eventlog

Log Name:      Application
Source:        Application Error
Date:          8/7/2014 10:42:23 PM
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      theater.xxxxxxx.com
Description:
Faulting application name: ehshell.exe, version: 6.1.7600.16385, time stamp: 0x4a5bd053
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x0000000000000000
Faulting process id: 0x%9
Faulting application start time: 0x%10
Faulting application path: %11
Faulting module path: %12
Report Id: %13
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Error" />
    <EventID Qualifiers="0">1000</EventID>
    <Level>2</Level>
    <Task>100</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-08-08T05:42:23.000000000Z" />
    <EventRecordID>6447</EventRecordID>
    <Channel>Application</Channel>
    <Computer>theater.xxxxxxx.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data>ehshell.exe</Data>
    <Data>6.1.7600.16385</Data>
    <Data>4a5bd053</Data>
    <Data>unknown</Data>
    <Data>0.0.0.0</Data>
    <Data>00000000</Data>
    <Data>c0000005</Data>
    <Data>0000000000000000</Data>
  </EventData>
</Event>