DFIRHub

Windows event log ยท Application10002 Shutting down application or service / Terminated due to non-response

  • Application
  • 4 fields
  • Application.evtx
  • Microsoft-Windows-RestartManagerMicrosoft-Windows-Winsrv

Shutting down application or service

Provider Microsoft-Windows-RestartManager

  • ExecutableInfo%FullPath%
    • %FullPath% = /Event/UserData/RmApplicationEvent/FullPath
  • PayloadData1DisplayName: %DisplayName%
    • %DisplayName% = /Event/UserData/RmApplicationEvent/DisplayName
  • PayloadData2Files: %Files%
    • %Files% = /Event/UserData/RmApplicationEvent/Files/File

Terminated due to non-response

Provider Microsoft-Windows-Winsrv

  • ExecutableInfo%AppName%
    • %AppName% = /Event/UserData/HungAppEvent/AppName

Sample event

Microsoft-Windows-RestartManager event XML

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-RestartManager" Guid="{GUID}"/>
    <EventID>10002</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2020-12-06T08:21:49.5722615Z"/>
    <EventRecordID>21064</EventRecordID>
    <Correlation/>
    <Execution ProcessID="8860" ThreadID="17736"/>
    <Channel>Application</Channel>
    <Computer>ComputerName</Computer>
    <Security UserID="{UserID}"/>
  </System>
  <UserData>
    <RmApplicationEvent xmlns="http://www.microsoft.com/2005/08/Windows/Reliability/RestartManager/">
      <RmSessionId>0</RmSessionId>
      <FullPath>RealPlayerUpdateSvc.exe</FullPath>
      <DisplayName>RealPlayer Update Service</DisplayName>
      <AppVersion>0</AppVersion>
      <AppType>3</AppType>
      <TSSessionId>0</TSSessionId>
      <Status>262146</Status>
      <Pid>4220</Pid>
      <nFiles>3</nFiles>
      <Files>
        <File>C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe</File>
        <File>C:\Program Files (x86)\Real\UpdateService\RealDownloaderUpdatePlugin.dll</File>
        <File>C:\Program Files (x86)\Real\UpdateService\VideoDLUpdatePlugin.dll</File>
      </Files>
    </RmApplicationEvent>
  </UserData>
</Event>

Sample event

Microsoft-Windows-Winsrv event XML

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winsrv" Guid="{GUID}"/>
    <EventID>10002</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2020-12-28T16:45:14.6424242Z"/>
    <EventRecordID>31565</EventRecordID>
    <Correlation/>
    <Execution ProcessID="11364" ThreadID="23376"/>
    <Channel>Application</Channel>
    <Computer>ComputerName</Computer>
    <Security UserID="{UserID}"/>
  </System>
  <UserData>
    <HungAppEvent xmlns="http://manifests.microsoft.com/win/2004/08/windows/winsrv">
      <AppName>PotPlayer.exe</AppName>
    </HungAppEvent>
  </UserData>
</Event>

References

1 link

Source: evtx/Maps/Application_Microsoft-Windows-RestartManager_10002.map(opens in new tab), evtx/Maps/Application_Microsoft-Windows-Winsrv_10002.map(opens in new tab) by Hyun Yi @hyuunnn and contributors(opens in new tab), MIT License(opens in new tab)