The following event properties can be used with image load events in uAQL queries (event type Image.Load). In addition to the properties listed here, the common properties are applicable, too.
Property name
uAQL Data Type
Description
Image.Name
String
The image’s file name (e.g., userenv.dll)
Image.Path
String
The image’s full path including the image file name
Image.Hash.Type
Integer
The type of the hash. 1 = MD5, 2 = SHA-1, 3 = SHA-256, 4 = ImpHash
Image Load Event Properties
The following event properties can be used with image load events in uAQL queries (event type
Image.Load). In addition to the properties listed here, the common properties are applicable, too.Image.Nameuserenv.dll)Image.PathImage.Hash.TypeImage.Hash.Value