Desktop Window Manager

6 events across 1 channel

Event ID	Title	Channel
9003		Application
9004		Application
9007		Application
9009	The Desktop Window Manager has exited with code (0x40010004)	Application
9016		Application
9027	The Desktop Window Manager has registered the session port.	Application

Event ID 9003 —

Provider: Desktop Window Manager
Channel: Application
Level: Informational

Example Event #

{
  "system": {
    "provider": "Desktop Window Manager",
    "guid": "",
    "event_source_name": "",
    "event_id": 9003,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2013-10-23T16:22:49+00:00",
    "event_record_id": 88,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "IE8Win7",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Event ID 9004 —

Provider: Desktop Window Manager
Channel: Application
Level: Informational

Example Event #

{
  "system": {
    "provider": "Desktop Window Manager",
    "guid": "",
    "event_source_name": "",
    "event_id": 9004,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2013-10-23T17:51:20+00:00",
    "event_record_id": 234,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "IE8Win7",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Event ID 9007 —

Provider: Desktop Window Manager
Channel: Application
Level: Informational

Example Event #

{
  "system": {
    "provider": "Desktop Window Manager",
    "guid": "",
    "event_source_name": "",
    "event_id": 9007,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2014-11-26T23:22:01.000000Z",
    "event_record_id": 1151,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "IE10Win7",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {}
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 9009 — The Desktop Window Manager has exited with code (0x40010004)

Provider: Desktop Window Manager
Channel: Application
Level: Informational

Fields #

Name	Description
`Data`	—

Example Event #

{
  "system": {
    "provider": "Desktop Window Manager",
    "guid": "",
    "event_source_name": "",
    "event_id": 9009,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2013-10-23T17:45:45+00:00",
    "event_record_id": 208,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "IE8Win7",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "0x40010004"
    ]
  },
  "message": "The Desktop Window Manager has exited with code (0x40010004)"
}

References #

Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Event ID 9016 —

Provider: Desktop Window Manager
Channel: Application
Level: Informational

Example Event #

{
  "system": {
    "provider": "Desktop Window Manager",
    "guid": "",
    "event_source_name": "",
    "event_id": 9016,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2014-11-26T23:26:01.000000Z",
    "event_record_id": 1211,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "IE10Win7",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {}
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 9027 — The Desktop Window Manager has registered the session port.

Provider: Desktop Window Manager
Channel: Application
Level: Informational

Example Event #

{
  "system": {
    "provider": "Desktop Window Manager",
    "guid": "",
    "event_source_name": "",
    "event_id": 9027,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2022-04-07T16:53:28.968520+00:00",
    "event_record_id": 194,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "The Desktop Window Manager has registered the session port."
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline