event viewer question; evidence of force quit rather than error?

[rtpgh]

Greetings Everyone,

I've been trying to determine, via the Event Viewer in Windows 10, if a program was intentionally force quit through the taskmanager rather than a software error.

When I replicate the sequence, I'm unable to directly see an instance of taskmanager.

However, when repeating the sequence I do see, under security, an event that appears during force quit that matches an event at the time of the original incident.

Is anyone able to read the events below and tell me if the data indicate a force quit rather than a program error? I'm including the original instance, then my replicated sequence.
For instance, I know that S-1-5-18 is a special account used by the operating system.

Or do these security events only indicate that a program terminated, and for all intents and purposes would also occur if an error closed the program, not an intentional force quit?

Thank you for any insight,

R

 

[Ralston18]

Logs are sequential so some parameters (some "count") will change no matter what.

Copy and paste both the Original Event and Replicated force event data into two adjacent Excel columns.

Doing so will make it easier to spot any differences. I noted several differences. E.g., ProcessID, ThreadID.

ProcessId is "0x364" and then "0x2f0"

Change the cell coloring for any pairings that are different. (Easily automated....)

May help you narrow down the differences and the possibilities...

The key is setting up a controlled test that only changes one variable at a time.

Something separate from the log sequences.

 

[rtpgh]

Thank you for the reply. At the time of the post, I didn't have access to the computer where the event occurred, so the replicated event didn't involve the same computer or software app.

So I took your advice tonight and tried to reproduce the event as best as possible on the same computer, with the same software. The software was upgraded since the event, so I reinstalled the original version.

I do see the Process ID is different, but I'm told these are dynamic and change between boots.

Here is a PDF comparing the app closing (in two parts) and the security events beforehand (on left) against a replicated event (on right):

https://www.NoFile.io/f/aQVKysSTFyQ