Windows event log ยท System26 Application Error
- System
- 2 fields
System.evtxApplication Popup
Fields EvtxECmd extracts
2 columns in the EvtxECmd CSV
- PayloadData1
Caption: %Caption%- %Caption% = /Event/EventData/Data[@Name="Caption"]
- PayloadData2
Message: %Message%- %Message% = /Event/EventData/Data[@Name="Message"]
Sample event
Event XML from the map file
<Event>
<System>
<Provider Name="Application Popup" Guid="47bfa2b7-bd54-4fac-b70b-29021079ca8f"/>
<EventID>26</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2021-02-08 13:18:41.6679518"/>
<EventRecordID>1616679</EventRecordID>
<Correlation/>
<Execution ProcessID="608" ThreadID="656"/>
<Channel>System</Channel>
<Computer>HOSTNAME.domain</Computer>
<Security UserID="S-1-5-18"/>
</System>
<EventData>
<Data Name="Caption">evil:ADS - Application Error</Data>
<Data Name="Message">The instruction at 0x679c1ff2 referenced memory at 0x0000003c. The memory could not be read., Click on OK to terminate the program</Data>
</EventData>
#
</Event>References
4 links
- social.technet.microsoft.com/Forums/Azure/en-US/793156d6-4dbd-430d-af37-fb0a503264f4/event-id-26-application-pop-up?forum=winservergen(opens in new tab)
- social.technet.microsoft.com/Forums/en-US/6bccbb97-07a1-435e-9e0e-93291b2e1b03/server-2003-r2-showing-regular-event-id-26-application-popup-errors?forum=winservergen(opens in new tab)
- social.technet.microsoft.com/Forums/en-US/c56e3a4e-7687-4348-8c7b-bae3b56c642b/event-id-26-source-application-popup?forum=winservergen(opens in new tab)
- github.com/nasbench/EVTX-ETW-Resources/blob/main/ETWProvidersCSVs/Internal/Application%20Popup.csv(opens in new tab)
Source: evtx/Maps/System_Application-Popup_26.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)