Common Process Functions

Registry Operations:
RegOpenKey
The process opened the Registry key specified in the Path column.

RegCloseKey
The process closed the Registry key specified in the Path column.

RegQueryValue
The process queried for the value of the Registry value listed in the Path statement. The value retrieved is listed in the Detail column.

RegEnumValue
The process is querying the value names and their data for the key in the Path. You will see repeated RegEnumValue and RegQueryValue operations
until all the values under this key have been enumerated.

RegQueryKey
The process queried the Registry key listed in the Path for information about the key. This information, such as the amount of values or subkeys
underneath it, is displayed in the Detail column.

RegEnumKey
The process queried the Registry key listed in the Path for information about it’s subkeys. You will see further RegEnumKey entries until there are no
more subkeys to enumerate.

RegCreateKey
The process attempted to create the key specified in the Path column.

RegSetValue
The process created or set the data of the value in the Path column with the information from the Detail column.

 

======================================================================================

File Operations:
QueryBasicInformationFile (FASTIO_QUERY_INFORMATION)
The process queried the file in the Path column for one of the following attributes:
CreationTime, LastAccessTime, LastWriteTime, ChangeTime, FileAttributes

QueryStandardInformationFile(FASTIO_QUERY_INFORMATION)
The process queried the file in the Path column for one of the following attributes:
AllocationSize, EndOfFile, NumberOfLinks, DeletePending, Directory

QueryNameInformationFile (IRP_MJ_QUERY_INFORMATION)
The process queried the file in the Path column for one of the following attributes: FileNameLength, FileName

SetBasicInformationFile (IRP_MJ_SET_INFORMATION)
The process changed one of the following attributes in the file in the Path field:
CreationTime, LastAccessTime, LastWriteTime, ChangeTime, FileAttributes

QueryOpen (FASTIO_NETWORK_QUERY_OPEN)
Appears before each CreateFile operation, checks for file specified in the Path.

CreateFile (IRP_MJ_CREATE)
The process opened or created the file specified in the Path. Whether the file was opened or created can be determined by the Disposition value in the
Details column.

CloseFile (IRP_MJ_CLEANUP)
The process closed the file specified in the Path.

QueryDirectory (IRP_MJ_DIRECTORY_CONTROL)
The process queried the contents of the directory listed in the Path. This listing will be found in the Details column.

WriteFile (IRP_MJ_WRITE)
The process wrote data to the file specified in the Path. The location written to in the file and the amount of data is specified in the Details column.

ReadFile (IRP_MJ_READ)
The process is reading the file specified in the Path statement. The Details column will tell you how many bytes were read during this operation. You
will see more ReadFile operations until an End of File (EOF) is reached.

SetEndOfFileInformationFile (IRP_MJ_SET_INFORMATION)
The process set the offset which the file’s End of File should be set to. This value is listed in the Details column.

SetRenameFileInformationFile (IRP_MJ_SET_INFORMATION)
The process renamed the file or directory in the Path column to the file or directory found in the Details column.

 

=====================================================================================
Process Operations:
Thread Create
The process opened the Registry key specified in the Path column..

Thread Exit
The process closed the Registry key specified in the Path column.

Process Exit
The process queried for the value of the Registry value listed in the Path statement. The value retrieved is listed in the Detail column.