Image_V1_Load class

This class is the event type class for image load events.

The following syntax is simplified from MOF code.

Syntax

[EventType(10), EventTypeName("Load")]
class Image_V1_Load : Image_V1
{
  uint32 ImageBase;
  uint32 ImageSize;
  uint32 ProcessId;
  string FileName;
};

Members

The Image_V1_Load class has these types of members:

• Properties

Properties

The Image_V1_Load class has these properties.

FileName

Data type: string

Access type: Read-only

Qualifiers: WmiDataId(4), StringTermination("NullTerminated"), Format("w")

File name and extension of the DLL or executable image to load.

ImageBase

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(1), Pointer

Base address of the application in which the image is loaded.

ImageSize

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(2), Pointer

Size of the image being loaded.

When consuming this property, the data type for this property is actually size_t. The Pointer qualifier is used to determine if the size_t is 4-bytes or 8-bytes.

ProcessId

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(3)

Identifies the process into which the image is loaded.

Requirements

See also

Image_V1