I understand that @randomascii is responsive, perhaps he could help with analysis. I see an email address on his site's About page. Also, I got curious about t

I understand that @randomascii is responsive, perhaps he could help with analysis. I see an email address on his site's About page. Also, I got curious about the perf collection process, and stumbled on https://blogs.technet.microsoft.com/yongrhee/2017/10/11/using-xperf-to-capture-etl-traces-for-slow-logons/ https://blogs.technet.microsoft.com/yongrhee/2017/10/11/usin... - unsure if this will be useful. Also found https://randomascii.wordpress.com/2015/09/24/etw-central/ https://randomascii.wordpress.com/2015/09/24/etw-central/, for completeness