| AppReadiness.dll | 1011 | Operational |
| AppXDeploymentServer.dll | 1011 | Microsoft-Windows-AppXDeploymentServer/Operational |
| AppxPackaging.dll | 8.11011 | Microsoft-Windows-AppxPackaging/Performance |
| AudioSes.dll | 78.11011 | Performance |
| AzureSettingSyncProvider.dll | 10 | Microsoft-Windows-SettingSync-Azure/Debug |
| BdeHdCfgLib.dll | 1011 | Microsoft-Windows-BitLocker-DrivePreparationTool/Operational |
| BlbEvents.dll | 1011 | Microsoft-Windows-Backup/Operational |
| CloudStorageWizard.exe | 8.1 | Microsoft-Windows-CloudStorageWizard/Analytic |
| DFDTS.dll | 1011 | Microsoft-Windows-DiskDiagnostic/Operational |
| DFDWiz.exe | 1011 | Microsoft-Windows-DiskDiagnostic/Operational |
| FrameServer.dll | 11 | Camera DeviceMFT |
| IdCtrls.dll | 8.11011 | Microsoft-Windows-IdCtrls/Analytic |
| ManageCI.dll | 1011 | Microsoft-Windows-DeviceGuard/Verbose |
| Microsoft.Bluetooth.Profiles.HidOverGatt.dll | 1011 | Microsoft-Bluetooth-Profiles-HidOverGatt/Analytic |
| Microsoft.Windows.ApplicationServer.Applications.dll | 8.11011 | Analytic |
| MitigationClient.dll | 1011 | Operational |
| MsSpellCheckingFacility.dll | 8.11011 | Application |
| NcdAutoSetup.dll | 1011 | Microsoft-Windows-NcdAutoSetup/Diagnostic |
| PSEvents.dll | 8.11011 | Microsoft-Windows-PowerShell/Debug |
| PackageStateRoaming.dll | 8.110 | Microsoft-Windows-PackageStateRoaming/Debug |
| QAgentRT.dll | 78.1 | Microsoft-Windows-NetworkAccessProtection/WHC |
| RDXService.dll | 1011 | Operational |
| RdpAvenc.dll | 11 | Microsoft-Windows-Rdp-Graphics-RdpAvenc/Debug |
| RdpLite.dll | 11 | Microsoft-Windows-Rdp-Graphics-RdpLite/Debug |
| RelPost.exe | 1011 | Microsoft-Windows-MemoryDiagnostics-Results/Debug |
| SensorPerformanceEvents.dll | 1011 | Debug |
| SettingSyncCore.dll | 8.110 | Microsoft-Windows-SettingSync/Debug |
| SmsRouterSvc.dll | 1011 | SmsRouter Debug Channel |
| USBXHCI.SYS | 1011 | This is the Analytic channel to which internal Analytic events from the USBXHCI trustlet are sent from VTL1. |
| WWAHost.exe | 8.11011 | AppTracing |
| Windows.CloudStore.dll | 1011 | Microsoft-Windows-CloudStore/Debug |
| Windows.StateRepository.dll | 1011 | Microsoft-Windows-StateRepository/Operational |
| WsmRes.dll | 78.11011 | Microsoft-Windows-WinRM/Analytic |
| aeevts.dll | 8.11011 | Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic |
| aeevts.dll | 7 | Application |
| agilevpn.sys | 1011 | Debug Channel |
| ajrouter.dll | 10 | Debug |
| appinfo.dll | 11 | Microsoft-Windows-LUA-CredUI/Elevation |
| appraiser.dll | 1011 | Microsoft-Windows-Compat-Appraiser/Operational |
| auditcse.dll | 1011 | Microsoft-Windows-Security-Audit-Configuration-Client/Diagnostic |
| authui.dll | 78.1 | Microsoft-Windows-Shell-AuthUI-CredUI/Diagnostic |
| autopilotdiag.dll | 1011 | Autopilot |
| bthserv.dll | 1011 | System |
| capauthz.dll | 1011 | Verbose |
| ci.dll | 1011 | Microsoft-Windows-CodeIntegrity/Verbose |
| clusapi.dll | 1011 | Microsoft-Windows-FailoverClustering-Client/Diagnostic |
| cofiredm.dll | 1011 | Microsoft-Windows-CorruptedFileRecovery-Server/Operational |
| comdlg32.dll | 78.11011 | Analytical |
| credprovhost.dll | 1011 | Microsoft-Windows-Shell-AuthUI-CredUI/Diagnostic |
| crypt32.dll | 78.11011 | Microsoft-Windows-CAPI2/Operational |
| cscsvc.dll | 1011 | Microsoft-Windows-OfflineFiles/Operational |
| cxwmbclass.sys | 1011 | Windows Mobile Broadband Class Driver Analytic Channel |
| dhcpcore.dll | 78.11011 | Microsoft-Windows-DHCP Client Events/Admin |
| dhcpcore6.dll | 78.11011 | Microsoft-Windows-DHCP Client Events/Operational |
| dhcpcsvc6.dll | 78.11011 | Microsoft-Windows-DHCP Client Events/Operational |
| dhcpsapi.dll | 8.11011 | Microsoft-Windows-DHCP Server Events/Admin |
| dhcpsapi.dll | 7 | System |
| diagperf.dll | 1011 | Diagnostic |
| dimsroam.dll | 78.11011 | Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational |
| dmenterprisediagnostics.dll | 1011 | Operational |
| dmvsc.sys | 1011 | Microsoft-Hyper-V-Guest-Drivers-Debug |
| dot3svc.dll | 78.11011 | Microsoft-Windows-Wired-AutoConfig/Diagnostic |
