| AppReadiness.dll | 1011 | Admin |
| AppXDeploymentServer.dll | 1011 | Microsoft-Windows-AppXDeploymentServer/Diagnostic |
| AppxPackaging.dll | 8.11011 | Microsoft-Windows-AppxPackaging/Operational |
| AudioSes.dll | 78.11011 | Application |
| AuthHost.exe | 8.11011 | Operational |
| AxInstSv.dll | 1011 | Application |
| AzureSettingSyncProvider.dll | 10 | Microsoft-Windows-SettingSync-Azure/Operational |
| BTHUSB.SYS | 1011 | Microsoft-Windows-BTH-BTHUSB/Operational |
| BdeHdCfgLib.dll | 1011 | Microsoft-Windows-BitLocker-DrivePreparationTool/Admin |
| BlbEvents.dll | 1011 | Application |
| BrowserCore.exe | 11 | Microsoft-Windows-AAD/Operational |
| CapabilityAccessManager.dll | 1011 | Operational |
| CellularApi.dll | 10 | CellularAPI Debug Channel |
| CertEnroll.dll | 78.11011 | Application |
| CertPolEng.dll | 78.11011 | Operation log |
| CloudRestoreLauncher.dll | 1011 | Microsoft-Windows-CloudRestoreLauncher/Operational |
| CloudStorageWizard.exe | 8.1 | Microsoft-Windows-CloudStorageWizard/Operational |
| DAMM.dll | 10 | Microsoft-Windows-DAMM/Diagnostic |
| DFDTS.dll | 1011 | System |
| DFDWiz.exe | 1011 | System |
| DaOtpCredentialProvider.dll | 8.11011 | Microsoft-Windows-OtpCredentialProvider/Operational |
| DeviceUpdateAgent.dll | 1011 | Device Update Agent operational channel |
| DiagCpl.dll | 1011 | Microsoft-Windows-DiagCpl/Debug |
| DocumentPerformanceEvents.dll | 1011 | Performance |
| DucUpdateAgent.dll | 10 | Duc Update Agent operational channel |
| EhStorAuthn.exe | 78.11011 | System |
| EhStorTcgDrv.sys | 1011 | System |
| FrameServer.dll | 10 | Media Foundation FrameServer |
| FrameServer.dll | 11 | Camera FrameServer |
| GeofenceMonitorService.dll | 8.1 | Automation |
| IdCtrls.dll | 8.11011 | Microsoft-Windows-IdCtrls/Operational |
| IdListen.dll | 78.110 | Operation log |
| KdsCli.dll | 1011 | Microsoft-Windows-KdsSvc/Operational |
| LocationNotifications.exe | 78.1 | Application |
| MFCaptureEngine.dll | 8.11011 | Media Foundation Capture Engine ETW Channel |
| MFCore.dll | 8.11011 | Media Foundation Performance Core |
| ManageCI.dll | 1011 | Microsoft-Windows-DeviceGuard/Operational |
| MdSched.exe | 1011 | System |
| MemoryDiagnostic.dll | 1011 | System |
| Microsoft.Bluetooth.Profiles.HidOverGatt.dll | 1011 | Microsoft-Bluetooth-Profiles-HidOverGatt/Operational |
| Microsoft.Uev.AgentDriverEvents.dll | 1011 | Debug |
| Microsoft.Uev.EventLogMessages.dll | 1011 | Analytic |
| Microsoft.Windows.ApplicationServer.Applications.dll | 8.11011 | Operational |
| MitigationClient.dll | 1011 | Admin |
| MsSpellCheckingFacility.dll | 8.11011 | System |
| MsSpellCheckingHost.exe | 8.1 | Application |
| NcdAutoSetup.dll | 1011 | Microsoft-Windows-NcdAutoSetup/Operational |
| NdisImPlatform.sys | 8.11011 | Microsoft-Windows-NdisImPlatform/Operational |
| NetCellcoreCellManagerProviderResources.dll | 10 | CellManager Debug Channel |
| NetSetupSvc.dll | 1011 | Microsoft-Windows-Network-Setup/Diagnostic |
