Имя журнала: Application
Источник: Microsoft-Windows-User Profiles Service
Дата: 09.07.2018 15:29:07
Код события: 1530
Категория задачи:Отсутствует
Уровень: Сведения
Ключевые слова:
Пользователь: СИСТЕМА
Компьютер: RIG-1050
Описание:
Система Windows обнаружила, что файл реестра все еще используется другими приложениями или службами. Файл будет выгружен, после чего приложения или службы, которые его используют, могут начать работать неправильно. Действий от пользователя не требуется.
ПОДРОБНО:
18 user registry handles leaked from \Registry\User\S-1-5-21-3433136275-4032158903-849953324-1001:
Process 768 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001
Process 848 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\System\GameConfigStore\Parents
Process 3284 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\Software\Microsoft\CommsAPHost\Test
Process 848 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\System\GameConfigStore
Process 1136 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall
Process 3284 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\Software\Microsoft\Windows\CurrentVersion\Explorer
Process 3284 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 376 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 3284 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\Software\Microsoft\Internet Explorer\Main\FeatureControl
Process 376 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\Software\Microsoft\Internet Explorer\Main\FeatureControl
Process 3284 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 376 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 3284 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\Software\Microsoft\Internet Explorer\Main
Process 376 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\Software\Microsoft\Internet Explorer\Main
Process 628 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\Software\Microsoft\Windows NT\CurrentVersion\Fonts
Process 848 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\System\GameConfigStore\Children
Process 3284 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\Software\Microsoft\Internet Explorer\Security
Process 376 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\Software\Microsoft\Internet Explorer\Security
Xml события:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
<EventID>1530</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2018-07-09T12:29:07.657385600Z" />
<EventRecordID>329</EventRecordID>
<Correlation />
<Execution ProcessID="376" ThreadID="5064" />
<Channel>Application</Channel>
<Computer>RIG-1050</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData Name="EVENT_HIVE_LEAK">
<Data Name="Detail">18 user registry handles leaked from \Registry\User\S-1-5-21-3433136275-4032158903-849953324-1001:
Process 768 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001
Process 848 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\System\GameConfigStore\Parents
Process 3284 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\Software\Microsoft\CommsAPHost\Test
Process 848 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\System\GameConfigStore
Process 1136 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall
Process 3284 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\Software\Microsoft\Windows\CurrentVersion\Explorer
Process 3284 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 376 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 3284 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\Software\Microsoft\Internet Explorer\Main\FeatureControl
Process 376 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\Software\Microsoft\Internet Explorer\Main\FeatureControl
Process 3284 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 376 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 3284 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\Software\Microsoft\Internet Explorer\Main
Process 376 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\Software\Microsoft\Internet Explorer\Main
Process 628 (<Unknown>
has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\Software\Microsoft\Windows NT\CurrentVersion\Fonts
Process 848 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\System\GameConfigStore\Children
Process 3284 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\Software\Microsoft\Internet Explorer\Security
Process 376 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3433136275-4032158903-849953324-1001\Software\Microsoft\Internet Explorer\Security
</Data>
</EventData>
</Event>
