data>
    <Binary>63006C0072005F006F007000740069006D0069007A006100740069006F006E005F00760034002E0030002E00330030003300310039005F00330032002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:30:59 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Microsoft .NET Framework NGEN v4.0.30319_X64 service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:00:59.011477800Z" />
    <EventRecordID>25388</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="3452" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Microsoft .NET Framework NGEN v4.0.30319_X64</Data>
    <Data Name="param2">running</Data>
    <Binary>63006C0072005F006F007000740069006D0069007A006100740069006F006E005F00760034002E0030002E00330030003300310039005F00360034002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:30:41 PM
Event ID:      7045
Task Category: None
Level:         Information
Keywords:      Classic
User:          user-PC\user
Computer:      user-PC
Description:
A service was installed in the system.

Service Name:  ASP.NET State Service
Service File Name:  %SystemRoot%\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
Service Type:  user mode service
Service Start Type:  disabled
Service Account:  LocalSystem
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7045</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:00:41.586247200Z" />
    <EventRecordID>25387</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="3340" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="ServiceName">ASP.NET State Service</Data>
    <Data Name="ImagePath">%SystemRoot%\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe</Data>
    <Data Name="ServiceType">user mode service</Data>
    <Data Name="StartType">disabled</Data>
    <Data Name="AccountName">LocalSystem</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:30:38 PM
Event ID:      7045
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      user-PC
Description:
A service was installed in the system.

Service Name:  Microsoft .NET Framework NGEN v4.0.30319_X64
Service File Name:  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Service Type:  user mode service
Service Start Type:  auto start
Service Account:  LocalSystem
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7045</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:00:38.279041400Z" />
    <EventRecordID>25386</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="3340" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="ServiceName">Microsoft .NET Framework NGEN v4.0.30319_X64</Data>
    <Data Name="ImagePath">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe</Data>
    <Data Name="ServiceType">user mode service</Data>
    <Data Name="StartType">auto start</Data>
    <Data Name="AccountName">LocalSystem</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:30:37 PM
Event ID:      7045
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      user-PC
Description:
A service was installed in the system.

