{
    "WINDOWS10_GENERIC": {
        "Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\winlogon.exe",
        "Cmd": null,
        "CreateTime": "2025-03-06T17:49:34+00:00",
        "ExitTime": null,
        "Handles": null,
        "ImageFileName": "winlogon.exe",
        "Offset(V)": 145201769754752,
        "PID": 3616,
        "PPID": 3568,
        "Path": null,
        "SessionId": 2,
        "Threads": 3,
        "Wow64": false,
        "__children": [
            {
                "Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe",
                "Cmd": null,
                "CreateTime": "2025-03-06T17:50:15+00:00",
                "ExitTime": "2025-03-06T17:50:32+00:00",
                "Handles": null,
                "ImageFileName": "userinit.exe",
                "Offset(V)": 145201786712256,
                "PID": 4832,
                "PPID": 3616,
                "Path": null,
                "SessionId": 2,
                "Threads": 0,
                "Wow64": false,
                "__children": [
                    {
                        "Audit": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe",
                        "Cmd": "C:\\Windows\\Explorer.EXE",
                        "CreateTime": "2025-03-06T17:50:17+00:00",
                        "ExitTime": null,
                        "Handles": null,
                        "ImageFileName": "explorer.exe",
                        "Offset(V)": 145201787191488,
                        "PID": 4912,
                        "PPID": 4832,
                        "Path": "C:\\Windows\\Explorer.EXE",
                        "SessionId": 2,
                        "Threads": 57,
                        "Wow64": false,
                        "__children": [
                            {
                                "Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\SecurityHealthSystray.exe",
                                "Cmd": "\"C:\\Windows\\System32\\SecurityHealthSystray.exe\" ",
                                "CreateTime": "2025-03-06T17:51:05+00:00",
                                "ExitTime": null,
                                "Handles": null,
                                "ImageFileName": "SecurityHealth",
                                "Offset(V)": 145201826054336,
                                "PID": 1860,
                                "PPID": 4912,
                                "Path": "C:\\Windows\\System32\\SecurityHealthSystray.exe",
                                "SessionId": 2,
                                "Threads": 2,
                                "Wow64": false,
                                "__children": []
                            },
                            {
                                "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                                "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window --win-session-start",
                                "CreateTime": "2025-03-06T17:51:05+00:00",
                                "ExitTime": null,
                                "Handles": null,
                                "ImageFileName": "msedge.exe",
                                "Offset(V)": 145201826906304,
                                "PID": 3952,
                                "PPID": 4912,
                                "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                                "SessionId": 2,
                                "Threads": 61,
                                "Wow64": false,
                                "__children": [
                                    {
                                        "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                                        "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --time-ticks-at-unix-epoch=-1741283277737123 --launch-time-ticks=556708795 --always-read-main-dll --field-trial-handle=3928,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:1",
                                        "CreateTime": "2025-03-06T17:57:14+00:00",
                                        "ExitTime": null,
                                        "Handles": null,
                                        "ImageFileName": "msedge.exe",
                                        "Offset(V)": 145201787768960,
                                        "PID": 5348,
                                        "PPID": 3952,
                                        "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                                        "SessionId": 2,
                                        "Threads": 19,
                                        "Wow64": false,
                                        "__children": []
                                    },
                                    {
                                        "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                                        "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --string-annotations --always-read-main-dll --field-trial-handle=6740,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:8",
                                        "CreateTime": "2025-03-06T17:57:52+00:00",
                                        "ExitTime": null,
                                        "Handles": null,
                                        "ImageFileName": "msedge.exe",
                                        "Offset(V)": 145201832050880,
                                        "PID": 3876,
                                        "PPID": 3952,
                                        "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                                        "SessionId": 2,
                                        "Threads": 8,
                                        "Wow64": false,
                                        "__children": []
                                    },
                                    {
                                        "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                                        "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=7016,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:8",
                                        "CreateTime": "2025-03-06T17:57:59+00:00",
                                        "ExitTime": null,
                                        "Handles": null,
                                        "ImageFileName": "msedge.exe",
                                        "Offset(V)": 145201827619008,
                                        "PID": 5604,
                                        "PPID": 3952,
                                        "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                                        "SessionId": 2,
                                        "Threads": 14,
                                        "Wow64": false,
                                        "__children": []
                                    },
                                    {
                                        "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                                        "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=5520,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8",
                                        "CreateTime": "2025-03-06T17:57:16+00:00",
