detection.wiki

Microsoft-Windows-UserDataAccess-UserDataUtils

19 events across 1 channel

Event IDTitleChannel
1Error: P1_HResult Location: P2_String Line Number: P3_UInt32.Operational
2Error Propagated: P1_HResult Location: P2_String Line Number: P3_UInt32.Operational
3Operational
101Error: HRESULT: Prop_LINE_UInt32 Service: Prop_Trace_UnicodeString.Operational
102Service: Prop_Trace_UnicodeString is starting up.Operational
103Service: Prop_Trace_UnicodeString has entered the running state.Operational
104Service: Prop_Trace_UnicodeString is shutting down.Operational
105Service: P1_UnicodeString received control: P1_UInt32.Operational
106Error during OnStarting for P1_UnicodeString: P1_UInt32.Operational
107Error during OnStarted for P1_UnicodeString: P1_UInt32.Operational
301CHSPinYinHelper Init failed: HRESULT: P1_HexInt32, CreateFile: Prop_Handle, …Operational
401Unknown photo type: P1_UnicodeString.Operational
402Unknown photo binary encoding type: P1_UnicodeString.Operational
403Cannot find photo type.Operational
501JetInit failed with JET error: P1_Int32.Operational
502JetAttachDatabase failed with JET error: P1_Int32.Operational
600GetBrokerEventIdForPackage: eventCount = P1_Int32.Operational
601GetBrokerEventIdForPackage: pPackageFamilyName= P1_UnicodeString, …Operational
602GetBrokerEventIdForPackage: capabilities = P1_HexInt32, desiredCapabilities = …Operational

Event ID 1 — Error: P1_HResult Location: P2_String Line Number: P3_UInt32.

Provider
Microsoft-Windows-UserDataAccess-UserDataUtils
Channel
Operational

Description

Error: P1_HResult Location: P2_String Line Number: P3_UInt32.

Message #

Error: %1 Location: %2 Line Number: %3

Fields #

NameDescription
P1_HResult Int32—
P2_String AnsiString—
P3_UInt32 UInt32—

Event ID 2 — Error Propagated: P1_HResult Location: P2_String Line Number: P3_UInt32.

Provider
Microsoft-Windows-UserDataAccess-UserDataUtils
Channel
Operational

Description

Error Propagated: P1_HResult Location: P2_String Line Number: P3_UInt32.

Message #

Error Propagated: %1 Location: %2 Line Number: %3

Fields #

NameDescription
P1_HResult Int32—
P2_String AnsiString—
P3_UInt32 UInt32—

Event ID 3 —

Provider
Microsoft-Windows-UserDataAccess-UserDataUtils
Channel
Operational
Task
Trace

Fields #

NameDescription
Message Pointer—

Event ID 101 — Error: HRESULT: Prop_LINE_UInt32 Service: Prop_Trace_UnicodeString.

Provider
Microsoft-Windows-UserDataAccess-UserDataUtils
Channel
Operational

Description

Error: HRESULT: Prop_LINE_UInt32 Service: Prop_Trace_UnicodeString.

Message #

Error: HRESULT: %1 Service: %2

Fields #

NameDescription
Prop_LINE_UInt32 UInt32—
Prop_Trace_UnicodeString UnicodeString—

Event ID 102 — Service: Prop_Trace_UnicodeString is starting up.

Provider
Microsoft-Windows-UserDataAccess-UserDataUtils
Channel
Operational

Description

Service: Prop_Trace_UnicodeString is starting up.

Message #

Service: %1 is starting up

Fields #

NameDescription
Prop_Trace_UnicodeString UnicodeString—

Event ID 103 — Service: Prop_Trace_UnicodeString has entered the running state.

Provider
Microsoft-Windows-UserDataAccess-UserDataUtils
Channel
Operational

Description

Service: Prop_Trace_UnicodeString has entered the running state.

Message #

Service: %1 has entered the running state

Fields #

NameDescription
Prop_Trace_UnicodeString UnicodeString—

Event ID 104 — Service: Prop_Trace_UnicodeString is shutting down.

Provider
Microsoft-Windows-UserDataAccess-UserDataUtils
Channel
Operational

Description

Service: Prop_Trace_UnicodeString is shutting down.

Message #

Service: %1 is shutting down

Fields #

NameDescription
Prop_Trace_UnicodeString UnicodeString—

Event ID 105 — Service: P1_UnicodeString received control: P1_UInt32.

Provider
Microsoft-Windows-UserDataAccess-UserDataUtils
Channel
Operational

Description

Service: P1_UnicodeString received control: P1_UInt32.

Message #

Service: %1 received control: %2

Fields #

NameDescription
P1_UnicodeString UnicodeString—
P1_UInt32 UInt32—

Event ID 106 — Error during OnStarting for P1_UnicodeString: P1_UInt32.

