detection.wiki

Microsoft-Windows-Diagnostics-Performance › Event 110

Event ID 110 — Session manager initialization caused a slow down in the startup process.

Provider
Microsoft-Windows-Diagnostics-Performance
Channel
Operational
Level
Warning
Task
BootPerformanceMonitoring
Opcode
BootDegradation

Description

Session manager initialization caused a slow down in the startup process.

Message #

Session manager initialization caused a slow down in the startup process: 

     Name		: %3

     Total Time		: %4ms

     Degradation Time	: %5ms

     Incident Time (UTC)	: %1

Fields #

NameDescription
StartTime FILETIME—
NameLength UInt32—
Name UnicodeString—
TotalTime UInt32—
DegradationTime UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Diagnostics-Performance",
    "guid": "CFC18EC0-96B1-4EBA-961B-622CAEE05B0A",
    "event_source_name": "",
    "event_id": 110,
    "version": 1,
    "level": 3,
    "task": 4002,
    "opcode": 33,
    "keywords": 9223372036854841344,
    "time_created": "2023-10-25T22:05:44.601513+00:00",
    "event_record_id": 26,
    "correlation": {
      "ActivityID": "028F2288-078F-0001-413E-8F028F07DA01"
    },
    "execution": {
      "process_id": 2484,
      "thread_id": 3796
    },
    "channel": "Microsoft-Windows-Diagnostics-Performance/Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "StartTime": "2023-10-25T22:02:56.552302Z",
    "NameLength": 9,
    "Name": "SMSSInit",
    "TotalTime": 17567,
    "DegradationTime": 7567
  },
  "message": ""
}

References #