mirror of
https://github.com/matthastings/PSalander
synced 2026-06-08 15:46:17 +00:00
Matt Hastings
82 lines
3.6 KiB
Plaintext
82 lines
3.6 KiB
Plaintext
Id Description
|
|
-- -----------
|
|
1 Process %1 started at time %2 by parent %3 running in session %4 with name %5.
|
|
2 Process %1 (which started at time %2) stopped at time %3 with exit code %4.
|
|
3 Thread %2 (in Process %1) started.
|
|
4 Thread %2 (in Process %1) stopped.
|
|
5 Process %3 had an image loaded with name %7.
|
|
6 Process %3 had an image unloaded with name %7.
|
|
7 Base CPU priority of thread %2 in process %1 was changed from %3 to %4.
|
|
8 CPU priority of thread %2 in process %1 was changed from %3 to %4.
|
|
9 Page priority of thread %2 in process %1 was changed from %3 to %4.
|
|
10 I/O priority of thread %2 in process %1 was changed from %3 to %4.
|
|
11 Execution of the process %1 has been suspended.
|
|
12 Execution of the process %1 has been resumed.
|
|
13 Job %1 started with status code %2.
|
|
14 Job %1 terminated with status code %2.
|
|
15 Enumerated process %1 had started at time %2 by parent %3 running in session %4 with name %6.
|
|
16
|
|
17
|
|
18
|
|
19
|
|
20
|
|
|
|
XML of process stop event properties
|
|
|
|
<Data Name='ProcessID'>5636</Data>
|
|
<Data Name='CreateTime'>2017-05-31T22:05:58.721944300Z</Data>
|
|
<Data Name='ExitTime'>2017-05-31T22:07:28.692039900Z</Data>
|
|
<Data Name='ExitCode'>1</Data>
|
|
<Data Name='TokenElevationType'>3</Data>
|
|
<Data Name='HandleCount'>208</Data>
|
|
<Data Name='CommitCharge'>4456448</Data>
|
|
<Data Name='CommitPeak'>4493312</Data>
|
|
<Data Name='CPUCycleCount'>199385866</Data>
|
|
<Data Name='ReadOperationCount'>0</Data>
|
|
<Data Name='WriteOperationCount'>0</Data>
|
|
<Data Name='ReadTransferKiloBytes'>0</Data>
|
|
<Data Name='WriteTransferKiloBytes'>0</Data>
|
|
<Data Name='HardFaultCount'>0</Data>
|
|
<Data Name='ImageName'>backgroundTask</Data>
|
|
|
|
XML of process start event properties
|
|
|
|
<Data Name='ProcessID'>5068</Data>
|
|
<Data Name='CreateTime'>2017-05-31T22:07:26.486024400Z</Data>
|
|
<Data Name='ParentProcessID'>852</Data>
|
|
<Data Name='SessionID'>1</Data>
|
|
<Data Name='Flags'>0</Data>
|
|
<Data Name='ImageName'>\Device\HarddiskVolume1\Windows\System32\dllhost.exe</Data>
|
|
<Data Name='ImageChecksum'>60860</Data>
|
|
<Data Name='TimeDateStamp'>1468636009</Data>
|
|
<Data Name='PackageFullName'></Data>
|
|
<Data Name='PackageRelativeAppId'></Data>
|
|
|
|
XML of image load event properties
|
|
|
|
<Data Name='ImageBase'>0x7ff7e4830000</Data>
|
|
<Data Name='ImageSize'>0x9000</Data>
|
|
<Data Name='ProcessID'>5068</Data>
|
|
<Data Name='ImageCheckSum'>60860</Data>
|
|
<Data Name='TimeDateStamp'>1468636009</Data>
|
|
<Data Name='DefaultBase'>0x7ff7e4830000</Data>
|
|
<Data Name='ImageName'>\Device\HarddiskVolume1\Windows\System32\dllhost.exe</Data>
|
|
|
|
Provider Keywords
|
|
|
|
|
|
Name Description Value
|
|
---- ----------- -----
|
|
WINEVENT_KEYWORD_PROCESS 16
|
|
WINEVENT_KEYWORD_THREAD 32
|
|
WINEVENT_KEYWORD_IMAGE 64
|
|
WINEVENT_KEYWORD_CPU_PRIORITY 128
|
|
WINEVENT_KEYWORD_OTHER_PRIORITY 256
|
|
WINEVENT_KEYWORD_PROCESS_FREEZE 512
|
|
WINEVENT_KEYWORD_JOB 1024
|
|
WINEVENT_KEYWORD_ENABLE_PROCESS_TRACING_CALLBACKS 2048
|
|
WINEVENT_KEYWORD_JOB_IO 4096
|
|
WINEVENT_KEYWORD_WORK_ON_BEHALF 8192
|
|
WINEVENT_KEYWORD_JOB_SILO 16384
|
|
Microsoft-Windows-Kernel-Process/Analytic 9223372036854775808
|