| OcpUpdateAgent.dll | 10 | Ocp Update Agent operational channel |
| OneBackupHandler.dll | 1011 | Microsoft-Windows-OneBackup/Debug |
| PSEvents.dll | 78.11011 | Microsoft-Windows-PowerShell/Analytic |
| PackageStateRoaming.dll | 8.110 | Microsoft-Windows-PackageStateRoaming/Operational |
| PeerDist.dll | 78.11011 | Microsoft-Windows-BranchCache/Operational |
| PeerDistSvc.dll | 1011 | Microsoft-Windows-BranchCache/Operational |
| PrintBrmEngine.exe | 1011 | Admin |
| QAgentRT.dll | 78.1 | Microsoft-Windows-NetworkAccessProtection/Operational |
| RDXService.dll | 1011 | Admin |
| RTWorkQ.dll | 8.11011 | RTWorkQueue Threading |
| RdpAvenc.dll | 11 | Microsoft-Windows-Rdp-Graphics-RdpAvenc/Operational |
| RdpLite.dll | 11 | Microsoft-Windows-Rdp-Graphics-RdpLite/Operational |
| RelPost.exe | 1011 | System |
| ResetEngine.dll | 11 | System |
| RpcEpMap.dll | 1011 | Debug |
| SMCCx.dll | 1011 | System |
| ScDeviceEnum.dll | 8.11011 | Microsoft-Windows-SmartCard-DeviceEnum/Operational |
| SensorPerformanceEvents.dll | 1011 | Performance |
| SettingSyncCore.dll | 8.110 | Microsoft-Windows-SettingSync/Operational |
| SmsRouterSvc.dll | 1011 | SmsRouter Operational Channel |
| SrEvents.dll | 1011 | Application |
| SystemEventsBrokerServer.dll | 1011 | Debug |
| TSWorkspace.dll | 78.11011 | Application |
| TimeBrokerServer.dll | 1011 | Debug |
| TpmCoreProvisioning.dll | 1011 | System |
| USBHUB3.SYS | 1011 | This is the Analytic channel to which internal Analytic events from the USBHUB3 driver are sent. |
| USBXHCI.SYS | 1011 | This is the Analytic channel to which internal Analytic events from the USBXHCI driver are sent. |
| UsbccidDriver.dll | 1011 | System |
| UserSettingsBackup.BackupUnitProcessor.dll | 1011 | Microsoft-Windows-UserSettingsBackup-BackupUnitProcessor/Operational |
| VAN.dll | 78.110 | Microsoft-Windows-VAN/Diagnostic |
| VaultRoaming.dll | 8.11011 | Microsoft-Windows-GenericRoaming/Admin |
| WLanConn.dll | 78.110 | Microsoft-Windows-WlanConn/Diagnostic |
| WUDFUsbccidDriver.dll | 1011 | System |
| WWAHost.exe | 8.11011 | Admin |
| WerFault.exe | 78.11011 | Operational |
| WinMgmtR.dll | 1011 | Application |
| WinREAgent.dll | 1011 | System |
| WinSAT.exe | 1011 | Application |
| WinSCard.dll | 8.11011 | Microsoft-Windows-SmartCard-Audit/Authentication |
| Windows.CloudStore.EarlyDownloader.dll | 11 | Microsoft-Windows-UserSettingsBackup-EarlyDownloader/Operational |
| Windows.CloudStore.Schema.DesktopShell.dll | 1011 | Microsoft-Windows-UserSettingsBackup-Orchestrator/Operational |
| Windows.CloudStore.dll | 1011 | Microsoft-Windows-CloudStore/Operational |
| Windows.Management.SecureAssessment.Diagnostics.dll | 1011 | Operational |
| Windows.Media.Editing.dll | 1011 | EditingOperationalChannel |
| Windows.Security.Credentials.UI.UserConsentVerifier.dll | 8.11011 | Microsoft-Windows-Security-UserConsentVerifier/Audit |
| Windows.StateRepository.dll | 1011 | Microsoft-Windows-StateRepository/Diagnostic |
| WsmRes.dll | 78.11011 | Microsoft-Windows-WinRM/Operational |
