What i've found is vmtools constantly using WMI, I am using Veeamone monitor.
Code: Select all
ProviderInfo for GroupOperationId = 111; Operation = Provider::ExecQuery - select __RELPATH, InstallDate, __RELPATH from Win32_ShortcutFile where Name = "C:\\pagefile.sys"; ProviderName = CIMWin32; ProviderGuid = {d63a5850-8f16-11cf-9f47-00aa00bf345c}; Path = %systemroot%\system32\wbem\cimwin32.dll
Code: Select all
ProviderInfo for GroupOperationId = 111; Operation = Provider::ExecQuery - select __RELPATH, InstallDate, __RELPATH from Win32_PageFile where Name = "C:\\pagefile.sys"; ProviderName = CIMWin32; ProviderGuid = {d63a5850-8f16-11cf-9f47-00aa00bf345c}; Path = %systemroot%\system32\wbem\cimwin32.dll
Code: Select all
GroupOperationId = 111; OperationId = 166056; Operation = Start IWbemServices::CreateInstanceEnum - Win32_PageFileUsage; ClientMachine = KDNAP-TS2; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1900; NamespaceName = \\.\root\cimv2
Any ideas ?