Suspicious log entries in Processmonitor?

[alogrep 0]

Hi.

I found these 3 lines thata semm VERY suspicious to me in Processmonitor. Is there something wrong with my delphi 12 installations?

04:14:27.0519775 p. m.    Explorer.EXE    9964    RegQueryValue    HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\C:\Program Files (x86)\Embarcadero\Studio\23.0\bin\bds.exe    NAME NOT FOUND    Length: 16

04:14:27.0526399 p. m.    Explorer.EXE    9964    CreateFileMapping    C:\Program Files (x86)\Embarcadero\Studio\23.0\bin\bds.exe    FILE LOCKED WITH ONLY READERS    SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_READ

04:14:27.0902689 p. m.    Explorer.EXE    9964    CreateFileMapping    C:\Program Files (x86)\Embarcadero\Studio\23.0\bin\bds.exe.config    FILE LOCKED WITH ONLY READERS    SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_READ
 

[Lars Fosdal 1732]

There is nothing unusual with Explorer querying a registry entry that doesn't exist. In this case, it checks for Application Compatibility flags and finds none for bds.exe.

Nor is there anything unusual about Explorer reading from the files to extract things like file information resources.

In computing like in medicine - it is only when the patience appear sick that you start examining the symptoms in detail.

[David Heffernan 2300]

Best to remove process monitor and get on with something else!

[David Heffernan 2300]

9 hours ago, Lars Fosdal said:

Nor is there anything unusual about Explorer reading from the files to extract things like file information resources.

Actually this just looks like what you'd expect to see during process creation. First we check for app compat. We don't find that, fine as you say. And then we map the exe.

Edited January 16 by David Heffernan