---
title: "Exploring Absurdity: Windows Event Logs and Binary Logs"
description: Dive into the quirky world of Windows Event Logs, including a detailed walk-through on handling event 1002 and decoding hidden binary data. Find answers!
---

[Gravwell Blog ](https://www.gravwell.io/blog)

# [Exploring Absurdity: Windows Event Logs and Binary Logs](https://www.gravwell.io/blog/absurdity-of-windows-logs)

 Written by [Gravwell](https://www.gravwell.io/blog/author/gravwell) | May 19, 2021 7:26:04 PM

In our first part of the *WTF Windows!?!?!* Query of the Week, we are going to jump into a fun hunt.  Long story short, we had some system applications that were hanging, Windows has an event for this 1002.  Great, lets go see why they were hanging! 

##### The Raw Log

```
 
```

`<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>`  
`<System>`  
`<Provider Name='Application Hang'/>`  
`<EventID Qualifiers='0'>1002</EventID>`  
`<Level>2</Level>`  
`<Task>101</Task>`  
`<Keywords>0x80000000000000</Keywords>`  
`<TimeCreated SystemTime='2021-05-07T17:03:37.913165700Z'/>`  
`<EventRecordID>1344</EventRecordID>`  
`<Channel>Application</Channel>`  
`<Computer>ad.traetox.net</Computer>`  
`<Security/>`  
`</System>`  
`<EventData>`  
`<Data>iexplore.exe</Data>`  
`<Data>11.0.17763.592</Data>`  
`<Data>8a0</Data>`  
`<Data>01d74362b99895fa</Data>`  
`<Data>60000</Data>`  
`<Data>C:\Program Files (x86)\Internet Explorer\iexplore.exe</Data>`  
`<Data>0df1f355-f43a-43d3-8205-07df810b6a76</Data>`  
`<Data></Data><Data></Data>`  
`<Data>Unknown</Data>`  
`<Binary>55006E006B006E006F0077006E0000000000</Binary>`  
`</EventData>`  
`</Event>`

```
 
```

Ok, we have an application, some unstructured execution parameters, version strings, some opaque hex numbers.  Cool cool...  OOOOH Binary.  Clearly that is where all the secrets lie!  Lets decode it! 

```
 
```

`tag=windows winlog Computer Provider=="Application Hang" EventID==1002`  
`Binary EventData | regex -e EventData "<Data>(?P<exe>[^<]+)</Data>" | hexlify -d Binary | table TIMESTAMP Computer exe Binary`

```
 
```

Soo... 55006E006B006E006F0077006E0000000000 decodes to "Unknown" in UTF-16.  Thanks... And double thanks for the multiple NULL characters at the end.

##### Screenshots: <https://www.gravwell.io/hubfs/blogimages/QOTW_WinLog-oooh-binary.png>

<https://www.gravwell.io/hubfs/blogimages/QOTW_WinLog-dangit-Microsoft.png>

<https://www.gravwell.io/hubfs/blogimages/QOTW_WinLog-final-output.png>

 

Next week we'll look at removable storage events; you know, the things that make your air gap NOT an airgap!

If you have retrieved this result from your logs and wish to discuss it with others, feel free to join our Discord and engage with our team of data experts.

[View full post](https://www.gravwell.io/blog/absurdity-of-windows-logs)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Gravwell"
  },
  "dateModified" : "2025-08-23T21:38:00.879Z",
  "datePublished" : "2021-05-19T19:26:04Z",
  "headline" : "Exploring Absurdity: Windows Event Logs and Binary Logs",
  "image" : {
    "@type" : "ImageObject",
    "height" : 60,
    "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
    "width" : 60
  },
  "mainEntityOfPage" : "https://www.gravwell.io/blog/absurdity-of-windows-logs",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Want deeper insights? Read exclusive commentary from the Gravwell team on the issues that matter most. "
  }
}
```