Post #3837653
2026-07-15 17:19 UTC
@Fringedcrow@infosec.exchange
Does this happen once or occasionally?
Maybe turn on process audit logging (if it's not) and look at the 4688 events.
If you can repro it try using procmon or even a debugger.
Replies (1)
-
@Fringedcrow@infosec.exchange 2026-07-15 17:29
@FritzAdalis@infosec.exchange It's occasionally with the same 2 users. never the same time when it happens. So letting procmon run that long, i might not be able to open that file. i've checked the event viewer for that, not finding anything.