Strange. I managed somehow to download an archived version of WMI for Windows 9x and install it. Launched Process Monitor (no gathering events option I could see), and tried to reproduce the bug. Doesn't do it anymore. Strange...