| WudfSMCClassExt.dll | 1011 | System |
| XAudio2_8.dll | 8.1 | Microsoft Windows XAudio2 performance metrics |
| XAudio2_9.dll | 1011 | Microsoft Windows XAudio2 performance metrics |
| aadWamExtension.dll | 1011 | Microsoft-Windows-AAD/Operational |
| aadcloudap.dll | 1011 | Microsoft-Windows-AAD/Operational |
| adtschema.dll | 78.11011 | Security |
| aeevts.dll | 8.11011 | Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug |
| aeevts.dll | 7 | System |
| afd.sys | 1011 | Microsoft-Windows-Winsock Catalog Change/Operational |
| agilevpn.sys | 1011 | Notification Channel |
| ajrouter.dll | 10 | Operational |
| apds.dll | 78.11011 | Microsoft-Windows-Help/Operational |
| apphelp.dll | 78.11011 | Application |
| appidapi.dll | 78.1 | Microsoft-Windows-AppID/Operational |
| appinfo.dll | 1011 | Microsoft-Windows-LUA-ConsentUI/Diagnostic |
| appraiser.dll | 1011 | Microsoft-Windows-Compat-Appraiser/Analytic |
| auditcse.dll | 1011 | Microsoft-Windows-Security-Audit-Configuration-Client/Operational |
| authui.dll | 78.1 | Microsoft-Windows-Authentication User Interface/Operational |
| autopilotdiag.dll | 1011 | Admin |
| bcrypt.dll | 8.11011 | Microsoft-Windows-Crypto-BCrypt/Analytic |
| bfe.dll | 8.11011 | BFE IPsec Connections Operational Log |
| bthserv.dll | 1011 | Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational |
| capauthz.dll | 1011 | Operational |
| certcli.dll | 78.11011 | Application |
| chartv.dll | 8.1 | Microsoft-Windows-Diagnosis-CV/Debug |
| ci.dll | 1011 | Microsoft-Windows-CodeIntegrity/Operational |
| clfs.sys | 11 | System |
| clusapi.dll | 1011 | System |
| clusapi.dll | 78.1 | Microsoft-Windows-FailoverClustering-Client/Diagnostic |
| cofiredm.dll | 1011 | System |
| comdlg32.dll | 78.11011 | Debug |
| credprovhost.dll | 1011 | Microsoft-Windows-Authentication User Interface/Operational |
| crypt32.dll | 78.11011 | Application |
| cscsvc.dll | 1011 | System |
| cxwmbclass.sys | 1011 | Windows Mobile Broadband Class Driver Channel |
| das.dll | 11 | System |
| ddputils.dll | 1011 | Application |
| deviceaccess.dll | 8.1 | System |
| dhcpcore.dll | 78.11011 | Microsoft-Windows-DHCP Client Events/Operational |
| dhcpcore6.dll | 78.11011 | Microsoft-Windows-DHCPv6 Client Events/Admin |
| dhcpcsvc6.dll | 78.11011 | Microsoft-Windows-DHCPv6 Client Events/Admin |
| dhcpsapi.dll | 78.11011 | Microsoft-Windows-DHCP Server Events/FilterNotifications |
| diagperf.dll | 1011 | Operational |
| dimsjob.dll | 78.11011 | Application |
| dimsroam.dll | 78.11011 | Application |
| dmenterprisediagnostics.dll | 1011 | Admin |
| dmvsc.sys | 1011 | Microsoft-Hyper-V-Guest-Drivers-Diagnose |
| dosvc.dll | 1011 | Application |
| dot3mm.dll | 10 | Microsoft-Windows-Dot3MM/Diagnostic |
| dot3svc.dll | 78.11011 | Microsoft-Windows-Wired-AutoConfig/Operational |
| dps.dll | 1011 | Microsoft-Windows-Diagnosis-DPS/Debug |
| drt.dll | 78.110 | Microsoft-Windows-PeerToPeerDrtEventProvider/DiagnosticChannel |