Service Name:  Microsoft .NET Framework NGEN v4.0.30319_X86
Service File Name:  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
Service Type:  user mode service
Service Start Type:  auto start
Service Account:  LocalSystem
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7045</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:00:37.842240600Z" />
    <EventRecordID>25385</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="3340" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="ServiceName">Microsoft .NET Framework NGEN v4.0.30319_X86</Data>
    <Data Name="ImagePath">C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe</Data>
    <Data Name="ServiceType">user mode service</Data>
    <Data Name="StartType">auto start</Data>
    <Data Name="AccountName">LocalSystem</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:30:36 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Multimedia Class Scheduler service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:00:36.886638700Z" />
    <EventRecordID>25384</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="3340" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Multimedia Class Scheduler</Data>
    <Data Name="param2">stopped</Data>
    <Binary>4D004D004300530053002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:30:13 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Volume Shadow Copy service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:00:13.588306200Z" />
    <EventRecordID>25383</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="3452" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Volume Shadow Copy</Data>
    <Data Name="param2">stopped</Data>
    <Binary>5600530053002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:30:01 PM
Event ID:      7040
Task Category: None
Level:         Information
Keywords:      Classic
User:          user-PC\user
Computer:      user-PC
Description:
The start type of the Microsoft .NET Framework NGEN v2.0.50727_X86 service was changed from auto start to disabled.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7040</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:00:01.224599000Z" />
    <EventRecordID>25382</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="3452" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="param1">Microsoft .NET Framework NGEN v2.0.50727_X86</Data>
    <Data Name="param2">auto start</Data>
    <Data Name="param3">disabled</Data>
    <Data Name="param4">clr_optimization_v2.0.50727_32</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:30:00 PM
Event ID:      7040
Task Category: None
Level:         Information
Keywords:      Classic
User:          user-PC\user
Computer:      user-PC
Description:
The start type of the Microsoft .NET Framework NGEN v2.0.50727_X64 service was changed from auto start to disabled.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7040</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T13:00:00.997586000Z" />
    <EventRecordID>25381</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="3452" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="param1">Microsoft .NET Framework NGEN v2.0.50727_X64</Data>
    <Data Name="param2">auto start</Data>
    <Data Name="param3">disabled</Data>
    <Data Name="param4">clr_optimization_v2.0.50727_64</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:29:52 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Windows Installer service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:59:52.867121000Z" />
    <EventRecordID>25380</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="3452" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Installer</Data>
    <Data Name="param2">running</Data>
    <Binary>6D00730069007300650072007600650072002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:28:49 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Software Protection service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:58:49.468494800Z" />
    <EventRecordID>25379</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1808" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Software Protection</Data>
    <Data Name="param2">stopped</Data>
    <Binary>7300700070007300760063002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          13/11/2018 11:27:47 PM
Event ID:      27
Task Category: Windows Update Agent
Level:         Information
Keywords:      State
User:          SYSTEM
Computer:      user-PC
Description:
Automatic Updates is now paused.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>27</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>16</Opcode>
    <Keywords>0x8000000000000080</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:57:47.120928700Z" />
    <EventRecordID>25378</EventRecordID>
    <Correlation />
    <Execution ProcessID="992" ThreadID="1764" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:27:44 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Microsoft .NET Framework NGEN v2.0.50727_X64 service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:57:44.333769300Z" />
    <EventRecordID>25377</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="3340" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Microsoft .NET Framework NGEN v2.0.50727_X64</Data>
    <Data Name="param2">stopped</Data>
    <Binary>63006C0072005F006F007000740069006D0069007A006100740069006F006E005F00760032002E0030002E00350030003700320037005F00360034002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:27:43 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Microsoft .NET Framework NGEN v2.0.50727_X86 service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:57:43.067696900Z" />
    <EventRecordID>25376</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="3340" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Microsoft .NET Framework NGEN v2.0.50727_X86</Data>
    <Data Name="param2">stopped</Data>
    <Binary>63006C0072005F006F007000740069006D0069007A006100740069006F006E005F00760032002E0030002E00350030003700320037005F00330032002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:27:42 PM
Event ID:      7040
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      user-PC
Description:
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7040</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:57:42.048638600Z" />
    <EventRecordID>25375</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1808" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="param1">Background Intelligent Transfer Service</Data>
    <Data Name="param2">demand start</Data>
    <Data Name="param3">auto start</Data>
    <Data Name="param4">BITS</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:27:41 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Background Intelligent Transfer Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:57:41.750621500Z" />
    <EventRecordID>25374</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1808" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Background Intelligent Transfer Service</Data>
    <Data Name="param2">running</Data>
    <Binary>42004900540053002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        volsnap
Date:          13/11/2018 11:26:58 PM
Event ID:      33
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The oldest shadow copy of volume C: was deleted to keep disk space usage for shadow copies of volume C: below the user defined limit.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="volsnap" />
    <EventID Qualifiers="16390">33</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:56:58.890170100Z" />
    <EventRecordID>25373</EventRecordID>
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>\Device\HarddiskVolumeShadowCopy1</Data>
    <Data>C:</Data>
    <Binary>00000000020030000000000021000640020000000000000000000000000000000000000000000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          13/11/2018 11:26:53 PM
Event ID:      27
Task Category: Windows Update Agent
Level:         Information
Keywords:      State
User:          SYSTEM
Computer:      user-PC
Description:
Automatic Updates is now paused.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>27</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>16</Opcode>
    <Keywords>0x8000000000000080</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:56:53.566865600Z" />
    <EventRecordID>25372</EventRecordID>
    <Correlation />
    <Execution ProcessID="992" ThreadID="1764" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:26:48 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Microsoft Software Shadow Copy Provider service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:56:48.851595900Z" />
    <EventRecordID>25371</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="3340" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Microsoft Software Shadow Copy Provider</Data>
    <Data Name="param2">running</Data>
    <Binary>730077007000720076002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:26:48 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Volume Shadow Copy service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:56:48.792592500Z" />
    <EventRecordID>25370</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="3340" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Volume Shadow Copy</Data>
    <Data Name="param2">running</Data>
    <Binary>5600530053002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:24:27 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Application Information service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:54:27.811413800Z" />
    <EventRecordID>25369</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1808" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Application Information</Data>
    <Data Name="param2">running</Data>
    <Binary>41007000700069006E0066006F002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Application-Experience
Date:          13/11/2018 11:24:26 PM
Event ID:      206
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The Program Compatibility Assistant service successfully performed phase two initialization.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Application-Experience" Guid="{EEF54E71-0661-422D-9A98-82FD4940B820}" />
    <EventID>206</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:54:26.891012200Z" />
    <EventRecordID>25368</EventRecordID>
    <Correlation />
    <Execution ProcessID="928" ThreadID="948" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:24:19 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Windows Connect Now - Config Registrar service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:54:19.512199300Z" />
    <EventRecordID>25367</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="2408" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Connect Now - Config Registrar</Data>
    <Data Name="param2">running</Data>
    <Binary>770063006E0063007300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-TerminalServices-Printers
Date:          13/11/2018 11:24:16 PM
Event ID:      1111
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
Driver Send to Microsoft OneNote 15 Driver required for printer Send To OneNote 2013 is unknown. Contact the administrator to install the driver before you log in again.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-TerminalServices-Printers" Guid="{952773BF-C2B7-49BC-88F4-920744B82C43}" EventSourceName="UmrdpService" />
    <EventID Qualifiers="0">1111</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:54:16.000000000Z" />
    <EventRecordID>25366</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Send to Microsoft OneNote 15 Driver</Data>
    <Data>Send To OneNote 2013</Data>
    <Binary>00000000A70E0000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-TerminalServices-Printers
Date:          13/11/2018 11:24:16 PM
Event ID:      1111
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
Driver Print to Evernote Driver required for printer Print to Evernote is unknown. Contact the administrator to install the driver before you log in again.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-TerminalServices-Printers" Guid="{952773BF-C2B7-49BC-88F4-920744B82C43}" EventSourceName="UmrdpService" />
    <EventID Qualifiers="0">1111</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:54:16.000000000Z" />
    <EventRecordID>25365</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Print to Evernote Driver</Data>
    <Data>Print to Evernote</Data>
    <Binary>00000000A70E0000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-TerminalServices-Printers
Date:          13/11/2018 11:24:16 PM
Event ID:      1111
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
Driver Microsoft XPS Document Writer v4 required for printer Microsoft XPS Document Writer is unknown. Contact the administrator to install the driver before you log in again.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-TerminalServices-Printers" Guid="{952773BF-C2B7-49BC-88F4-920744B82C43}" EventSourceName="UmrdpService" />
    <EventID Qualifiers="0">1111</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:54:16.000000000Z" />
    <EventRecordID>25364</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Microsoft XPS Document Writer v4</Data>
    <Data>Microsoft XPS Document Writer</Data>
    <Binary>00000000A70E0000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:24:14 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The HomeGroup Provider service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:54:14.847791100Z" />
    <EventRecordID>25363</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1808" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">HomeGroup Provider</Data>
    <Data Name="param2">running</Data>
    <Binary>48006F006D006500470072006F0075007000500072006F00760069006400650072002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:24:14 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Function Discovery Resource Publication service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:54:14.754190900Z" />
    <EventRecordID>25362</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="2408" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Function Discovery Resource Publication</Data>
    <Data Name="param2">running</Data>
    <Binary>460044005200650073005000750062002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:24:14 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Function Discovery Provider Host service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:54:14.410990300Z" />
    <EventRecordID>25361</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="2408" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Function Discovery Provider Host</Data>
    <Data Name="param2">running</Data>
    <Binary>66006400500048006F00730074002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-TerminalServices-Printers
Date:          13/11/2018 11:24:16 PM
Event ID:      1111
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
Driver Microsoft Print To PDF required for printer Microsoft Print to PDF is unknown. Contact the administrator to install the driver before you log in again.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-TerminalServices-Printers" Guid="{952773BF-C2B7-49BC-88F4-920744B82C43}" EventSourceName="UmrdpService" />
    <EventID Qualifiers="0">1111</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:54:16.000000000Z" />
    <EventRecordID>25360</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Microsoft Print To PDF</Data>
    <Data>Microsoft Print to PDF</Data>
    <Binary>00000000A70E0000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-TerminalServices-Printers
Date:          13/11/2018 11:24:15 PM
Event ID:      1111
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
