Image_V1_Load class
This class is the event type class for image load events.
The following syntax is simplified from MOF code.
[EventType(10), EventTypeName("Load")]
class Image_V1_Load : Image_V1
{
uint32 ImageBase;
uint32 ImageSize;
uint32 ProcessId;
string FileName;
};
The Image_V1_Load class has these types of members:
The Image_V1_Load class has these properties.
-
FileName
-
-
Data type: string
-
Access type: Read-only
-
Qualifiers: WmiDataId(4), StringTermination("NullTerminated"), Format("w")
File name and extension of the DLL or executable image to load.
-
-
ImageBase
-
-
Data type: uint32
-
Access type: Read-only
-
Qualifiers: WmiDataId(1), Pointer
Base address of the application in which the image is loaded.
-
-
ImageSize
-
-
Data type: uint32
-
Access type: Read-only
-
Qualifiers: WmiDataId(2), Pointer
Size of the image being loaded.
When consuming this property, the data type for this property is actually size_t. The Pointer qualifier is used to determine if the size_t is 4-bytes or 8-bytes.
-
-
ProcessId
-
-
Data type: uint32
-
Access type: Read-only
-
Qualifiers: WmiDataId(3)
Identifies the process into which the image is loaded.
-
Requirement | Value |
---|---|
Minimum supported client |
Windows XP [desktop apps only] |
Minimum supported server |
Windows Server 2003 [desktop apps only] |