Re: Workbench Startup/ Shutdown does not work

[Andrei Iurchenko]

- System

- Provider

[ Name] Microsoft-Windows-Security-Auditing
[ Guid] {54849625-5478-4994-a5ba-3e3b0328c30d}

EventID 4624

Version 2

Level 0

Task 12544

Opcode 0

Keywords 0x8020000000000000

- TimeCreated

[ SystemTime] 2021-09-30T23:07:40.5544317Z

EventRecordID 786210

- Correlation

[ ActivityID] {f3eea5c0-b5a5-0006-d4a5-eef3a5b5d701}

- Execution

[ ProcessID] 804
[ ThreadID] 4376

Channel Security

Computer DESKTOP-G2Q81C0

Security


- EventData

SubjectUserSid S-1-5-18
SubjectUserName DESKTOP-G2Q81C0$
SubjectDomainName WORKGROUP
SubjectLogonId 0x3e7
TargetUserSid S-1-5-18
TargetUserName SYSTEM
TargetDomainName NT AUTHORITY
TargetLogonId 0x3e7
LogonType 5
LogonProcessName Advapi
AuthenticationPackageName Negotiate
WorkstationName -
LogonGuid {00000000-0000-0000-0000-000000000000}
TransmittedServices -
LmPackageName -
KeyLength 0
ProcessId 0x318
ProcessName C:\Windows\System32\services.exe
IpAddress -
IpPort -
ImpersonationLevel %%1833
RestrictedAdminMode -
TargetOutboundUserName -
TargetOutboundDomainName -
VirtualAccount %%1843
TargetLinkedLogonId 0x0
ElevatedToken %%1842

- System

- Provider

[ Name] Microsoft-Windows-Security-Auditing
[ Guid] {54849625-5478-4994-a5ba-3e3b0328c30d}

EventID 4672

Version 0

Level 0

Task 12548

Opcode 0

Keywords 0x8020000000000000

- TimeCreated

[ SystemTime] 2021-09-30T23:07:40.5544402Z

EventRecordID 786211

- Correlation

[ ActivityID] {f3eea5c0-b5a5-0006-d4a5-eef3a5b5d701}

- Execution

[ ProcessID] 804
[ ThreadID] 4376

Channel Security

Computer DESKTOP-G2Q81C0

Security


- EventData

SubjectUserSid S-1-5-18
SubjectUserName SYSTEM
SubjectDomainName NT AUTHORITY
SubjectLogonId 0x3e7
PrivilegeList SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege

- System

- Provider

[ Name] Microsoft-Windows-Security-Auditing
[ Guid] {54849625-5478-4994-a5ba-3e3b0328c30d}

EventID 4624

Version 2

Level 0

Task 12544

Opcode 0

Keywords 0x8020000000000000

- TimeCreated

[ SystemTime] 2021-09-30T23:08:24.0215132Z

EventRecordID 786212

- Correlation

[ ActivityID] {f3eea5c0-b5a5-0006-d4a5-eef3a5b5d701}

- Execution

[ ProcessID] 804
[ ThreadID] 4376

Channel Security

Computer DESKTOP-G2Q81C0

Security


- EventData

SubjectUserSid S-1-5-18
SubjectUserName DESKTOP-G2Q81C0$
SubjectDomainName WORKGROUP
SubjectLogonId 0x3e7
TargetUserSid S-1-5-18
TargetUserName SYSTEM
TargetDomainName NT AUTHORITY
TargetLogonId 0x3e7
LogonType 5
LogonProcessName Advapi
AuthenticationPackageName Negotiate
WorkstationName -
LogonGuid {00000000-0000-0000-0000-000000000000}
TransmittedServices -
LmPackageName -
KeyLength 0
ProcessId 0x318
ProcessName C:\Windows\System32\services.exe
IpAddress -
IpPort -
ImpersonationLevel %%1833
RestrictedAdminMode -
TargetOutboundUserName -
TargetOutboundDomainName -
VirtualAccount %%1843
TargetLinkedLogonId 0x0
ElevatedToken %%1842

- System

- Provider

[ Name] Microsoft-Windows-Security-Auditing
[ Guid] {54849625-5478-4994-a5ba-3e3b0328c30d}

EventID 4672

Version 0

Level 0

Task 12548

Opcode 0

Keywords 0x8020000000000000

- TimeCreated

[ SystemTime] 2021-09-30T23:08:24.0215195Z

EventRecordID 786213

- Correlation

[ ActivityID] {f3eea5c0-b5a5-0006-d4a5-eef3a5b5d701}

- Execution

[ ProcessID] 804
[ ThreadID] 4376

Channel Security

Computer DESKTOP-G2Q81C0

Security


- EventData

SubjectUserSid S-1-5-18
SubjectUserName SYSTEM
SubjectDomainName NT AUTHORITY
SubjectLogonId 0x3e7
PrivilegeList SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege

- System

- Provider

[ Name] Microsoft-Windows-Security-Auditing
[ Guid] {54849625-5478-4994-a5ba-3e3b0328c30d}