| dssenh.dll | 8.11011 | Microsoft-Windows-Crypto-DSSEnh/Analytic |
| eapsvc.dll | 1011 | Application |
| efscore.dll | 78.11011 | Application |
| efswrt.dll | 8.1 | Application |
| elshyph.dll | 8.1 | Application |
| eqossnap.dll | 8.11011 | Microsoft-Windows-Policy-based QoS/Operational |
| fcon.dll | 1011 | Analytic |
| fdPHost.dll | 1011 | System |
| fdeploy.dll | 78.11011 | Application |
| fdrespub.dll | 1011 | System |
| fltmgr.sys | 1011 | System |
| fms.dll | 78.11011 | System |
| fthsvc.dll | 71011 | System |
| fveapi.dll | 1011 | System |
| fvevol.sys | 1011 | System |
| gpsvc.dll | 78.11011 | System |
| hgcpl.dll | 78.11011 | Microsoft-Windows-HomeGroup Control Panel/Operational |
| hvloader.dll | 11 | System |
| hvservice.sys | 10 | System |
| hvsievaluator.exe | 1011 | Operational |
| hvsigpext.dll | 1011 | Operational |
| intl.cpl | 78.11011 | Operational |
| iphlpsvc.dll | 78.11011 | Iphlpsvc Etw Channel |
| ipxlatcfg.dll | 1011 | Operational Channel |
| l2nacp.dll | 78.11011 | Microsoft-Windows-L2NACP/Diagnostic |
| listsvc.dll | 78.110 | Microsoft-Windows-HomeGroup Listener Service/Operational |
| loadperf.dll | 78.11011 | Application |
| localspl.dll | 1011 | Admin |
| locationframework.dll | 1011 | Debug |
| lpdsvc.dll | 1011 | System |
| lpksetup.exe | 1011 | System |
| lsm.dll | 1011 | System |
| luafv.sys | 1011 | Microsoft-Windows-UAC-FileVirtualization/Operational |
| mciavi32.dll | 78.11011 | Application |
| mf.dll | 8.11011 | Media Foundation DeviceProxy |
| mf.dll | 7 | Media Foundation Pipeline |
| mfmediaengine.dll | 8.11011 | Media Foundation MediaEngine |
| mfplat.dll | 78.11011 | Media Foundation Platform |
| microsoft-windows-hal-events.dll | 1011 | System |
| microsoft-windows-kernel-cc-events.dll | 11 | Operational |
| microsoft-windows-kernel-pnp-events.dll | 1011 | System |
| microsoft-windows-kernel-processor-power-events.dll | 1011 | System |
| microsoft-windows-storage-tiering-events.dll | 1011 | Tiering Heat Measurement Channel |
| microsoft-windows-system-events.dll | 1011 | Microsoft-Windows-Kernel-WDI/Analytic |
| mrxsmb.sys | 1011 | Microsoft-Windows-SMBClient/HelperClassDiagnostic |
| msdt.exe | 78.11011 | Microsoft-Windows-Diagnosis-MSDE/Debug |
| mslldp.sys | 1011 | Microsoft-Windows-LinkLayerDiscoveryProtocol/Operational |
| msoobedui.dll | 1011 | Microsoft-Windows-OOBE-Machine-DUI/Operational |
| msra.exe | 78.11011 | Application |
| mstscax.dll | 78.11011 | Application |
| msvideodsp.dll | 8.1 | MS Video DSP |
| msvproc.dll | 8.1 | MS Video Processor MFT |
| mup.sys | 10 | Microsoft-Windows-NetworkProvider/Operational |
| mup.sys | 11 | System |
| ncrypt.dll | 8.11011 | Microsoft-Windows-Crypto-NCrypt/Operational |
| ncsi.dll | 1011 | Microsoft-Windows-NCSI/Analytic |
| ndis.sys | 1011 | Microsoft-Windows-NDIS/Operational |
| ndisuio.sys | 1011 | WWAN NDISUIO Channel |
| netdiagfx.dll | 78.11011 | Microsoft-Windows-Diagnostics-Networking/Operational |
| netevent.dll | 78.11011 | System |
