Running the autorun for ARM64 yields this:
- <Event xmlns="
http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="
Application Error" Guid="
{a0e9b465-b939-57d7-b27d-95d8e925ff57}" />
<EventID>1000</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>100</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="
2024-09-23T03:46:25.4441392Z" />
<EventRecordID>1852</EventRecordID>
<Correlation />
<Execution ProcessID="
7584" ThreadID="
8780" />
<Channel>Application</Channel>
<Computer>MSM1UltraGareth</Computer>
<Security UserID="
S-1-5-21-2905184571-1333223065-1864081360-1001" />
</System>
- <EventData>
<Data Name="
AppName">PTAgent.exe</Data>
<Data Name="
AppVersion">20.0.1.55659</Data>
<Data Name="
AppTimeStamp">66e6ec33</Data>
<Data Name="
ModuleName">PTAgent.exe</Data>
<Data Name="
ModuleVersion">20.0.1.55659</Data>
<Data Name="
ModuleTimeStamp">66e6ec33</Data>
<Data Name="
ExceptionCode">c000001d</Data>
<Data Name="
FaultingOffset">0001878a</Data>
<Data Name="
ProcessId">0x1820</Data>
<Data Name="
ProcessCreationTime">0x1db0d6b29e2232e</Data>
<Data Name="
AppPath">D:\PTAgent.exe</Data>
<Data Name="
ModulePath">D:\PTAgent.exe</Data>
<Data Name="
IntegratorReportId">a77e3217-a466-41b3-9565-c506c138c6a6</Data>
<Data Name="
PackageFullName" />
<Data Name="
PackageRelativeAppId" />
</EventData>
</Event>
PTAgent crash:
<Event xmlns="
http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="
Windows Error Reporting" Guid="
{0ead09bd-2157-539a-8d6d-c87f95b64d70}" />
<EventID>1001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="
2024-09-23T03:46:26.2875738Z" />
<EventRecordID>1855</EventRecordID>
<Correlation />
<Execution ProcessID="
10852" ThreadID="
4232" />
<Channel>Application</Channel>
<Computer>MSM1UltraGareth</Computer>
<Security UserID="
S-1-5-18" />
</System>
- <EventData>
<Data Name="
Bucket">2215326170925454677</Data>
<Data Name="
BucketType">1</Data>
<Data Name="
EventName">APPCRASH</Data>
<Data Name="
Response">Not available</Data>
<Data Name="
CabId">0</Data>
<Data Name="
P1">PTAgent.exe</Data>
<Data Name="
P2">20.0.1.55659</Data>
<Data Name="
P3">66e6ec33</Data>
<Data Name="
P4">PTAgent.exe</Data>
<Data Name="
P5">20.0.1.55659</Data>
<Data Name="
P6">66e6ec33</Data>
<Data Name="
P7">c000001d</Data>
<Data Name="
P8">0001878a</Data>
<Data Name="
P9" />
<Data Name="
P10" />
<Data Name="
AttachedFiles">\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.adf470dd-8714-476c-a993-99dc7284eeb3.tmp.WERInternalMetadata.xml</Data>
<Data Name="
StorePath">\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_PTAgent.exe_2d1084923885f795ed9f33de6b7dbd46f78bbe7c_c712d731_8a617dc2-4b13-460d-a460-41794c92977f</Data>
<Data Name="
AnalysisSymbol" />
<Data Name="
Rechecking">0</Data>
<Data Name="
ReportId">a77e3217-a466-41b3-9565-c506c138c6a6</Data>
<Data Name="
ReportStatus">268435456</Data>
<Data Name="
HashedBucket">6c037abae1235b81eebe6b6a47a35555</Data>
<Data Name="
CabGuid">0</Data>
</EventData>
</Event>
Of course it'd be easier to pull this stuff out if I had tools running on the VM that allowed me to cut and paste etc...