{ "WINDOWS10_GENERIC": { "Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\winlogon.exe", "Cmd": null, "CreateTime": "2025-03-06T17:49:34+00:00", "ExitTime": null, "Handles": null, "ImageFileName": "winlogon.exe", "Offset(V)": 145201769754752, "PID": 3616, "PPID": 3568, "Path": null, "SessionId": 2, "Threads": 3, "Wow64": false, "__children": [ { "Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe", "Cmd": null, "CreateTime": "2025-03-06T17:50:15+00:00", "ExitTime": "2025-03-06T17:50:32+00:00", "Handles": null, "ImageFileName": "userinit.exe", "Offset(V)": 145201786712256, "PID": 4832, "PPID": 3616, "Path": null, "SessionId": 2, "Threads": 0, "Wow64": false, "__children": [ { "Audit": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe", "Cmd": "C:\\Windows\\Explorer.EXE", "CreateTime": "2025-03-06T17:50:17+00:00", "ExitTime": null, "Handles": null, "ImageFileName": "explorer.exe", "Offset(V)": 145201787191488, "PID": 4912, "PPID": 4832, "Path": "C:\\Windows\\Explorer.EXE", "SessionId": 2, "Threads": 57, "Wow64": false, "__children": [ { "Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\SecurityHealthSystray.exe", "Cmd": "\"C:\\Windows\\System32\\SecurityHealthSystray.exe\" ", "CreateTime": "2025-03-06T17:51:05+00:00", "ExitTime": null, "Handles": null, "ImageFileName": "SecurityHealth", "Offset(V)": 145201826054336, "PID": 1860, "PPID": 4912, "Path": "C:\\Windows\\System32\\SecurityHealthSystray.exe", "SessionId": 2, "Threads": 2, "Wow64": false, "__children": [] }, { "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window --win-session-start", "CreateTime": "2025-03-06T17:51:05+00:00", "ExitTime": null, "Handles": null, "ImageFileName": "msedge.exe", "Offset(V)": 145201826906304, "PID": 3952, "PPID": 4912, "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "SessionId": 2, "Threads": 61, "Wow64": false, "__children": [ { "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --time-ticks-at-unix-epoch=-1741283277737123 --launch-time-ticks=556708795 --always-read-main-dll --field-trial-handle=3928,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:1", "CreateTime": "2025-03-06T17:57:14+00:00", "ExitTime": null, "Handles": null, "ImageFileName": "msedge.exe", "Offset(V)": 145201787768960, "PID": 5348, "PPID": 3952, "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "SessionId": 2, "Threads": 19, "Wow64": false, "__children": [] }, { "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --string-annotations --always-read-main-dll --field-trial-handle=6740,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:8", "CreateTime": "2025-03-06T17:57:52+00:00", "ExitTime": null, "Handles": null, "ImageFileName": "msedge.exe", "Offset(V)": 145201832050880, "PID": 3876, "PPID": 3952, "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "SessionId": 2, "Threads": 8, "Wow64": false, "__children": [] }, { "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=7016,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:8", "CreateTime": "2025-03-06T17:57:59+00:00", "ExitTime": null, "Handles": null, "ImageFileName": "msedge.exe", "Offset(V)": 145201827619008, "PID": 5604, "PPID": 3952, "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "SessionId": 2, "Threads": 14, "Wow64": false, "__children": [] }, { "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=5520,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8", "CreateTime": "2025-03-06T17:57:16+00:00", "ExitTime": null, "Handles": null, "ImageFileName": "msedge.exe", "Offset(V)": 145201827774656, "PID": 1000, "PPID": 3952, "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "SessionId": 2, "Threads": 9, "Wow64": false, "__children": [] }, { "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --time-ticks-at-unix-epoch=-1741283277737123 --launch-time-ticks=596993509 --always-read-main-dll --field-trial-handle=6904,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:1", "CreateTime": "2025-03-06T17:57:54+00:00", "ExitTime": null, "Handles": null, "ImageFileName": "msedge.exe", "Offset(V)": 145201839592000, "PID": 7080, "PPID": 3952, "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "SessionId": 2, "Threads": 15, "Wow64": false, "__children": [] }, { "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --time-ticks-at-unix-epoch=-1741283277737123 --launch-time-ticks=625057436 --always-read-main-dll --field-trial-handle=5592,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1", "CreateTime": "2025-03-06T17:58:23+00:00", "ExitTime": null, "Handles": null, "ImageFileName": "msedge.exe", "Offset(V)": 145201828201216, "PID": 5132, "PPID": 3952, "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "SessionId": 2, "Threads": 17, "Wow64": false, "__children": [] }, { "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --time-ticks-at-unix-epoch=-1741283277737123 --launch-time-ticks=625148972 --always-read-main-dll --field-trial-handle=7112,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1", "CreateTime": "2025-03-06T17:58:23+00:00", "ExitTime": null, "Handles": null, "ImageFileName": "msedge.exe", "Offset(V)": 145201839919232, "PID": 5388, "PPID": 3952, "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "SessionId": 2, "Threads": 15, "Wow64": false, "__children": [] }, { "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=2180,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:3", "CreateTime": "2025-03-06T17:51:14+00:00", "ExitTime": null, "Handles": null, "ImageFileName": "msedge.exe", "Offset(V)": 145201835704512, "PID": 6448, "PPID": 3952, "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "SessionId": 2, "Threads": 16, "Wow64": false, "__children": [] }, { "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "Cmd": null, "CreateTime": "2025-03-06T17:51:16+00:00", "ExitTime": null, "Handles": null, "ImageFileName": "msedge.exe", "Offset(V)": 145201668321408, "PID": 6672, "PPID": 3952, "Path": null, "SessionId": 2, "Threads": 9, "Wow64": false, "__children": [] }, { "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=price_comparison_service.mojom.DataProcessor --lang=en-US --service-sandbox-type=entity_extraction --string-annotations --always-read-main-dll --field-trial-handle=6188,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8", "CreateTime": "2025-03-06T17:58:44+00:00", "ExitTime": null, "Handles": null, "ImageFileName": "msedge.exe", "Offset(V)": 145201830273728, "PID": 6064, "PPID": 3952, "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "SessionId": 2, "Threads": 9, "Wow64": false, "__children": [] }, { "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2472,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:2", "CreateTime": "2025-03-06T17:51:14+00:00", "ExitTime": null, "Handles": null, "ImageFileName": "msedge.exe", "Offset(V)": 145201834049728, "PID": 6456, "PPID": 3952, "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "SessionId": 2, "Threads": 15, "Wow64": false, "__children": [] }, { "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "Cmd": null, "CreateTime": "2025-03-06T17:51:11+00:00", "ExitTime": null, "Handles": null, "ImageFileName": "msedge.exe", "Offset(V)": 145201786340096, "PID": 6204, "PPID": 3952, "Path": null, "SessionId": 2, "Threads": 8, "Wow64": false, "__children": [] } ] }, { "Audit": "\\Device\\HarddiskVolume4\\Users\\generic-user\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe", "Cmd": "\"C:\\Users\\generic-user\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /background", "CreateTime": "2025-03-06T17:51:11+00:00", "ExitTime": null, "Handles": null, "ImageFileName": "OneDrive.exe", "Offset(V)": 145201834340544, "PID": 6160, "PPID": 4912, "Path": "C:\\Users\\generic-user\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe", "SessionId": 2, "Threads": 22, "Wow64": true, "__children": [] }, { "Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", "Cmd": "\"C:\\Windows\\system32\\cmd.exe\" ", "CreateTime": "2025-03-06T17:51:44+00:00", "ExitTime": null, "Handles": null, "ImageFileName": "cmd.exe", "Offset(V)": 145201834332288, "PID": 784, "PPID": 4912, "Path": "C:\\Windows\\system32\\cmd.exe", "SessionId": 2, "Threads": 1, "Wow64": false, "__children": [ { "Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\conhost.exe", "Cmd": null, "CreateTime": "2025-03-06T17:51:49+00:00", "ExitTime": null, "Handles": null, "ImageFileName": "conhost.exe", "Offset(V)": 145201834446976, "PID": 3896, "PPID": 784, "Path": null, "SessionId": 2, "Threads": 3, "Wow64": false, "__children": [] } ] }, { "Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\notepad.exe", "Cmd": "\"C:\\Windows\\system32\\notepad.exe\" ", "CreateTime": "2025-03-06T17:52:33+00:00", "ExitTime": null, "Handles": null, "ImageFileName": "notepad.exe", "Offset(V)": 145201839497344, "PID": 2968, "PPID": 4912, "Path": "C:\\Windows\\system32\\notepad.exe", "SessionId": 2, "Threads": 4, "Wow64": false, "__children": [] } ] } ] }, { "Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\fontdrvhost.exe", "Cmd": null, "CreateTime": "2025-03-06T17:49:42+00:00", "ExitTime": null, "Handles": null, "ImageFileName": "fontdrvhost.ex", "Offset(V)": 145201770697088, "PID": 3812, "PPID": 3616, "Path": null, "SessionId": 2, "Threads": 5, "Wow64": false, "__children": [] }, { "Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\dwm.exe", "Cmd": "\"dwm.exe\"", "CreateTime": "2025-03-06T17:49:42+00:00", "ExitTime": null, "Handles": null, "ImageFileName": "dwm.exe", "Offset(V)": 145201770352768, "PID": 3860, "PPID": 3616, "Path": "C:\\Windows\\system32\\dwm.exe", "SessionId": 2, "Threads": 16, "Wow64": false, "__children": [] } ] } }