Driver Foxit Reader PDF Printer Driver required for printer Foxit Reader PDF Printer is unknown. Contact the administrator to install the driver before you log in again.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-TerminalServices-Printers" Guid="{952773BF-C2B7-49BC-88F4-920744B82C43}" EventSourceName="UmrdpService" />
    <EventID Qualifiers="0">1111</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:54:15.000000000Z" />
    <EventRecordID>25359</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Foxit Reader PDF Printer Driver</Data>
    <Data>Foxit Reader PDF Printer</Data>
    <Binary>00000000A70E0000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-TerminalServices-Printers
Date:          13/11/2018 11:24:15 PM
Event ID:      1111
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
Driver Canon iX6800 series required for printer Canon iX6800 series WS is unknown. Contact the administrator to install the driver before you log in again.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-TerminalServices-Printers" Guid="{952773BF-C2B7-49BC-88F4-920744B82C43}" EventSourceName="UmrdpService" />
    <EventID Qualifiers="0">1111</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:54:15.000000000Z" />
    <EventRecordID>25358</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Canon iX6800 series</Data>
    <Data>Canon iX6800 series WS</Data>
    <Binary>00000000A70E0000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:24:13 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Network Connections service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:54:13.194188200Z" />
    <EventRecordID>25357</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="2408" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Network Connections</Data>
    <Data Name="param2">running</Data>
    <Binary>4E00650074006D0061006E002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-TerminalServices-Printers
Date:          13/11/2018 11:24:12 PM
Event ID:      1111
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
Driver Foxit PhantomPDF Printer Driver required for printer Foxit PhantomPDF Printer is unknown. Contact the administrator to install the driver before you log in again.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-TerminalServices-Printers" Guid="{952773BF-C2B7-49BC-88F4-920744B82C43}" EventSourceName="UmrdpService" />
    <EventID Qualifiers="0">1111</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:54:12.000000000Z" />
    <EventRecordID>25356</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Foxit PhantomPDF Printer Driver</Data>
    <Data>Foxit PhantomPDF Printer</Data>
    <Binary>00000000A70E0000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-TerminalServices-Printers
Date:          13/11/2018 11:24:12 PM
Event ID:      1111
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
Driver HP Photosmart 2570 series required for printer HP Photosmart 2570 series is unknown. Contact the administrator to install the driver before you log in again.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-TerminalServices-Printers" Guid="{952773BF-C2B7-49BC-88F4-920744B82C43}" EventSourceName="UmrdpService" />
    <EventID Qualifiers="0">1111</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:54:12.000000000Z" />
    <EventRecordID>25355</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>HP Photosmart 2570 series</Data>
    <Data>HP Photosmart 2570 series</Data>
    <Binary>00000000A70E0000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Winlogon
Date:          13/11/2018 11:24:03 PM
Event ID:      7001
Task Category: (1101)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
User Logon Notification for Customer Experience Improvement Program
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" />
    <EventID>7001</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>1101</Task>
    <Opcode>0</Opcode>
    <Keywords>0x2000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:54:03.537771200Z" />
    <EventRecordID>25354</EventRecordID>
    <Correlation />
    <Execution ProcessID="2344" ThreadID="2380" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="TSId">2</Data>
    <Data Name="UserSid">S-1-5-21-1074371277-1214576197-998651128-1000</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:24:00 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Shell Hardware Detection service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:54:00.292965500Z" />
    <EventRecordID>25353</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="2408" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Shell Hardware Detection</Data>
    <Data Name="param2">running</Data>
    <Binary>5300680065006C006C004800570044006500740065006300740069006F006E002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        TermDD
Date:          13/11/2018 11:23:56 PM
Event ID:      56
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Terminal Server security layer detected an error in the protocol stream and has disconnected the client. Client IP: 10.1.1.28.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="TermDD" />
    <EventID Qualifiers="49162">56</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:53:56.923359600Z" />
    <EventRecordID>25352</EventRecordID>
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>\Device\Termdd</Data>
    <Data>10.1.1.28</Data>
    <Binary>0000040002002C000000000038000AC00000000038000AC00000000000000000000000000000000002030980</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        BROWSER
Date:          13/11/2018 11:23:04 PM
Event ID:      8032
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{BEECF757-E108-4718-B991-F174CEE8BBBF}. The backup browser is stopping.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="BROWSER" />
    <EventID Qualifiers="49152">8032</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:53:04.000000000Z" />
    <EventRecordID>25351</EventRecordID>
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>\Device\NetBT_Tcpip_{BEECF757-E108-4718-B991-F174CEE8BBBF}</Data>
    <Binary>88080000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:23:03 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Intel(R) Management and Security Application User Notification Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:53:03.618066000Z" />
    <EventRecordID>25350</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1188" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Intel(R) Management and Security Application User Notification Service</Data>
    <Data Name="param2">running</Data>
    <Binary>55004E0053002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:23:03 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Windows Update service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:53:03.165665200Z" />
    <EventRecordID>25349</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1188" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Update</Data>
    <Data Name="param2">running</Data>
    <Binary>770075006100750073006500720076002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:23:00 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Windows Search service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:53:00.498060500Z" />
    <EventRecordID>25348</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1188" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Search</Data>
    <Data Name="param2">running</Data>
    <Binary>57005300650061007200630068002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:22:56 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The UPnP Device Host service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:52:56.613653700Z" />
    <EventRecordID>25347</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="2464" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">UPnP Device Host</Data>
    <Data Name="param2">running</Data>
    <Binary>750070006E00700068006F00730074002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WMPNSS-Service
Date:          13/11/2018 11:22:57 PM
Event ID:      14206
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
Media server 'USER-PC: user:' was successfully initialized and is sharing media with network media devices.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WMPNSS-Service" Guid="{6A2DC7C1-930A-4FB5-BB44-80B30AEBED6C}" EventSourceName="WMPNetworkSvc" />
    <EventID Qualifiers="16397">14206</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:52:57.000000000Z" />
    <EventRecordID>25346</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="FriendlyName">USER-PC: user:</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:22:55 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The SSDP Discovery service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:52:55.989652600Z" />
    <EventRecordID>25345</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="2464" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">SSDP Discovery</Data>
    <Data Name="param2">running</Data>
    <Binary>53005300440050005300520056002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:22:55 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Security Center service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:52:55.911652400Z" />
    <EventRecordID>25344</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="2464" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Security Center</Data>
    <Data Name="param2">running</Data>
    <Binary>7700730063007300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:22:55 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Windows Media Player Network Sharing Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:52:55.506051700Z" />
    <EventRecordID>25343</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="2464" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Media Player Network Sharing Service</Data>
    <Data Name="param2">running</Data>
    <Binary>57004D0050004E006500740077006F0072006B005300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:22:54 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Windows Defender service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:52:54.273649600Z" />
    <EventRecordID>25342</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="2464" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Defender</Data>
    <Data Name="param2">running</Data>
    <Binary>570069006E0044006500660065006E0064002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WMPNSS-Service
Date:          13/11/2018 11:22:55 PM
Event ID:      14204
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
Service 'WMPNetworkSvc' started.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WMPNSS-Service" Guid="{6A2DC7C1-930A-4FB5-BB44-80B30AEBED6C}" EventSourceName="WMPNetworkSvc" />
    <EventID Qualifiers="16397">14204</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:52:55.000000000Z" />
    <EventRecordID>25341</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ServiceName">WMPNetworkSvc</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:22:54 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Shell Hardware Detection service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:52:54.086449200Z" />
    <EventRecordID>25340</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="2464" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Shell Hardware Detection</Data>
    <Data Name="param2">stopped</Data>
    <Binary>5300680065006C006C004800570044006500740065006300740069006F006E002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:22:53 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Software Protection service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:52:53.696448500Z" />
    <EventRecordID>25339</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="2464" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Software Protection</Data>
    <Data Name="param2">running</Data>
    <Binary>7300700070007300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:22:53 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Portable Device Enumerator Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:52:53.493648200Z" />
    <EventRecordID>25338</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="2464" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Portable Device Enumerator Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>57005000440042007500730045006E0075006D002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:22:53 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Intel(R) Management and Security Application Local Management Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:52:53.353247900Z" />
    <EventRecordID>25337</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="2464" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Intel(R) Management and Security Application Local Management Service</Data>
    <Data Name="param2">running</Data>
    <Binary>4C004D0053002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:22:53 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Google Update Service (gupdate) service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:52:53.072447400Z" />
    <EventRecordID>25336</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="2464" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Google Update Service (gupdate)</Data>
    <Data Name="param2">stopped</Data>
    <Binary>67007500700064006100740065002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:22:52 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Google Update Service (gupdate) service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:52:52.978847300Z" />
    <EventRecordID>25335</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="2464" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Google Update Service (gupdate)</Data>
    <Data Name="param2">running</Data>
    <Binary>67007500700064006100740065002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:22:52 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Microsoft .NET Framework NGEN v2.0.50727_X64 service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:52:52.214445900Z" />
    <EventRecordID>25334</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="2464" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Microsoft .NET Framework NGEN v2.0.50727_X64</Data>
    <Data Name="param2">running</Data>
    <Binary>63006C0072005F006F007000740069006D0069007A006100740069006F006E005F00760032002E0030002E00350030003700320037005F00360034002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:22:51 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Microsoft .NET Framework NGEN v2.0.50727_X86 service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:52:51.528044700Z" />
    <EventRecordID>25333</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="2464" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Microsoft .NET Framework NGEN v2.0.50727_X86</Data>
    <Data Name="param2">running</Data>
    <Binary>63006C0072005F006F007000740069006D0069007A006100740069006F006E005F00760032002E0030002E00350030003700320037005F00330032002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:22:51 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Application Experience service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:52:51.309644300Z" />
    <EventRecordID>25332</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="2464" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Application Experience</Data>
    <Data Name="param2">running</Data>
    <Binary>410065004C006F006F006B00750070005300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        BROWSER
Date:          13/11/2018 11:22:04 PM
Event ID:      8021
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The browser service was unable to retrieve a list of servers from the browser master \\IMAGER on the network \Device\NetBT_Tcpip_{BEECF757-E108-4718-B991-F174CEE8BBBF}.
 