Provider
Microsoft-Windows-UserDataAccess-UserDataUtils
Channel
Operational

Description

Error during OnStarting for P1_UnicodeString: P1_UInt32.

Message #

Error during OnStarting for %1: %2

Fields #

NameDescription
P1_UnicodeString UnicodeString—
P1_UInt32 UInt32—

Event ID 107 — Error during OnStarted for P1_UnicodeString: P1_UInt32.

Provider
Microsoft-Windows-UserDataAccess-UserDataUtils
Channel
Operational

Description

Error during OnStarted for P1_UnicodeString: P1_UInt32.

Message #

Error during OnStarted for %1: %2

Fields #

NameDescription
P1_UnicodeString UnicodeString—
P1_UInt32 UInt32—

Event ID 301 — CHSPinYinHelper Init failed: HRESULT: P1_HexInt32, CreateFile: Prop_Handle, CreateFileMapping: Prop_Handle2.

Provider
Microsoft-Windows-UserDataAccess-UserDataUtils
Channel
Operational

Description

CHSPinYinHelper Init failed: HRESULT: P1_HexInt32, CreateFile: Prop_Handle, CreateFileMapping: Prop_Handle2.

Message #

CHSPinYinHelper Init failed: HRESULT: %1, CreateFile: %2, CreateFileMapping: %3

Fields #

NameDescription
P1_HexInt32 Int32—
Prop_Handle UInt32—
Prop_Handle2 UInt32—

Event ID 401 — Unknown photo type: P1_UnicodeString.

Provider
Microsoft-Windows-UserDataAccess-UserDataUtils
Channel
Operational

Description

Unknown photo type: P1_UnicodeString. Default to be binary.

Message #

Unknown photo type: %1. Default to be binary.

Fields #

NameDescription
P1_UnicodeString UnicodeString—

Event ID 402 — Unknown photo binary encoding type: P1_UnicodeString.

Provider
Microsoft-Windows-UserDataAccess-UserDataUtils
Channel
Operational

Description

Unknown photo binary encoding type: P1_UnicodeString. Default to be base64.

Message #

Unknown photo binary encoding type: %1. Default to be base64.

Fields #

NameDescription
P1_UnicodeString UnicodeString—

Event ID 403 — Cannot find photo type.

Provider
Microsoft-Windows-UserDataAccess-UserDataUtils
Channel
Operational

Description

Cannot find photo type. Default to be binary.

Message #

Cannot find photo type. Default to be binary.

Event ID 501 — JetInit failed with JET error: P1_Int32.

Provider
Microsoft-Windows-UserDataAccess-UserDataUtils
Channel
Operational

Description

JetInit failed with JET error: P1_Int32.

Message #

JetInit failed with JET error: %1

Fields #

NameDescription
P1_Int32 Int32—

Event ID 502 — JetAttachDatabase failed with JET error: P1_Int32.

Provider
Microsoft-Windows-UserDataAccess-UserDataUtils
Channel
Operational

Description

JetAttachDatabase failed with JET error: P1_Int32.

Message #

JetAttachDatabase failed with JET error: %1

Fields #

NameDescription
P1_Int32 Int32—

Event ID 600 — GetBrokerEventIdForPackage: eventCount = P1_Int32.

Provider
Microsoft-Windows-UserDataAccess-UserDataUtils
Channel
Operational

Description

GetBrokerEventIdForPackage: eventCount = P1_Int32.

Message #

GetBrokerEventIdForPackage: eventCount = %1

Fields #

NameDescription
P1_Int32 Int32—

Event ID 601 — GetBrokerEventIdForPackage: pPackageFamilyName= P1_UnicodeString, packageFamilyName = P2_UnicodeString.

Provider
Microsoft-Windows-UserDataAccess-UserDataUtils
Channel
Operational

Description

GetBrokerEventIdForPackage: pPackageFamilyName= P1_UnicodeString, packageFamilyName = P2_UnicodeString.

Message #

GetBrokerEventIdForPackage: pPackageFamilyName= %1, packageFamilyName = %2

Fields #

NameDescription
P1_UnicodeString UnicodeString—
P2_UnicodeString UnicodeString—

Event ID 602 — GetBrokerEventIdForPackage: capabilities = P1_HexInt32, desiredCapabilities = P2_HexInt32.

Provider
Microsoft-Windows-UserDataAccess-UserDataUtils
Channel
Operational

Description

GetBrokerEventIdForPackage: capabilities = P1_HexInt32, desiredCapabilities = P2_HexInt32.

Message #

GetBrokerEventIdForPackage: capabilities = %1, desiredCapabilities = %2

Fields #

NameDescription
P1_HexInt32 Int32—
P2_HexInt32 Int32—