Fibratus relies on Windows ETW API to collect the raw information emitted from the operating system’s kernel. The kernel stream collector (kstreamc) deals with the basic decoding of the ETW data by installing the callback interface on the kernel event stream. Each of the kernel events is routed from the collector to a chain of parsers. Before hitting the parsers, the event queries the thread registry to get the process associated with the occurrence of the kernel event.