 Browser master: \\IMAGER
 Network: \Device\NetBT_Tcpip_{BEECF757-E108-4718-B991-F174CEE8BBBF}
 
 This event may be caused by a temporary loss of network connectivity. If this message appears again, verify that the server is still connected to the network. The return code is in the Data text box.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="BROWSER" />
    <EventID Qualifiers="32768">8021</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:52:04.000000000Z" />
    <EventRecordID>25331</EventRecordID>
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>\\IMAGER</Data>
    <Data>\Device\NetBT_Tcpip_{BEECF757-E108-4718-B991-F174CEE8BBBF}</Data>
    <Binary>88080000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:55 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Remote Desktop Services UserMode Port Redirector service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:55.370240700Z" />
    <EventRecordID>25330</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1964" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Remote Desktop Services UserMode Port Redirector</Data>
    <Data Name="param2">running</Data>
    <Binary>55006D0052006400700053006500720076006900630065002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:54 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The WinHTTP Web Proxy Auto-Discovery Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:54.356238900Z" />
    <EventRecordID>25329</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1188" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">WinHTTP Web Proxy Auto-Discovery Service</Data>
    <Data Name="param2">running</Data>
    <Binary>570069006E0048007400740070004100750074006F00500072006F00780079005300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:54 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The IPsec Policy Agent service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:54.044238400Z" />
    <EventRecordID>25328</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="672" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">IPsec Policy Agent</Data>
    <Data Name="param2">running</Data>
    <Binary>50006F006C006900630079004100670065006E0074002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:53 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Remote Desktop Configuration service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:53.560637500Z" />
    <EventRecordID>25327</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1188" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Remote Desktop Configuration</Data>
    <Data Name="param2">running</Data>
    <Binary>530065007300730069006F006E0045006E0076002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:53 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Certificate Propagation service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:53.545037500Z" />
    <EventRecordID>25326</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1188" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Certificate Propagation</Data>
    <Data Name="param2">running</Data>
    <Binary>4300650072007400500072006F0070005300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:53 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Windows Driver Foundation - User-mode Driver Framework service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:53.435837300Z" />
    <EventRecordID>25325</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1188" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Driver Foundation - User-mode Driver Framework</Data>
    <Data Name="param2">running</Data>
    <Binary>77007500640066007300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:53 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Computer Browser service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:53.170636800Z" />
    <EventRecordID>25324</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1964" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Computer Browser</Data>
    <Data Name="param2">running</Data>
    <Binary>420072006F0077007300650072002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:51 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Portable Device Enumerator Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:51.626834600Z" />
    <EventRecordID>25323</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="672" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Portable Device Enumerator Service</Data>
    <Data Name="param2">running</Data>
    <Binary>57005000440042007500730045006E0075006D002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:51 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Diagnostic System Host service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:51.066833800Z" />
    <EventRecordID>25322</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="672" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Diagnostic System Host</Data>
    <Data Name="param2">running</Data>
    <Binary>570064006900530079007300740065006D0048006F00730074002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:51 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Diagnostic Service Host service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:51.066833800Z" />
    <EventRecordID>25321</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="672" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Diagnostic Service Host</Data>
    <Data Name="param2">running</Data>
    <Binary>570064006900530065007200760069006300650048006F00730074002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:51 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Human Interface Device Access service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:51.056833800Z" />
    <EventRecordID>25320</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1964" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Human Interface Device Access</Data>
    <Data Name="param2">running</Data>
    <Binary>68006900640073006500720076002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:51 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Network List Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:51.056833800Z" />
    <EventRecordID>25319</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="1964" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Network List Service</Data>
    <Data Name="param2">running</Data>
    <Binary>6E0065007400700072006F0066006D002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:51 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Remote Desktop Services service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:51.056833800Z" />
    <EventRecordID>25318</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="820" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Remote Desktop Services</Data>
    <Data Name="param2">running</Data>
    <Binary>5400650072006D0053006500720076006900630065002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:51 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Network Location Awareness service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:51.046833700Z" />
    <EventRecordID>25317</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="820" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Network Location Awareness</Data>
    <Data Name="param2">running</Data>
    <Binary>4E006C0061005300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:50 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Server service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:50.146832500Z" />
    <EventRecordID>25316</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="820" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Server</Data>
    <Data Name="param2">running</Data>
    <Binary>4C0061006E006D0061006E005300650072007600650072002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:48 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Distributed Link Tracking Client service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:48.616830300Z" />
    <EventRecordID>25315</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="820" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Distributed Link Tracking Client</Data>
    <Data Name="param2">running</Data>
    <Binary>540072006B0057006B0073002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:48 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Superfetch service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:48.616830300Z" />
    <EventRecordID>25314</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="820" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Superfetch</Data>
    <Data Name="param2">running</Data>
    <Binary>5300790073004D00610069006E002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:48 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Diagnostics Tracking Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:48.486830200Z" />
    <EventRecordID>25313</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="820" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Diagnostics Tracking Service</Data>
    <Data Name="param2">running</Data>
    <Binary>440069006100670054007200610063006B002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:48 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Wireless Keyboard 850 Notification Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:48.366830000Z" />
    <EventRecordID>25312</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="692" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Wireless Keyboard 850 Notification Service</Data>
    <Data Name="param2">running</Data>
    <Binary>57006900720065006C006500730073004B0042003800350030004E006F00740069006600690063006100740069006F006E0053006500720076006900630065002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:48 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The IP Helper service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:48.366830000Z" />
    <EventRecordID>25311</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="692" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">IP Helper</Data>
    <Data Name="param2">running</Data>
    <Binary>6900700068006C0070007300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:48 PM
Event ID:      7000
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The FusionHDTV 88x, WDM DVB-T TvTuner (T7579+Zarlink) service failed to start due to the following error: 
The system cannot find the file specified.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="49152">7000</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:48.356830000Z" />
    <EventRecordID>25310</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="504" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">FusionHDTV 88x, WDM DVB-T TvTuner (T7579+Zarlink)</Data>
    <Data Name="param2">%%2</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:48 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Windows Management Instrumentation service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:48.356830000Z" />
    <EventRecordID>25309</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="820" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Management Instrumentation</Data>
    <Data Name="param2">running</Data>
    <Binary>570069006E006D0067006D0074002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:48 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Program Compatibility Assistant Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:48.346830000Z" />
    <EventRecordID>25308</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="820" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Program Compatibility Assistant Service</Data>
    <Data Name="param2">running</Data>
    <Binary>5000630061005300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Application-Experience
Date:          13/11/2018 11:20:48 PM
Event ID:      201
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The Program Compatibility Assistant service started successfully.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Application-Experience" Guid="{EEF54E71-0661-422D-9A98-82FD4940B820}" />
    <EventID>201</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:48.346830000Z" />
    <EventRecordID>25307</EventRecordID>
    <Correlation />
    <Execution ProcessID="928" ThreadID="1572" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:48 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Intel(R) PROSet Monitoring Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:48.346830000Z" />
    <EventRecordID>25306</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="692" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Intel(R) PROSet Monitoring Service</Data>
    <Data Name="param2">running</Data>
    <Binary>49006E00740065006C002800520029002000500052004F0053006500740020004D006F006E00690074006F00720069006E006700200053006500720076006900630065002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:48 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Diagnostic Policy Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:48.336829900Z" />
    <EventRecordID>25305</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="672" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Diagnostic Policy Service</Data>
    <Data Name="param2">running</Data>
    <Binary>4400500053002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:48 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The DokanMounter service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:48.336829900Z" />
    <EventRecordID>25304</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="672" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">DokanMounter</Data>
    <Data Name="param2">running</Data>
    <Binary>44006F006B0061006E004D006F0075006E007400650072002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:48 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Cryptographic Services service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:48.306829900Z" />
    <EventRecordID>25303</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="692" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Cryptographic Services</Data>
    <Data Name="param2">running</Data>
    <Binary>430072007900700074005300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:48 PM
Event ID:      7000
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The FusionHDTV 88x, WDM Crossbar service failed to start due to the following error: 
The system cannot find the file specified.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="49152">7000</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:48.306829900Z" />
    <EventRecordID>25302</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="504" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">FusionHDTV 88x, WDM Crossbar</Data>
    <Data Name="param2">%%2</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:48 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Workstation service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:48.306829900Z" />
    <EventRecordID>25301</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="692" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Workstation</Data>
    <Data Name="param2">running</Data>
    <Binary>4C0061006E006D0061006E0057006F0072006B00730074006100740069006F006E002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:48 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Windows Firewall service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:48.296829900Z" />
    <EventRecordID>25300</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="692" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Firewall</Data>
    <Data Name="param2">running</Data>
    <Binary>4D00700073005300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:48 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Base Filtering Engine service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:48.286829900Z" />
    <EventRecordID>25299</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="692" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Base Filtering Engine</Data>
    <Data Name="param2">running</Data>
    <Binary>4200460045002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:48 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Print Spooler service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:48.246829800Z" />
    <EventRecordID>25298</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="672" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Print Spooler</Data>
    <Data Name="param2">running</Data>
    <Binary>530070006F006F006C00650072002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:48 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Task Scheduler service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:48.236829800Z" />
    <EventRecordID>25297</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="672" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Task Scheduler</Data>
    <Data Name="param2">running</Data>
    <Binary>5300630068006500640075006C0065002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WLAN-AutoConfig
Date:          13/11/2018 11:20:48 PM
Event ID:      10000
Task Category: None
Level:         Error
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
WLAN Extensibility Module has failed to start.