| dps.dll | 1011 | Microsoft-Windows-Diagnosis-DPS/Operational |
| eapsvc.dll | 1011 | Microsoft-Windows-EapHost/Operational |
| eqossnap.dll | 8.11011 | Microsoft-Windows-Policy-based QoS/Analytic |
| fcon.dll | 1011 | Operational |
| fdeploy.dll | 78.11011 | Microsoft-Windows-Folder Redirection/Operational |
| fms.dll | 78.11011 | Microsoft-Windows-FMS/Operational |
| fthsvc.dll | 71011 | Microsoft-Windows-Fault-Tolerant-Heap/Operational |
| fveapi.dll | 1011 | Management |
| gpsvc.dll | 78.11011 | Microsoft-Windows-GroupPolicy/Operational |
| iphlpsvc.dll | 78.11011 | Iphlpsvc Etw Debug Channel |
| ipxlatcfg.dll | 1011 | Debug Channel |
| localspl.dll | 1011 | Operational |
| locationframework.dll | 11 | Operational |
| lpksetup.exe | 1011 | Microsoft-Windows-LanguagePackSetup/Operational |
| mf.dll | 1011 | Media Foundation DeviceMFT |
| mf.dll | 8.1 | Media Foundation Pipeline |
| microsoft-windows-hal-events.dll | 1011 | Microsoft-Windows-HAL/Debug |
| microsoft-windows-kernel-pnp-events.dll | 1011 | Device Configuration |
| microsoft-windows-system-events.dll | 1011 | Microsoft-Windows-Kernel-WDI/Debug |
| mrxsmb.sys | 1011 | Microsoft-Windows-SMBClient/ObjectStateDiagnostic |
| mslldp.sys | 1011 | Microsoft-Windows-LinkLayerDiscoveryProtocol/Diagnostic |
| msvproc.dll | 8.1 | MS Video Processor MFT (D3D11) |
| mup.sys | 11 | Microsoft-Windows-NetworkProvider/Operational |
| ncrypt.dll | 11 | Microsoft-Windows-Crypto-NCrypt/CertInUse |
| ncsi.dll | 1011 | Microsoft-Windows-NCSI/Operational |
| ndis.sys | 1011 | Microsoft-Windows-NDIS/Diagnostic |
| netdiagfx.dll | 78.11011 | System |
| netprofm.dll | 7 | Microsoft-Windows-NetworkProfile/Operational |
| netprofmsvc.dll | 8.11011 | Microsoft-Windows-NetworkProfile/Operational |
| nlasvc.dll | 78.110 | Microsoft-Windows-NlaSvc/Operational |
| ntprint.dll | 78.11011 | Operational |
| onex.dll | 1011 | Microsoft-Windows-OneX/Operational |
| pcaevts.dll | 1011 | Analytic |
| pcrpf.dll | 11 | Operational |
| pcwum.dll | 78.11011 | Microsoft-Windows-Diagnosis-PCW/Analytic |
| pla.dll | 78.11011 | Microsoft-Windows-Diagnosis-PLA/Debug |
| profsvc.dll | 1011 | Microsoft-Windows-User Profile Service/Operational |
| provcore.dll | 8.11011 | Microsoft-Windows-NetworkProvisioning/Operational |
| provdiagnostics.dll | 1011 | AutoPilot |
| qmgr.dll | 78.11011 | Microsoft-Windows-Bits-Client/Operational |
| quartz.dll | 78.11011 | DirectShow FilterGraph |
| radardt.dll | 78.11011 | Microsoft-Windows-Resource-Exhaustion-Detector/Operational |
| rdbss.sys | 1011 | Microsoft-Windows-Remotefs-Rdbss/Operational |
| rdpcorets.dll | 1011 | Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Debug |
| rpcrt4.dll | 78.11011 | Debug |
| rstrtmgr.dll | 78.11011 | Microsoft-Windows-RestartManager/Operational |
| rtutils.dll | 1011 | Admin Channel |
| schedsvc.dll | 78.11011 | System |
| sdiageng.dll | 78.11011 | Microsoft-Windows-Diagnosis-Scripted/Debug |
| sdiagprv.dll | 78.11011 | Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug |
| smbdirect.sys | 10 | Microsoft-Windows-SMBDirect/Netmon |
| srv2.sys | 1011 | Microsoft-Windows-SMBServer/Operational |
| timedate.cpl | 78.11011 | Analytical |
| tpmvsc.dll | 1011 | Microsoft-Windows-SmartCard-TPM-VCard-Module/Operational |
| tsusbflt.sys | 1011 | Analytic |
| tsusbhub.sys | 1011 | Analytic |
| tzsyncres.dll | 1011 | Operational |
| umrdp.dll | 1011 | Analytic |
| wbiosrvc.dll | 1011 | Microsoft-Windows-Biometrics/Analytic |
| wcmsvc.dll | 1011 | Diagnostic |
| wecsvc.dll | 78.11011 | System |
| wevtapi.dll | 1011 | ProviderMetadata |
| wevtfwd.dll | 78.11011 | Debug |
| wevtsvc.dll | 1011 | Security |
| winspool.drv | 78.11011 | Operational |
| wlansvc.dll | 78.11011 | System |
| wldp.dll | 1011 | Microsoft-Windows-VerifyHardwareSecurity/Admin |
| workfolderssvc.dll | 10 | Debug |
| wpd_ci.dll | 1011 | Analytic |
| wpncore.dll | 1011 | Microsoft-Windows-PushNotifications-Platform/Debug |
| wudfplatform.dll | 1011 | System |
| wwansvc.dll | 1011 | WWAN Operational Channel |
| ztdns.sys | 11 | PermittedConnections |
| zthelper.dll | 11 | PermittedConnections |