detection.wiki

Microsoft-Windows-Shell-Core › Event 62460

Event ID 62460 — OOBE Health Monitor.

Provider
Microsoft-Windows-Shell-Core
Channel
Operational
Level
Informational
Task
OOBEHealth_Progress

Description

OOBE Health Monitor. Version: DataVersion, Health flags: HealthStateFlags, Census flags: CensusFlags, Seconds since boot: SecondsSinceBoot, Image identifier: 'ImageIdentifier', Detailed info: 'TrackingInfo'.

Message #

OOBE Health Monitor. Version: %1, Health flags: %2, Census flags: %3, Seconds since boot: %4, Image identifier: '%5', Detailed info: '%6'.

Fields #

NameDescription
DataVersion Int32—
HealthStateFlags UInt64—
CensusFlags UInt64—
SecondsSinceBoot UInt64—
ImageIdentifier UnicodeString—
TrackingInfo UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Shell-Core",
    "guid": "30336ED4-E327-447C-9DE0-51B652C86108",
    "event_source_name": "",
    "event_id": 62460,
    "version": 0,
    "level": 4,
    "task": 62460,
    "opcode": 0,
    "keywords": 2305843146652712960,
    "time_created": "2023-11-06T06:25:35.337008+00:00",
    "event_record_id": 1692,
    "correlation": {},
    "execution": {
      "process_id": 1424,
      "thread_id": 1428
    },
    "channel": "Microsoft-Windows-Shell-Core/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DataVersion": 14,
    "HealthStateFlags": 0,
    "CensusFlags": 14,
    "SecondsSinceBoot": 59,
    "ImageIdentifier": "",
    "TrackingInfo": "{ 0; 1; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0; 0;}"
  },
  "message": ""
}

References #