Module Path: C:\Windows\system32\Rtlihvs.dll
Error Code: 126

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WLAN-AutoConfig" Guid="{9580D7DD-0379-4658-9870-D5BE7D52D6DE}" />
    <EventID>10000</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:48.106829600Z" />
    <EventRecordID>25296</EventRecordID>
    <Correlation />
    <Execution ProcessID="928" ThreadID="1208" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="ExtensibleModulePath">C:\Windows\system32\Rtlihvs.dll</Data>
    <Data Name="ErrorCode">126</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:48 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Shell Hardware Detection service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:48.086829600Z" />
    <EventRecordID>25295</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="672" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Shell Hardware Detection</Data>
    <Data Name="param2">running</Data>
    <Binary>5300680065006C006C004800570044006500740065006300740069006F006E002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WLAN-AutoConfig
Date:          13/11/2018 11:20:48 PM
Event ID:      4000
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
WLAN AutoConfig service has successfully started.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WLAN-AutoConfig" Guid="{9580D7DD-0379-4658-9870-D5BE7D52D6DE}" />
    <EventID>4000</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>1</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:48.086829600Z" />
    <EventRecordID>25294</EventRecordID>
    <Correlation />
    <Execution ProcessID="928" ThreadID="1208" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:48 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The WLAN AutoConfig service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:48.086829600Z" />
    <EventRecordID>25293</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="672" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">WLAN AutoConfig</Data>
    <Data Name="param2">running</Data>
    <Binary>57006C0061006E007300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:48 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Extensible Authentication Protocol service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:48.066829600Z" />
    <EventRecordID>25292</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="672" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Extensible Authentication Protocol</Data>
    <Data Name="param2">running</Data>
    <Binary>45006100700048006F00730074002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:47 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The DNS Client service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.895628800Z" />
    <EventRecordID>25291</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="672" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">DNS Client</Data>
    <Data Name="param2">running</Data>
    <Binary>44006E007300630061006300680065002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:47 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The CNG Key Isolation service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.895628800Z" />
    <EventRecordID>25290</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="672" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">CNG Key Isolation</Data>
    <Data Name="param2">running</Data>
    <Binary>4B0065007900490073006F002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:47 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The DHCP Client service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.880028700Z" />
    <EventRecordID>25289</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="672" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">DHCP Client</Data>
    <Data Name="param2">running</Data>
    <Binary>44006800630070002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DHCPv6-Client
Date:          13/11/2018 11:20:47 PM
Event ID:      51046
Task Category: Service State Event
Level:         Information
Keywords:      
User:          LOCAL SERVICE
Computer:      user-PC
Description:
DHCPv6 client service is started
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DHCPv6-Client" Guid="{6A1F2B00-6A90-4C38-95A5-5CAB3B056778}" />
    <EventID>51046</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>62</Opcode>
    <Keywords>0x2000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.880028700Z" />
    <EventRecordID>25288</EventRecordID>
    <Correlation />
    <Execution ProcessID="876" ThreadID="1096" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Dhcp-Client
Date:          13/11/2018 11:20:47 PM
Event ID:      50036
Task Category: Service State Event
Level:         Information
Keywords:      
User:          LOCAL SERVICE
Computer:      user-PC
Description:
DHCPv4 client service is started
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Dhcp-Client" Guid="{15A7A4F8-0072-4EAB-ABAD-F98A4D666AED}" />
    <EventID>50036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>68</Opcode>
    <Keywords>0x2000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.880028700Z" />
    <EventRecordID>25287</EventRecordID>
    <Correlation />
    <Execution ProcessID="876" ThreadID="1076" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:47 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The TCP/IP NetBIOS Helper service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.880028700Z" />
    <EventRecordID>25286</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="672" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">TCP/IP NetBIOS Helper</Data>
    <Data Name="param2">running</Data>
    <Binary>6C006D0068006F007300740073002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:47 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Network Store Interface Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.880028700Z" />
    <EventRecordID>25285</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="672" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Network Store Interface Service</Data>
    <Data Name="param2">running</Data>
    <Binary>6E00730069002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:47 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Security Accounts Manager service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.848828700Z" />
    <EventRecordID>25284</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="672" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Security Accounts Manager</Data>
    <Data Name="param2">running</Data>
    <Binary>530061006D00530073002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:47 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Desktop Window Manager Session Manager service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.848828700Z" />
    <EventRecordID>25283</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="820" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Desktop Window Manager Session Manager</Data>
    <Data Name="param2">running</Data>
    <Binary>5500780053006D0073002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:47 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The System Event Notification Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.848828700Z" />
    <EventRecordID>25282</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="820" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">System Event Notification Service</Data>
    <Data Name="param2">running</Data>
    <Binary>530045004E0053002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:47 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The COM+ Event System service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.848828700Z" />
    <EventRecordID>25281</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="820" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">COM+ Event System</Data>
    <Data Name="param2">running</Data>
    <Binary>4500760065006E007400530079007300740065006D002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:47 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Offline Files service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.848828700Z" />
    <EventRecordID>25280</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="820" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Offline Files</Data>
    <Data Name="param2">running</Data>
    <Binary>43007300630053006500720076006900630065002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:47 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Group Policy Client service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.848828700Z" />
    <EventRecordID>25279</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="672" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Group Policy Client</Data>
    <Data Name="param2">running</Data>
    <Binary>670070007300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:47 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The User Profile Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.848828700Z" />
    <EventRecordID>25278</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="820" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">User Profile Service</Data>
    <Data Name="param2">running</Data>
    <Binary>500072006F0066005300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:47 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Themes service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.833228700Z" />
    <EventRecordID>25277</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="672" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Themes</Data>
    <Data Name="param2">running</Data>
    <Binary>5400680065006D00650073002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:47 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Windows Audio service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.817628600Z" />
    <EventRecordID>25276</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="672" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Audio</Data>
    <Data Name="param2">running</Data>
    <Binary>41007500640069006F005300720076002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:47 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Windows Audio Endpoint Builder service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.770828500Z" />
    <EventRecordID>25275</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="672" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Audio Endpoint Builder</Data>
    <Data Name="param2">running</Data>
    <Binary>41007500640069006F0045006E00640070006F0069006E0074004200750069006C006400650072002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:47 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Multimedia Class Scheduler service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.646028300Z" />
    <EventRecordID>25274</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="672" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Multimedia Class Scheduler</Data>
    <Data Name="param2">running</Data>
    <Binary>4D004D004300530053002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:47 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Windows Font Cache Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.630428300Z" />
    <EventRecordID>25273</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="672" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Font Cache Service</Data>
    <Data Name="param2">running</Data>
    <Binary>46006F006E007400430061006300680065002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:47 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Windows Event Log service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.614828300Z" />
    <EventRecordID>25272</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="672" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Event Log</Data>
    <Data Name="param2">running</Data>
    <Binary>6500760065006E0074006C006F0067002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:47 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Remote Procedure Call (RPC) service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.552428200Z" />
    <EventRecordID>25271</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="692" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Remote Procedure Call (RPC)</Data>
    <Data Name="param2">running</Data>
    <Binary>520070006300530073002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:47 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The RPC Endpoint Mapper service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.536828100Z" />
    <EventRecordID>25270</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="692" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">RPC Endpoint Mapper</Data>
    <Data Name="param2">running</Data>
    <Binary>5200700063004500700074004D00610070007000650072002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:47 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The DCOM Server Process Launcher service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.490028100Z" />
    <EventRecordID>25269</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="692" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">DCOM Server Process Launcher</Data>
    <Data Name="param2">running</Data>
    <Binary>440063006F006D004C00610075006E00630068002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-FilterManager
Date:          13/11/2018 11:20:47 PM
Event ID:      6
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
File System Filter 'luafv' (6.1, ?2017?-?10?-?12T10:50:09.000000000Z) has successfully loaded and registered with Filter Manager.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-FilterManager" Guid="{F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}" />
    <EventID>6</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.490028100Z" />
    <EventRecordID>25268</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="52" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="FinalStatus">0x0</Data>
    <Data Name="DeviceVersionMajor">6</Data>
    <Data Name="DeviceVersionMinor">1</Data>
    <Data Name="DeviceNameLength">5</Data>
    <Data Name="DeviceName">luafv</Data>
    <Data Name="DeviceTime">2017-10-12T10:50:09.000000000Z</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:47 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Power service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.474428000Z" />
    <EventRecordID>25267</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="692" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Power</Data>
    <Data Name="param2">running</Data>
    <Binary>50006F007700650072002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-UserPnp
Date:          13/11/2018 11:20:47 PM
Event ID:      20010
Task Category: (7010)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
One or more of the Plug and Play service's subsystems has changed state. 