EventID 5382

Version 0

Level 0

Task 13824

Opcode 0

Keywords 0x8020000000000000

- TimeCreated

[ SystemTime] 2021-09-30T23:08:24.0862311Z

EventRecordID 786214

Correlation

- Execution

[ ProcessID] 804
[ ThreadID] 4376

Channel Security

Computer DESKTOP-G2Q81C0

Security


- EventData

SubjectUserSid S-1-5-18
SubjectUserName DESKTOP-G2Q81C0$
SubjectDomainName WORKGROUP
SubjectLogonId 0x3e7
SchemaFriendlyName NGC Local Accoount Logon Vault Resource Schema
Schema {1d4350a3-330d-4af9-b3ff-a927a45998ac}
Resource NGC Local Accoount Logon Vault Resource
Identity 0105000000000005150000005018FF33678EABCE8E0B16ACED030000
PackageSid
Flags 0
ReturnCode 1168
ProcessCreationTime 2021-09-30T23:08:24.0229176Z
ClientProcessId 1612


- System

- Provider

[ Name] Microsoft-Windows-Security-Auditing
[ Guid] {54849625-5478-4994-a5ba-3e3b0328c30d}

EventID 4624

Version 2

Level 0

Task 12544

Opcode 0

Keywords 0x8020000000000000

- TimeCreated

[ SystemTime] 2021-09-30T23:08:27.1909908Z

EventRecordID 786215

- Correlation

[ ActivityID] {f3eea5c0-b5a5-0006-d4a5-eef3a5b5d701}

- Execution

[ ProcessID] 804
[ ThreadID] 2404

Channel Security

Computer DESKTOP-G2Q81C0

Security


- EventData

SubjectUserSid S-1-5-18
SubjectUserName DESKTOP-G2Q81C0$
SubjectDomainName WORKGROUP
SubjectLogonId 0x3e7
TargetUserSid S-1-5-18
TargetUserName SYSTEM
TargetDomainName NT AUTHORITY
TargetLogonId 0x3e7
LogonType 5
LogonProcessName Advapi
AuthenticationPackageName Negotiate
WorkstationName -
LogonGuid {00000000-0000-0000-0000-000000000000}
TransmittedServices -
LmPackageName -
KeyLength 0
ProcessId 0x318
ProcessName C:\Windows\System32\services.exe
IpAddress -
IpPort -
ImpersonationLevel %%1833
RestrictedAdminMode -
TargetOutboundUserName -
TargetOutboundDomainName -
VirtualAccount %%1843
TargetLinkedLogonId 0x0
ElevatedToken %%1842

- System

- Provider

[ Name] Microsoft-Windows-Security-Auditing
[ Guid] {54849625-5478-4994-a5ba-3e3b0328c30d}

EventID 4672

Version 0

Level 0

Task 12548

Opcode 0

Keywords 0x8020000000000000

- TimeCreated

[ SystemTime] 2021-09-30T23:08:27.1909988Z

EventRecordID 786216

- Correlation

[ ActivityID] {f3eea5c0-b5a5-0006-d4a5-eef3a5b5d701}

- Execution

[ ProcessID] 804
[ ThreadID] 2404

Channel Security

Computer DESKTOP-G2Q81C0

Security


- EventData

SubjectUserSid S-1-5-18
SubjectUserName SYSTEM
SubjectDomainName NT AUTHORITY
SubjectLogonId 0x3e7
PrivilegeList SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege

- System

- Provider

[ Name] Windows Error Reporting

- EventID 1001

[ Qualifiers] 0

Version 0

Level 4

Task 0

Opcode 0

Keywords 0x80000000000000

- TimeCreated

[ SystemTime] 2021-09-30T23:08:30.8568024Z

EventRecordID 84060

Correlation

- Execution

[ ProcessID] 0
[ ThreadID] 0

Channel Application

Computer DESKTOP-G2Q81C0

Security


- EventData

1253173323343951595
5
AppHangB1
Not available
0
MySQLWorkbench.exe
8.0.26.0
60db0058
8335
134217728





\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF467.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF478.tmp.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF487.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF4A7.tmp.txt \\?\C:\Users\OPTIPLEX9010\AppData\Local\Temp\WERFD14.tmp.appcompat.txt
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppHang_MySQLWorkbench.e_1c816f88bd78fdb0dda2616afa37d2238075d360_075a4268_c25f6269-fc2d-4e57-8982-6d724dc76f1c

0
75cdb688-234d-4e2f-8757-16f7fcd5afc9
268435456
bc5db2a7b139db7491642a7f7be976eb
0

- System

- Provider

[ Name] Application Hang

- EventID 1002

[ Qualifiers] 0

Version 0

Level 2

Task 101

Opcode 0

Keywords 0x80000000000000

- TimeCreated

[ SystemTime] 2021-09-30T23:08:32.8570597Z

EventRecordID 84061

Correlation

- Execution

[ ProcessID] 0
[ ThreadID] 0

Channel Application

Computer DESKTOP-G2Q81C0

Security


- EventData

MySQLWorkbench.exe
8.0.26.0
e34
01d7b64f54b11c42
15
C:\Program Files\MySQL\MySQL Workbench 8.0\MySQLWorkbench.exe
75cdb688-234d-4e2f-8757-16f7fcd5afc9


Unknown
55006E006B006E006F0077006E0000000000


--------------------------------------------------------------------------------

Binary data:


In Words

0000: 006E0055 006E006B 0077006F 0000006E
0010: 0000


In Bytes

0000: 55 00 6E 00 6B 00 6E 00 U.n.k.n.
0008: 6F 00 77 00 6E 00 00 00 o.w.n...
0010: 00 00 ..