4689
Microsoft-Windows-Security-Auditing
Process Termination
Security
A process has exited.
Subject:
Security ID: MYDOMAIN\some.user
Account Name: some.user
Account Domain: MYDOMAIN
Logon ID: 0x5E006051
Process Information:
Process ID: 0x5ec4
Process Name: C:\Windows\System32\dllhost.exe
Exit Status: 0x0
This event is logged by Windows when a process exits. Also see event 4688 which is logged when a process starts.