PlugPlay install subsystem enabled: 'true' 
PlugPlay caching subsystem enabled: 'true' 

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-UserPnp" Guid="{96F4A050-7E31-453C-88BE-9634F4E02139}" />
    <EventID>20010</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>7010</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.458828000Z" />
    <EventRecordID>25266</EventRecordID>
    <Correlation />
    <Execution ProcessID="700" ThreadID="716" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <INFO_PNP_STATE xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://manifests.microsoft.com/win/2004/08/windows/userpnp">
      <InstallSubsystemState>true</InstallSubsystemState>
      <CachingSubsystemState>true</CachingSubsystemState>
    </INFO_PNP_STATE>
  </UserData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:20:47 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Plug and Play service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.458828000Z" />
    <EventRecordID>25265</EventRecordID>
    <Correlation />
    <Execution ProcessID="500" ThreadID="692" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Plug and Play</Data>
    <Data Name="param2">running</Data>
    <Binary>50006C007500670050006C00610079002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-PnP
Date:          13/11/2018 11:20:44 PM
Event ID:      219
Task Category: (212)
Level:         Warning
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The driver \Driver\WUDFRd failed to load for the device {C5A047D8-CB5B-40E9-B9E3-316AB06B5A18}\WirelessKeyboardFilter\9&154ffa24&0&01.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-PnP" Guid="{9C205A39-1250-487D-ABD7-E831C6290539}" />
    <EventID>219</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>212</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:44.650823100Z" />
    <EventRecordID>25264</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="56" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="DriverNameLength">77</Data>
    <Data Name="DriverName">{C5A047D8-CB5B-40E9-B9E3-316AB06B5A18}\WirelessKeyboardFilter\9&amp;154ffa24&amp;0&amp;01</Data>
    <Data Name="Status">3221226341</Data>
    <Data Name="FailureNameLength">14</Data>
    <Data Name="FailureName">\Driver\WUDFRd</Data>
    <Data Name="Version">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DriverFrameworks-UserMode
Date:          13/11/2018 11:20:44 PM
Event ID:      10114
Task Category: Startup of the UMDF reflector
Level:         Information
Keywords:      (2)
User:          SYSTEM
Computer:      user-PC
Description:
The UMDF reflector was unable to complete startup because the WUDFPf service was not found.  This service may be started later during boot, at which point Windows will attempt to start the device again.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DriverFrameworks-UserMode" Guid="{2E35AAEB-857F-4BEB-A418-2E6C0E54D988}" />
    <EventID>10114</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>101</Task>
    <Opcode>0</Opcode>
    <Keywords>0x2000000000000002</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:44.650823100Z" />
    <EventRecordID>25263</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="56" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <UMDFReflectorDependencyMissing xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://www.microsoft.com/DriverFrameworks/UserMode/Event">
      <Dependency>WUDFPf</Dependency>
    </UMDFReflectorDependencyMissing>
  </UserData>
</Event>

Log Name:      System
Source:        e1cexpress
Date:          13/11/2018 11:20:44 PM
Event ID:      27
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The description for Event ID 27 from source e1cexpress cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event: 

Intel(R) 82579LM Gigabit Network Connection

The resource loader failed to find MUI file

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="e1cexpress" />
    <EventID Qualifiers="40964">27</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:44.182822200Z" />
    <EventRecordID>25262</EventRecordID>
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data>Intel(R) 82579LM Gigabit Network Connection</Data>
    <Binary>0000040002003000000000001B0004A00000000000000000000000000000000000000000000000001B0004A0</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Directory-Services-SAM
Date:          13/11/2018 11:20:42 PM
Event ID:      16962
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
Remote calls to the SAM database are being restricted using the default security descriptor: .
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Directory-Services-SAM" Guid="{0D4FDC09-8C27-494A-BDA0-505E4FD8ADAE}" />
    <EventID>16962</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:42.669619600Z" />
    <EventRecordID>25261</EventRecordID>
    <Correlation />
    <Execution ProcessID="520" ThreadID="524" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData Name="SAMMSG_RESTRICT_REMOTE_SAM_DEFAULT_SD">
    <Data Name="Default SD String:">
    </Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Processor-Power
Date:          13/11/2018 11:20:41 PM
Event ID:      26
Task Category: (4)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
Processor 3 in group 0 exposes the following:

3 idle state(s)
10 performance state(s)
8 throttle state(s)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Processor-Power" Guid="{0F67E49F-FE51-4E9F-B490-6F2948CC6027}" />
    <EventID>26</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:41.858418200Z" />
    <EventRecordID>25260</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="64" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="Group">0</Data>
    <Data Name="Number">3</Data>
    <Data Name="IdleStateCount">3</Data>
    <Data Name="PerfStateCount">10</Data>
    <Data Name="ThrottleStateCount">8</Data>
    <ComplexData Name="IdleState">010203</ComplexData>
    <ComplexData Name="PerfState">1D0C0000640000001C0C000063000000540B00005D0000008C0A000057000000C409000050000000FC0800004A00000034080000430000006C0700003D000000A4060000360000004006000033000000</ComplexData>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Processor-Power
Date:          13/11/2018 11:20:41 PM
Event ID:      26
Task Category: (4)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
Processor 2 in group 0 exposes the following:

