日志名称: Application
来源: Microsoft-Windows-Winlogon
日期: 2021/8/22 21:52:49
事件 ID: 1002
任务类别: 无
级别: 信息
关键字: 经典
用户: 暂缺
计算机: PC-20210304BJKO
描述:
外壳程序意外停止,explorer.exe 被重新启动。
事件 Xml:
<
Event
xmlns
=
"http://schemas.microsoft.com/win/2004/08/events/event"
>
<
System
>
<
Provider
Name
=
"Microsoft-Windows-Winlogon"
Guid
=
"{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}"
EventSourceName
=
"Wlclntfy"
/>
<
EventID
Qualifiers
=
"16384"
>1002</
EventID
>
<
Version
>0</
Version
>
<
Level
>4</
Level
>
<
Task
>0</
Task
>
<
Opcode
>0</
Opcode
>
<
Keywords
>0x80000000000000</
Keywords
>
<
TimeCreated
SystemTime
=
"2021-08-22T13:52:49.6148089Z"
/>
<
EventRecordID
>34141</
EventRecordID
>
<
Correlation
/>
<
Execution
ProcessID
=
"0"
ThreadID
=
"0"
/>
<
Channel
>Application</
Channel
>
<
Computer
>PC-20210304BJKO</
Computer
>
<
Security
/>
</
System
>
<
EventData
>
<
Data
>explorer.exe</
Data
>
</
EventData
>
</
Event
>