| netprofm.dll | 7 | Microsoft-Windows-NetworkProfile/Diagnostic |
| netprofmsvc.dll | 8.11011 | Microsoft-Windows-NetworkProfile/Diagnostic |
| netshell.dll | 7 | Microsoft-Windows-NetworkLocationWizard/Operational |
| nettrace.dll | 1011 | Microsoft-Windows-Networking-Correlation/Diagnostic |
| nlasvc.dll | 78.110 | Microsoft-Windows-NlaSvc/Diagnostic |
| ntasn1.dll | 8.11011 | Microsoft-Windows-ASN1/Operational |
| ntevt.dll | 1011 | Debug |
| ntprint.dll | 78.11011 | Admin |
| nwifi.sys | 1011 | Microsoft-Windows-NWiFi/Diagnostic |
| onex.dll | 78.11011 | Microsoft-Windows-OneX/Diagnostic |
| osbaseln.dll | 78.11011 | Microsoft-Windows-Service Reporting API/Debug |
| pautoenr.dll | 78.11011 | Application |
| pcaevts.dll | 1011 | Analytic |
| pcrpf.dll | 11 | System |
| pcwum.dll | 78.11011 | Microsoft-Windows-Diagnosis-PCW/Operational |
| pdh.dll | 11 | Application |
| perfctrs.dll | 78.110 | Application |
| perfdisk.dll | 1011 | Application |
| perfhost.exe | 78.11011 | Microsoft-Windows-Diagnosis-Perfhost/Analytic |
| perfnet.dll | 78.11011 | Application |
| perfos.dll | 78.11011 | Application |
| perfproc.dll | 78.11011 | Application |
| pla.dll | 78.11011 | Microsoft-Windows-Diagnosis-PLA/Operational |
| pnidui.dll | 710 | Microsoft-Windows-NetworkLocationWizard/Operational |
| pots.dll | 78.11011 | System |
| profsvc.dll | 1011 | Application |
| provcore.dll | 8.11011 | Microsoft-Windows-NetworkProvisioning/Analytic |
| provdiagnostics.dll | 1011 | Admin |
| provsvc.dll | 78.110 | Microsoft-Windows-HomeGroup Provider Service/Operational |
| pshed.dll | 78.11011 | System |
| pwlauncher.dll | 1011 | System |
| qdvd.dll | 1011 | DVD Navigator |
| qmgr.dll | 78.11011 | System |
| quartz.dll | 78.11011 | Application |
| racengn.dll | 78.11011 | Operational |
| radardt.dll | 78.11011 | System |
| radarrs.dll | 78.11011 | Microsoft-Windows-Resource-Exhaustion-Resolver/Operational |
| rdbss.sys | 1011 | Microsoft-Windows-Remotefs-Rdbss/Diagnostic |
| rdpcorets.dll | 1011 | Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational |
| rdrleakdiag.exe | 78.11011 | Microsoft-Windows-Resource-Leak-Diagnostic/Operational |
| reagent.dll | 78.11011 | System |
| refs.sys | 1011 | System |
| refsdedupsvc.exe | 11 | Microsoft-Windows-ReFsDedupSvc/Operational |
| refsv1.sys | 1011 | System |
| reseteng.dll | 10 | System |
| rpchttp.dll | 78.1 | Debug |
| rpcrt4.dll | 78.11011 | EEInfo |
| rsaenh.dll | 8.11011 | Microsoft-Windows-Crypto-RSAEnh/Analytic |
| rstrtmgr.dll | 78.11011 | Application |
| rtutils.dll | 1011 | Notification Channel |
| schedsvc.dll | 78.11011 | Operational |
| sdiageng.dll | 78.11011 | Microsoft-Windows-Diagnosis-Scripted/Operational |
| sdiagprv.dll | 78.11011 | Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational |
| sens.dll | 71011 | Debug |
| setupapi.dll | 78.11011 | System |
| shell32.dll | 7 | Microsoft-Windows-Known Folders Operational |
| shell32.dll | 8.1 | Microsoft-Windows-Known Folders/Operational |