3 idle state(s)
10 performance state(s)
8 throttle state(s)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Processor-Power" Guid="{0F67E49F-FE51-4E9F-B490-6F2948CC6027}" />
    <EventID>26</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:41.858418200Z" />
    <EventRecordID>25259</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="64" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="Group">0</Data>
    <Data Name="Number">2</Data>
    <Data Name="IdleStateCount">3</Data>
    <Data Name="PerfStateCount">10</Data>
    <Data Name="ThrottleStateCount">8</Data>
    <ComplexData Name="IdleState">010203</ComplexData>
    <ComplexData Name="PerfState">1D0C0000640000001C0C000063000000540B00005D0000008C0A000057000000C409000050000000FC0800004A00000034080000430000006C0700003D000000A4060000360000004006000033000000</ComplexData>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Processor-Power
Date:          13/11/2018 11:20:41 PM
Event ID:      26
Task Category: (4)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
Processor 1 in group 0 exposes the following:

3 idle state(s)
10 performance state(s)
8 throttle state(s)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Processor-Power" Guid="{0F67E49F-FE51-4E9F-B490-6F2948CC6027}" />
    <EventID>26</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:41.858418200Z" />
    <EventRecordID>25258</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="64" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="Group">0</Data>
    <Data Name="Number">1</Data>
    <Data Name="IdleStateCount">3</Data>
    <Data Name="PerfStateCount">10</Data>
    <Data Name="ThrottleStateCount">8</Data>
    <ComplexData Name="IdleState">010203</ComplexData>
    <ComplexData Name="PerfState">1D0C0000640000001C0C000063000000540B00005D0000008C0A000057000000C409000050000000FC0800004A00000034080000430000006C0700003D000000A4060000360000004006000033000000</ComplexData>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Processor-Power
Date:          13/11/2018 11:20:41 PM
Event ID:      26
Task Category: (4)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
Processor 0 in group 0 exposes the following:

3 idle state(s)
10 performance state(s)
8 throttle state(s)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Processor-Power" Guid="{0F67E49F-FE51-4E9F-B490-6F2948CC6027}" />
    <EventID>26</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:41.858418200Z" />
    <EventRecordID>25257</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="64" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="Group">0</Data>
    <Data Name="Number">0</Data>
    <Data Name="IdleStateCount">3</Data>
    <Data Name="PerfStateCount">10</Data>
    <Data Name="ThrottleStateCount">8</Data>
    <ComplexData Name="IdleState">010203</ComplexData>
    <ComplexData Name="PerfState">1D0C0000640000001C0C000063000000540B00005D0000008C0A000057000000C409000050000000FC0800004A00000034080000430000006C0700003D000000A4060000360000004006000033000000</ComplexData>
  </EventData>
</Event>

Log Name:      System
Source:        MEIx64
Date:          13/11/2018 11:20:37 PM
Event ID:      2
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The description for Event ID 2 from source MEIx64 cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event: 


The resource loader failed to find MUI file

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MEIx64" />
    <EventID Qualifiers="16391">2</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:37.786811000Z" />
    <EventRecordID>25256</EventRecordID>
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Binary>00000000010000000000000002000740000000000000000000000000000000000000000000000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Power
Date:          13/11/2018 11:20:36 PM
Event ID:      41
Task Category: (63)
Level:         Critical
Keywords:      (2)
User:          SYSTEM
Computer:      user-PC
Description:
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
    <EventID>41</EventID>
    <Version>2</Version>
    <Level>1</Level>
    <Task>63</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000002</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:36.164408200Z" />
    <EventRecordID>25255</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="8" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="BugcheckCode">0</Data>
    <Data Name="BugcheckParameter1">0x0</Data>
    <Data Name="BugcheckParameter2">0x0</Data>
    <Data Name="BugcheckParameter3">0x0</Data>
    <Data Name="BugcheckParameter4">0x0</Data>
    <Data Name="SleepInProgress">false</Data>
    <Data Name="PowerButtonTimestamp">131865869728089963</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-FilterManager
Date:          13/11/2018 11:20:31 PM
Event ID:      6
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
File System Filter 'FileInfo' (6.1, ?2009?-?07?-?14T10:04:25.000000000Z) has successfully loaded and registered with Filter Manager.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-FilterManager" Guid="{F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}" />
    <EventID>6</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:31.843200600Z" />
    <EventRecordID>25254</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="8" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="FinalStatus">0x0</Data>
    <Data Name="DeviceVersionMajor">6</Data>
    <Data Name="DeviceVersionMinor">1</Data>
    <Data Name="DeviceNameLength">8</Data>
    <Data Name="DeviceName">FileInfo</Data>
    <Data Name="DeviceTime">2009-07-14T10:04:25.000000000Z</Data>
  </EventData>
</Event>

Log Name:      System
Source:        EventLog
Date:          13/11/2018 11:20:47 PM
Event ID:      6013
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The system uptime is 16 seconds.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="EventLog" />
    <EventID Qualifiers="32768">6013</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.000000000Z" />
    <EventRecordID>25253</EventRecordID>
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>16</Data>
    <Data>60</Data>
    <Data>-570 Cen. Australia Standard Time</Data>
    <Binary>31002E003100000030000000570069006E0064006F0077007300200037002000500072006F00660065007300730069006F006E0061006C00000036002E0031002E00370036003000310020004200750069006C006400200037003600300031002000530065007200760069006300650020005000610063006B002000310000004D0075006C0074006900700072006F0063006500730073006F00720020004600720065006500000037003600300031002E00770069006E0037007300700031005F006C00640072002E003100380030003900300038002D00300036003000300000003500380066006200340031006600300000004E006F007400200041007600610069006C00610062006C00650000004E006F007400200041007600610069006C00610062006C0065000000390000003400000033003900380035000000630030003900000075007300650072002D005000430000000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        EventLog
Date:          13/11/2018 11:20:47 PM
Event ID:      6005
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Event log service was started.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="EventLog" />
    <EventID Qualifiers="32768">6005</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.000000000Z" />
    <EventRecordID>25252</EventRecordID>
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Binary>E2070B0002000D000C0032002F0066020000000000000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        EventLog
Date:          13/11/2018 11:20:47 PM
Event ID:      6009
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="EventLog" />
    <EventID Qualifiers="32768">6009</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.000000000Z" />
    <EventRecordID>25251</EventRecordID>
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>6.01.</Data>
    <Data>7601</Data>
    <Data>Service Pack 1</Data>
    <Data>Multiprocessor Free</Data>
    <Data>17514</Data>
  </EventData>
</Event>