                                        "ExitTime": null,
                                        "Handles": null,
                                        "ImageFileName": "msedge.exe",
                                        "Offset(V)": 145201827774656,
                                        "PID": 1000,
                                        "PPID": 3952,
                                        "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                                        "SessionId": 2,
                                        "Threads": 9,
                                        "Wow64": false,
                                        "__children": []
                                    },
                                    {
                                        "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                                        "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --time-ticks-at-unix-epoch=-1741283277737123 --launch-time-ticks=596993509 --always-read-main-dll --field-trial-handle=6904,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:1",
                                        "CreateTime": "2025-03-06T17:57:54+00:00",
                                        "ExitTime": null,
                                        "Handles": null,
                                        "ImageFileName": "msedge.exe",
                                        "Offset(V)": 145201839592000,
                                        "PID": 7080,
                                        "PPID": 3952,
                                        "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                                        "SessionId": 2,
                                        "Threads": 15,
                                        "Wow64": false,
                                        "__children": []
                                    },
                                    {
                                        "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                                        "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --time-ticks-at-unix-epoch=-1741283277737123 --launch-time-ticks=625057436 --always-read-main-dll --field-trial-handle=5592,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1",
                                        "CreateTime": "2025-03-06T17:58:23+00:00",
                                        "ExitTime": null,
                                        "Handles": null,
                                        "ImageFileName": "msedge.exe",
                                        "Offset(V)": 145201828201216,
                                        "PID": 5132,
                                        "PPID": 3952,
                                        "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                                        "SessionId": 2,
                                        "Threads": 17,
                                        "Wow64": false,
                                        "__children": []
                                    },
                                    {
                                        "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                                        "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --time-ticks-at-unix-epoch=-1741283277737123 --launch-time-ticks=625148972 --always-read-main-dll --field-trial-handle=7112,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1",
                                        "CreateTime": "2025-03-06T17:58:23+00:00",
                                        "ExitTime": null,
                                        "Handles": null,
                                        "ImageFileName": "msedge.exe",
                                        "Offset(V)": 145201839919232,
                                        "PID": 5388,
                                        "PPID": 3952,
                                        "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                                        "SessionId": 2,
                                        "Threads": 15,
                                        "Wow64": false,
                                        "__children": []
                                    },
                                    {
                                        "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                                        "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=2180,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:3",
                                        "CreateTime": "2025-03-06T17:51:14+00:00",
                                        "ExitTime": null,
                                        "Handles": null,
                                        "ImageFileName": "msedge.exe",
                                        "Offset(V)": 145201835704512,
                                        "PID": 6448,
                                        "PPID": 3952,
                                        "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                                        "SessionId": 2,
                                        "Threads": 16,
                                        "Wow64": false,
                                        "__children": []
                                    },
                                    {
                                        "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                                        "Cmd": null,
                                        "CreateTime": "2025-03-06T17:51:16+00:00",
                                        "ExitTime": null,
                                        "Handles": null,
                                        "ImageFileName": "msedge.exe",
                                        "Offset(V)": 145201668321408,
                                        "PID": 6672,
                                        "PPID": 3952,
                                        "Path": null,
                                        "SessionId": 2,
                                        "Threads": 9,
                                        "Wow64": false,
                                        "__children": []
                                    },
                                    {
                                        "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                                        "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=price_comparison_service.mojom.DataProcessor --lang=en-US --service-sandbox-type=entity_extraction --string-annotations --always-read-main-dll --field-trial-handle=6188,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8",
                                        "CreateTime": "2025-03-06T17:58:44+00:00",
                                        "ExitTime": null,
                                        "Handles": null,
                                        "ImageFileName": "msedge.exe",
                                        "Offset(V)": 145201830273728,
                                        "PID": 6064,
                                        "PPID": 3952,
                                        "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                                        "SessionId": 2,