| slcext.dll | 1011 | Application |
| smbdirect.sys | 10 | Microsoft-Windows-SMBDirect/Debug |
| sndvolsso.dll | 78.11011 | Performance |
| sppcext.dll | 1011 | Application |
| sppsvc.exe | 1011 | Application |
| srpapi.dll | 1011 | Microsoft-Windows-AppID/Operational |
| srv2.sys | 1011 | Microsoft-Windows-SMBServer/Analytic |
| sysmain.dll | 1011 | Operational |
| taskmgr.exe | 7 | Microsoft-Windows-Diagnosis-TaskManager/Debug |
| tbssvc.dll | 7 | System |
| termsrv.dll | 78.11011 | System |
| timedate.cpl | 78.11011 | Operational |
| tpm.sys | 1011 | System |
| tpmvsc.dll | 1011 | Microsoft-Windows-SmartCard-TPM-VCard-Module/Admin |
| tquery.dll | 1011 | Application |
| tsusbflt.sys | 1011 | Admin |
| tsusbhub.sys | 1011 | Admin |
| tunnel.sys | 1011 | Tunnel Driver Etw Channel |
| twinui.appcore.dll | 1011 | Application |
| twinui.dll | 8.1 | Application |
| tzsyncres.dll | 1011 | Analytic |
| tzutil.exe | 78.11011 | Operational |
| umpnpmgr.dll | 78.11011 | System |
| umrdp.dll | 1011 | Admin |
| usbmon.dll | 1011 | Debug |
| user32.dll | 8.11011 | System |
| usercpl.dll | 8.11011 | Microsoft-Windows-User Control Panel/Operational |
| userenv.dll | 78.11011 | Application |
| vdrvroot.sys | 1011 | Microsoft-Windows-VHDMP/Operational |
| vhdmp.sys | 1011 | Microsoft-Windows-VHDMP/Operational |
| w32time.dll | 1011 | System |
| wbiosrvc.dll | 1011 | Microsoft-Windows-Biometrics/Operational |
| wcmsvc.dll | 1011 | Operational |
| wcncsvc.dll | 78.11011 | Microsoft-Windows-WCN-Config-Registrar/Diagnostic |
| wecsvc.dll | 78.11011 | Application |
| wephostsvc.dll | 1011 | Operational |
| wevtapi.dll | 1011 | TraceLogging |
| wevtfwd.dll | 78.11011 | Operational |
| wevtsvc.dll | 1011 | System |
| whealogr.dll | 71011 | System |
| win32_tpm.dll | 78.1 | System |
| windows.storage.dll | 1011 | Microsoft-Windows-Known Folders/Operational |
| wininit.exe | 78.11011 | System |
| winlogon.exe | 1011 | System |
| winsetup.dll | 1011 | System |
| winspool.drv | 78.11011 | Admin |
| winsrvext.dll | 11 | System |
| wlanmm.dll | 8.110 | Microsoft-Windows-WLAN-MediaManager/Diagnostic |
| wlansvc.dll | 78.11011 | Microsoft-Windows-WLAN-AutoConfig/Operational |
| wldp.dll | 1011 | Microsoft-Windows-VerifyHardwareSecurity/Operational |
| wlidres.dll | 8.11011 | Microsoft-Windows-LiveId/Operational |
| wof.sys | 1011 | System |
| workfolderssvc.dll | 10 | Operational |
| wpd_ci.dll | 1011 | Operational |
| wpnapps.dll | 8.11011 | Microsoft-Windows-PushNotifications-Developer/Debug |
| wpncore.dll | 1011 | Microsoft-Windows-PushNotifications-Platform/Operational |
| ws2_32.dll | 78.11011 | Microsoft-Windows-Winsock Catalog Change/Operational |
| wuaueng.dll | 1011 | System |
| wuauengcore.dll | 11 | System |
| wudfplatform.dll | 1011 | Operational |
| wwanconn.dll | 10 | Microsoft-Windows-WWAN-CFE/Diagnostic |
| wwansvc.dll | 1011 | WWAN Diagnostic Channel |
| xwizards.dll | 78.11011 | Application |
| ztdns.sys | 11 | Operational |
| zthelper.dll | 11 | Operational |