Log Name:      System
Source:        EventLog
Date:          13/11/2018 11:20:47 PM
Event ID:      6008
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The previous system shutdown at 11:18:44 PM on ?13/?11/?2018 was unexpected.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="EventLog" />
    <EventID Qualifiers="32768">6008</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:47.000000000Z" />
    <EventRecordID>25250</EventRecordID>
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>11:18:44 PM</Data>
    <Data>?13/?11/?2018</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>1819</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Binary>E2070B0002000D00170012002C009501E2070B0002000D000C0030002C009501600900003C000000010000006009000000000000B00400000100000000000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          13/11/2018 11:20:31 PM
Event ID:      12
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
The operating system started at system time ?2018?-?11?-?13T12:50:31.109999300Z.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>12</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:50:31.593600100Z" />
    <EventRecordID>25249</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="8" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="MajorVersion">6</Data>
    <Data Name="MinorVersion">1</Data>
    <Data Name="BuildVersion">7601</Data>
    <Data Name="QfeVersion">24260</Data>
    <Data Name="ServiceVersion">1</Data>
    <Data Name="BootMode">0</Data>
    <Data Name="StartTime">2018-11-13T12:50:31.109999300Z</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Winlogon
Date:          13/11/2018 11:19:08 PM
Event ID:      7002
Task Category: (1102)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      user-PC
Description:
User Logoff Notification for Customer Experience Improvement Program
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" />
    <EventID>7002</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>1102</Task>
    <Opcode>0</Opcode>
    <Keywords>0x2000000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:49:08.972154400Z" />
    <EventRecordID>25248</EventRecordID>
    <Correlation />
    <Execution ProcessID="2216" ThreadID="4036" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="TSId">2</Data>
    <Data Name="UserSid">S-1-5-21-1074371277-1214576197-998651128-1000</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:19:06 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Multimedia Class Scheduler service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:49:06.089804300Z" />
    <EventRecordID>25247</EventRecordID>
    <Correlation />
    <Execution ProcessID="516" ThreadID="3620" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Multimedia Class Scheduler</Data>
    <Data Name="param2">running</Data>
    <Binary>4D004D004300530053002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:18:51 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Problem Reports and Solutions Control Panel Support service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:48:51.597378800Z" />
    <EventRecordID>25246</EventRecordID>
    <Correlation />
    <Execution ProcessID="516" ThreadID="2704" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Problem Reports and Solutions Control Panel Support</Data>
    <Data Name="param2">stopped</Data>
    <Binary>770065007200630070006C0073007500700070006F00720074002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:18:45 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Problem Reports and Solutions Control Panel Support service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:48:45.934568900Z" />
    <EventRecordID>25245</EventRecordID>
    <Correlation />
    <Execution ProcessID="516" ThreadID="2704" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Problem Reports and Solutions Control Panel Support</Data>
    <Data Name="param2">running</Data>
    <Binary>770065007200630070006C0073007500700070006F00720074002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:18:10 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Multimedia Class Scheduler service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:48:10.004705600Z" />
    <EventRecordID>25244</EventRecordID>
    <Correlation />
    <Execution ProcessID="516" ThreadID="3732" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Multimedia Class Scheduler</Data>
    <Data Name="param2">stopped</Data>
    <Binary>4D004D004300530053002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:15:03 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Microsoft .NET Framework NGEN v2.0.50727_X86 service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:45:03.017010500Z" />
    <EventRecordID>25243</EventRecordID>
    <Correlation />
    <Execution ProcessID="516" ThreadID="2704" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Microsoft .NET Framework NGEN v2.0.50727_X86</Data>
    <Data Name="param2">running</Data>
    <Binary>63006C0072005F006F007000740069006D0069007A006100740069006F006E005F00760032002E0030002E00350030003700320037005F00330032002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:15:02 PM
Event ID:      7040
Task Category: None
Level:         Information
Keywords:      Classic
User:          user-PC\user
Computer:      user-PC
Description:
The start type of the Microsoft .NET Framework NGEN v2.0.50727_X86 service was changed from demand start to auto start.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7040</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:45:02.674991000Z" />
    <EventRecordID>25242</EventRecordID>
    <Correlation />
    <Execution ProcessID="516" ThreadID="3284" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="param1">Microsoft .NET Framework NGEN v2.0.50727_X86</Data>
    <Data Name="param2">demand start</Data>
    <Data Name="param3">auto start</Data>
    <Data Name="param4">clr_optimization_v2.0.50727_32</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:15:02 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Microsoft .NET Framework NGEN v2.0.50727_X64 service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:45:02.378974000Z" />
    <EventRecordID>25241</EventRecordID>
    <Correlation />
    <Execution ProcessID="516" ThreadID="3284" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Microsoft .NET Framework NGEN v2.0.50727_X64</Data>
    <Data Name="param2">running</Data>
    <Binary>63006C0072005F006F007000740069006D0069007A006100740069006F006E005F00760032002E0030002E00350030003700320037005F00360034002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:15:02 PM
Event ID:      7040
Task Category: None
Level:         Information
Keywords:      Classic
User:          user-PC\user
Computer:      user-PC
Description:
The start type of the Microsoft .NET Framework NGEN v2.0.50727_X64 service was changed from demand start to auto start.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7040</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:45:02.061955900Z" />
    <EventRecordID>25240</EventRecordID>
    <Correlation />
    <Execution ProcessID="516" ThreadID="2704" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="param1">Microsoft .NET Framework NGEN v2.0.50727_X64</Data>
    <Data Name="param2">demand start</Data>
    <Data Name="param3">auto start</Data>
    <Data Name="param4">clr_optimization_v2.0.50727_64</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:14:52 PM
Event ID:      7040
Task Category: None
Level:         Information
Keywords:      Classic
User:          user-PC\user
Computer:      user-PC
Description:
The start type of the Microsoft .NET Framework NGEN v2.0.50727_X86 service was changed from disabled to demand start.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7040</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:44:52.621415900Z" />
    <EventRecordID>25239</EventRecordID>
    <Correlation />
    <Execution ProcessID="516" ThreadID="2704" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="param1">Microsoft .NET Framework NGEN v2.0.50727_X86</Data>
    <Data Name="param2">disabled</Data>
    <Data Name="param3">demand start</Data>
    <Data Name="param4">clr_optimization_v2.0.50727_32</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:14:52 PM
Event ID:      7040
Task Category: None
Level:         Information
Keywords:      Classic
User:          user-PC\user
Computer:      user-PC
Description:
The start type of the Microsoft .NET Framework NGEN v2.0.50727_X64 service was changed from disabled to demand start.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7040</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:44:52.294397200Z" />
    <EventRecordID>25238</EventRecordID>
    <Correlation />
    <Execution ProcessID="516" ThreadID="2704" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security UserID="S-1-5-21-1074371277-1214576197-998651128-1000" />
  </System>
  <EventData>
    <Data Name="param1">Microsoft .NET Framework NGEN v2.0.50727_X64</Data>
    <Data Name="param2">disabled</Data>
    <Data Name="param3">demand start</Data>
    <Data Name="param4">clr_optimization_v2.0.50727_64</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:14:42 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The ASP.NET State Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:44:42.410831900Z" />
    <EventRecordID>25237</EventRecordID>
    <Correlation />
    <Execution ProcessID="516" ThreadID="2704" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">ASP.NET State Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>6100730070006E00650074005F00730074006100740065002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:14:08 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Microsoft Software Shadow Copy Provider service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:44:08.393886300Z" />
    <EventRecordID>25236</EventRecordID>
    <Correlation />
    <Execution ProcessID="516" ThreadID="2704" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Microsoft Software Shadow Copy Provider</Data>
    <Data Name="param2">stopped</Data>
    <Binary>730077007000720076002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          13/11/2018 11:13:43 PM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      user-PC
Description:
The Windows Installer service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2018-11-13T12:43:43.894485000Z" />
    <EventRecordID>25235</EventRecordID>
    <Correlation />
    <Execution ProcessID="516" ThreadID="2704" />
    <Channel>System</Channel>
    <Computer>user-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Installer</Data>
    <Data Name="param2">running</Data>
    <Binary>6D00730069007300650072007600650072002F0034000000</Binary>
  </EventData>
</Event>