Id Description
-- -----------
 1 Process %1 started at time %2 by parent %3 running in session %4 with name %5.
 2 Process %1 (which started at time %2) stopped at time %3 with exit code %4.
 3 Thread %2 (in Process %1) started.
 4 Thread %2 (in Process %1) stopped.
 5 Process %3 had an image loaded with name %7.
 6 Process %3 had an image unloaded with name %7.
 7 Base CPU priority of thread %2 in process %1 was changed from %3 to %4.
 8 CPU priority of thread %2 in process %1 was changed from %3 to %4.
 9 Page priority of thread %2 in process %1 was changed from %3 to %4.
10 I/O priority of thread %2 in process %1 was changed from %3 to %4.
11 Execution of the process %1 has been suspended.
12 Execution of the process %1 has been resumed.
13 Job %1 started with status code %2.
14 Job %1 terminated with status code %2.
15 Enumerated process %1 had started at time %2 by parent %3 running in session %4 with name %6.
16
17
18
19
20

XML of process stop event properties

<Data Name='ProcessID'>5636</Data>
<Data Name='CreateTime'>2017-05-31T22:05:58.721944300Z</Data>
<Data Name='ExitTime'>2017-05-31T22:07:28.692039900Z</Data>
<Data Name='ExitCode'>1</Data>
<Data Name='TokenElevationType'>3</Data>
<Data Name='HandleCount'>208</Data>
<Data Name='CommitCharge'>4456448</Data>
<Data Name='CommitPeak'>4493312</Data>
<Data Name='CPUCycleCount'>199385866</Data>
<Data Name='ReadOperationCount'>0</Data>
<Data Name='WriteOperationCount'>0</Data>
<Data Name='ReadTransferKiloBytes'>0</Data>
<Data Name='WriteTransferKiloBytes'>0</Data>
<Data Name='HardFaultCount'>0</Data>
<Data Name='ImageName'>backgroundTask</Data>

XML of process start event properties

<Data Name='ProcessID'>5068</Data>
<Data Name='CreateTime'>2017-05-31T22:07:26.486024400Z</Data>
<Data Name='ParentProcessID'>852</Data>
<Data Name='SessionID'>1</Data>
<Data Name='Flags'>0</Data>
<Data Name='ImageName'>\Device\HarddiskVolume1\Windows\System32\dllhost.exe</Data>
<Data Name='ImageChecksum'>60860</Data>
<Data Name='TimeDateStamp'>1468636009</Data>
<Data Name='PackageFullName'></Data>
<Data Name='PackageRelativeAppId'></Data>

XML of image load event properties

<Data Name='ImageBase'>0x7ff7e4830000</Data>
<Data Name='ImageSize'>0x9000</Data>
<Data Name='ProcessID'>5068</Data>
<Data Name='ImageCheckSum'>60860</Data>
<Data Name='TimeDateStamp'>1468636009</Data>
<Data Name='DefaultBase'>0x7ff7e4830000</Data>
<Data Name='ImageName'>\Device\HarddiskVolume1\Windows\System32\dllhost.exe</Data>

Provider Keywords


Name                                              Description               Value
----                                              -----------               -----
WINEVENT_KEYWORD_PROCESS                                                      16
WINEVENT_KEYWORD_THREAD                                                       32
WINEVENT_KEYWORD_IMAGE                                                        64
WINEVENT_KEYWORD_CPU_PRIORITY                                                128
WINEVENT_KEYWORD_OTHER_PRIORITY                                              256
WINEVENT_KEYWORD_PROCESS_FREEZE                                              512
WINEVENT_KEYWORD_JOB                                                        1024
WINEVENT_KEYWORD_ENABLE_PROCESS_TRACING_CALLBACKS                           2048
WINEVENT_KEYWORD_JOB_IO                                                     4096
WINEVENT_KEYWORD_WORK_ON_BEHALF                                             8192
WINEVENT_KEYWORD_JOB_SILO                                                  16384
Microsoft-Windows-Kernel-Process/Analytic                    9223372036854775808
