Logfile-FAIL.CSV
text/csv
Filename: Logfile-FAIL.CSV
Type: text/csv
Part: 1
"Time of Day","Process Name","PID","Operation","Path","Result","Detail" "6:46:01.7192801 AM","connect.EXE","912","RegQueryKey","HKLM","SUCCESS","Query: <Unknown: 7 >" "6:46:01.7192850 AM","connect.EXE","912","RegOpenKey","HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Winsock","REPARSE","Desired Access: Read" "6:46:01.7192907 AM","connect.EXE","912","RegOpenKey","HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Winsock","SUCCESS","Desired Access: Read" "6:46:01.7192966 AM","connect.EXE","912","RegQueryValue","HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Winsock\MinSockaddrLength","SUCCESS","Type: REG_DWORD, Length: 4, Data: 16" "6:46:01.7193012 AM","connect.EXE","912","RegQueryValue","HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Winsock\MaxSockaddrLength","SUCCESS","Type: REG_DWORD, Length: 4, Data: 16" "6:46:01.7193054 AM","connect.EXE","912","RegQueryValue","HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Winsock\UseDelayedAcceptance","SUCCESS","Type: REG_DWORD, Length: 4, Data: 0" "6:46:01.7193106 AM","connect.EXE","912","RegCloseKey","HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Winsock","SUCCESS","" "6:46:01.7201104 AM","connect.EXE","912","RegCloseKey","HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9","SUCCESS","" "6:46:01.7201252 AM","connect.EXE","912","RegCloseKey","HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5","SUCCESS","" "6:46:01.7202319 AM","connect.EXE","912","FASTIO_NETWORK_QUERY_OPEN","C:\Windows\System32\kernel.appcore.dll","FAST IO DISALLOWED","" "6:46:01.7203969 AM","connect.EXE","912","IRP_MJ_CREATE","C:\Windows\System32\kernel.appcore.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened" "6:46:01.7204185 AM","connect.EXE","912","FASTIO_QUERY_INFORMATION","C:\Windows\System32\kernel.appcore.dll","SUCCESS","Type: QueryBasicInformationFile, CreationTime: 11/21/2014 7:47:53 AM, LastAccessTime: 11/21/2014 7:47:53 AM, LastWriteTime: 11/21/2014 7:47:53 AM, ChangeTime: 12/4/2019 2:31:34 PM, FileAttributes: A" "6:46:01.7204290 AM","connect.EXE","912","IRP_MJ_CLEANUP","C:\Windows\System32\kernel.appcore.dll","SUCCESS","" "6:46:01.7204435 AM","connect.EXE","912","IRP_MJ_CLOSE","C:\Windows\System32\kernel.appcore.dll","SUCCESS","" "6:46:01.7205422 AM","connect.EXE","912","IRP_MJ_CREATE","C:\Windows\System32\kernel.appcore.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened" "6:46:01.7205920 AM","connect.EXE","912","FASTIO_ACQUIRE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\kernel.appcore.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: " "6:46:01.7206011 AM","connect.EXE","912","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\kernel.appcore.dll","SUCCESS","" "6:46:01.7206088 AM","connect.EXE","912","FASTIO_ACQUIRE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\kernel.appcore.dll","SUCCESS","SyncType: SyncTypeOther" "6:46:01.7206139 AM","connect.EXE","912","FASTIO_RELEASE_FOR_SECTION_SYNCHRONIZATION","C:\Windows\System32\kernel.appcore.dll","SUCCESS","" "6:46:01.7208406 AM","connect.EXE","912","IRP_MJ_READ","C:\Windows\System32\mswsock.dll","SUCCESS","Offset: 78,848, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal" "6:46:01.7208457 AM","connect.EXE","912","IRP_MJ_CLEANUP","C:\Windows\System32\kernel.appcore.dll","SUCCESS","" "6:46:01.7208579 AM","connect.EXE","912","IRP_MJ_CLOSE","C:\Windows\System32\kernel.appcore.dll","SUCCESS","" "6:46:01.7215400 AM","connect.EXE","912","RegOpenKey","HKLM\SYSTEM\CurrentControlSet\Control\Session Manager","REPARSE","Desired Access: Query Value, Enumerate Sub Keys" "6:46:01.7215594 AM","connect.EXE","912","RegOpenKey","HKLM\System\CurrentControlSet\Control\Session Manager","SUCCESS","Desired Access: Query Value, Enumerate Sub Keys" "6:46:01.7215765 AM","connect.EXE","912","RegQueryValue","HKLM\System\CurrentControlSet\Control\SESSION MANAGER\ResourcePolicies","NAME NOT FOUND","Length: 24" "6:46:01.7215895 AM","connect.EXE","912","RegCloseKey","HKLM\System\CurrentControlSet\Control\SESSION MANAGER","SUCCESS","" "6:46:01.7224784 AM","connect.EXE","912","IRP_MJ_CLEANUP","C:\src\postgresql\src\test\modules\connect","SUCCESS","" "6:46:01.7224892 AM","connect.EXE","912","IRP_MJ_CLOSE","C:\src\postgresql\src\test\modules\connect","SUCCESS","" "6:46:01.7225069 AM","connect.EXE","912","RegCloseKey","HKLM\System\CurrentControlSet\Control\SESSION MANAGER","SUCCESS","" "6:46:01.7225785 AM","connect.EXE","912","RegCloseKey","HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions","SUCCESS","" "6:46:01.7225825 AM","connect.EXE","912","RegCloseKey","HKLM","SUCCESS","" "6:46:01.7496773 AM","perl.exe","2756","IRP_MJ_READ","C:\Users\Administrator\AppData\Local\Temp\IPC-Run.tmp\Win32io-002756-00053866","END OF FILE","Offset: 0, Length: 999,999, Priority: Normal" "6:46:01.7497439 AM","perl.exe","2756","IRP_MJ_DEVICE_CONTROL","C:\Users\Administrator\AppData\Local\Temp\IPC-Run.tmp\Win32io-002756-00053866","FAST IO DISALLOWED","Control: 0x12043 (Device:0x1 Function:2064 Method: 3)"