                                        "Threads": 9,
                                        "Wow64": false,
                                        "__children": []
                                    },
                                    {
                                        "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                                        "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2472,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:2",
                                        "CreateTime": "2025-03-06T17:51:14+00:00",
                                        "ExitTime": null,
                                        "Handles": null,
                                        "ImageFileName": "msedge.exe",
                                        "Offset(V)": 145201834049728,
                                        "PID": 6456,
                                        "PPID": 3952,
                                        "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                                        "SessionId": 2,
                                        "Threads": 15,
                                        "Wow64": false,
                                        "__children": []
                                    },
                                    {
                                        "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                                        "Cmd": null,
                                        "CreateTime": "2025-03-06T17:51:11+00:00",
                                        "ExitTime": null,
                                        "Handles": null,
                                        "ImageFileName": "msedge.exe",
                                        "Offset(V)": 145201786340096,
                                        "PID": 6204,
                                        "PPID": 3952,
                                        "Path": null,
                                        "SessionId": 2,
                                        "Threads": 8,
                                        "Wow64": false,
                                        "__children": []
                                    }
                                ]
                            },
                            {
                                "Audit": "\\Device\\HarddiskVolume4\\Users\\generic-user\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
                                "Cmd": "\"C:\\Users\\generic-user\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /background",
                                "CreateTime": "2025-03-06T17:51:11+00:00",
                                "ExitTime": null,
                                "Handles": null,
                                "ImageFileName": "OneDrive.exe",
                                "Offset(V)": 145201834340544,
                                "PID": 6160,
                                "PPID": 4912,
                                "Path": "C:\\Users\\generic-user\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
                                "SessionId": 2,
                                "Threads": 22,
                                "Wow64": true,
                                "__children": []
                            },
                            {
                                "Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe",
                                "Cmd": "\"C:\\Windows\\system32\\cmd.exe\" ",
                                "CreateTime": "2025-03-06T17:51:44+00:00",
                                "ExitTime": null,
                                "Handles": null,
                                "ImageFileName": "cmd.exe",
                                "Offset(V)": 145201834332288,
                                "PID": 784,
                                "PPID": 4912,
                                "Path": "C:\\Windows\\system32\\cmd.exe",
                                "SessionId": 2,
                                "Threads": 1,
                                "Wow64": false,
                                "__children": [
                                    {
                                        "Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\conhost.exe",
                                        "Cmd": null,
                                        "CreateTime": "2025-03-06T17:51:49+00:00",
                                        "ExitTime": null,
                                        "Handles": null,
                                        "ImageFileName": "conhost.exe",
                                        "Offset(V)": 145201834446976,
                                        "PID": 3896,
                                        "PPID": 784,
                                        "Path": null,
                                        "SessionId": 2,
                                        "Threads": 3,
                                        "Wow64": false,
                                        "__children": []
                                    }
                                ]
                            },
                            {
                                "Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\notepad.exe",
                                "Cmd": "\"C:\\Windows\\system32\\notepad.exe\" ",
                                "CreateTime": "2025-03-06T17:52:33+00:00",
                                "ExitTime": null,
                                "Handles": null,
                                "ImageFileName": "notepad.exe",
                                "Offset(V)": 145201839497344,
                                "PID": 2968,
                                "PPID": 4912,
                                "Path": "C:\\Windows\\system32\\notepad.exe",
                                "SessionId": 2,
                                "Threads": 4,
                                "Wow64": false,
                                "__children": []
                            }
                        ]
                    }
                ]
            },
            {
                "Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\fontdrvhost.exe",
                "Cmd": null,
                "CreateTime": "2025-03-06T17:49:42+00:00",
                "ExitTime": null,
                "Handles": null,
                "ImageFileName": "fontdrvhost.ex",
                "Offset(V)": 145201770697088,
                "PID": 3812,
                "PPID": 3616,
                "Path": null,
                "SessionId": 2,
                "Threads": 5,
                "Wow64": false,
                "__children": []
            },
            {
                "Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\dwm.exe",
                "Cmd": "\"dwm.exe\"",
                "CreateTime": "2025-03-06T17:49:42+00:00",
                "ExitTime": null,
                "Handles": null,
                "ImageFileName": "dwm.exe",
                "Offset(V)": 145201770352768,
                "PID": 3860,
                "PPID": 3616,
                "Path": "C:\\Windows\\system32\\dwm.exe",
                "SessionId": 2,
                "Threads": 16,
                "Wow64": false,
                "__children": []
            }
        ]
    }
}
