viewer9 documentation

RegCloseKey PML Operation

The evdata of this event only contains the Path.

Example from 32-bit PML

Hover over field values like Time, ResultCode, and bytes of evdata in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.

RegCloseKey opcode=2,2

ev=5710

Time:	2011-01-20 16:47:04.9259238
Duration:	0.0000035
ResultCode:	SUCCESS
Tid:	2772

Path:	HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers

evdata[0-63] file offset 481396

0	3e 80 48 4b 4c 4d 5c 53	>.HKLM\S
8	4f 46 54 57 41 52 45 5c	OFTWARE\
16	50 6f 6c 69 63 69 65 73	Policies
24	5c 4d 69 63 72 6f 73 6f	\Microso
32	66 74 5c 57 69 6e 64 6f	ft\Windo
40	77 73 5c 53 61 66 65 72	ws\Safer
48	5c 43 6f 64 65 49 64 65	\CodeIde
56	6e 74 69 66 69 65 72 73	ntifiers

Call Stack stacksize=9

StackAddress	mod	ModName	ModPath
0x8054164c	79	ntkrnlpa.exe + 0x6a64c	C:\WINDOWS\system32\ntkrnlpa.exe
0x7c91c9f3	37	ntdll.dll + 0x1c9f3	C:\WINDOWS\system32\ntdll.dll
0x7c91c66a	37	ntdll.dll + 0x1c66a	C:\WINDOWS\system32\ntdll.dll
0x7c91626a	37	ntdll.dll + 0x1626a	C:\WINDOWS\system32\ntdll.dll
0x7c9164d3	37	ntdll.dll + 0x164d3	C:\WINDOWS\system32\ntdll.dll
0x7c9386f9	37	ntdll.dll + 0x386f9	C:\WINDOWS\system32\ntdll.dll
0x7c938aec	37	ntdll.dll + 0x38aec	C:\WINDOWS\system32\ntdll.dll
0x7c9210af	37	ntdll.dll + 0x210af	C:\WINDOWS\system32\ntdll.dll
0x7c90e457	37	ntdll.dll + 0xe457	C:\WINDOWS\system32\ntdll.dll