"Time of Day","Process Name","PID","Operation","Path","Result","Detail"
"14:01:36.8584126","cmd.exe","5948","Thread Create","","SUCCESS","Thread ID: 8164"
"14:01:36.8591775","cmd.exe","5948","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"14:01:36.8591999","cmd.exe","5948","QueryBasicInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","SUCCESS","CreationTime: 10.10.2025 15:34:53, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:45:59, ChangeTime: 13.10.2025 11:45:59, FileAttributes: A"
"14:01:36.8592073","cmd.exe","5948","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","SUCCESS",""
"14:01:36.8593113","cmd.exe","5948","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
"14:01:36.8593775","cmd.exe","5948","QueryEAFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","SUCCESS",""
"14:01:36.8596226","cmd.exe","5948","CreateFileMapping","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE|PAGE_NOCACHE"
"14:01:36.8597146","cmd.exe","5948","CreateFileMapping","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","SUCCESS","SyncType: SyncTypeOther"
"14:01:36.8598060","cmd.exe","5948","Load Image","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","SUCCESS","Image Base: 0x7ff8d84d0000, Image Size: 0x41000"
"14:01:36.8598747","cmd.exe","5948","RegOpenKey","HKLM\Software\Policies\Microsoft\MUI\Settings","NAME NOT FOUND","Desired Access: Read"
"14:01:36.8598971","cmd.exe","5948","RegOpenKey","HKCU","SUCCESS","Desired Access: Maximum Allowed, Granted Access: All Access"
"14:01:36.8599207","cmd.exe","5948","RegOpenKey","HKCU\Software\Policies\Microsoft\Control Panel\Desktop","NAME NOT FOUND","Desired Access: Read"
"14:01:36.8599326","cmd.exe","5948","RegOpenKey","HKCU\Control Panel\Desktop","SUCCESS","Desired Access: Read"
"14:01:36.8599426","cmd.exe","5948","RegQueryValue","HKCU\Control Panel\Desktop\PreferredUILanguages","BUFFER OVERFLOW","Length: 12"
"14:01:36.8599556","cmd.exe","5948","RegQueryValue","HKCU\Control Panel\Desktop\PreferredUILanguages","SUCCESS","Type: REG_MULTI_SZ, Length: 14, Data: en-GB"
"14:01:36.8599718","cmd.exe","5948","RegCloseKey","HKCU\Control Panel\Desktop","SUCCESS",""
"14:01:36.8599790","cmd.exe","5948","RegCloseKey","HKCU","SUCCESS",""
"14:01:36.8599885","cmd.exe","5948","RegOpenKey","HKLM\Software\Policies\Microsoft\MUI\Settings","NAME NOT FOUND","Desired Access: Read"
"14:01:36.8600008","cmd.exe","5948","RegOpenKey","HKCU","SUCCESS","Desired Access: Maximum Allowed, Granted Access: All Access"
"14:01:36.8600100","cmd.exe","5948","RegOpenKey","HKCU\Software\Policies\Microsoft\Control Panel\Desktop","NAME NOT FOUND","Desired Access: Read"
"14:01:36.8600171","cmd.exe","5948","RegOpenKey","HKCU\Control Panel\Desktop\LanguageConfiguration","SUCCESS","Desired Access: Read"
"14:01:36.8600323","cmd.exe","5948","RegEnumValue","HKCU\Control Panel\Desktop\LanguageConfiguration","SUCCESS","Index: 0, Name: de-DE, Type: REG_MULTI_SZ, Length: 14, Data: en-US"
"14:01:36.8600484","cmd.exe","5948","RegEnumValue","HKCU\Control Panel\Desktop\LanguageConfiguration","SUCCESS","Index: 1, Name: en-GB, Type: REG_MULTI_SZ, Length: 14, Data: en-US"
"14:01:36.8600555","cmd.exe","5948","RegEnumValue","HKCU\Control Panel\Desktop\LanguageConfiguration","NO MORE ENTRIES","Index: 2, Length: 512"
"14:01:36.8600610","cmd.exe","5948","RegCloseKey","HKCU\Control Panel\Desktop\LanguageConfiguration","SUCCESS",""
"14:01:36.8600661","cmd.exe","5948","RegCloseKey","HKCU","SUCCESS",""
"14:01:36.8601175","cmd.exe","5948","RegOpenKey","HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide","SUCCESS","Desired Access: Read"
"14:01:36.8601332","cmd.exe","5948","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest","NAME NOT FOUND","Length: 20"
"14:01:36.8601403","cmd.exe","5948","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide","SUCCESS",""
"14:01:36.8602383","cmd.exe","5948","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
"14:01:36.8608169","cmd.exe","5948","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","SUCCESS",""
"14:01:36.8609820","cmd.exe","5948","Load Image","C:\Windows\System32\advapi32.dll","SUCCESS","Image Base: 0x7ff913b00000, Image Size: 0xb4000"
"14:01:36.8611571","cmd.exe","5948","Load Image","C:\Windows\System32\sechost.dll","SUCCESS","Image Base: 0x7ff9140d0000, Image Size: 0xa6000"
"14:01:36.8612881","cmd.exe","5948","Thread Create","","SUCCESS","Thread ID: 8992"
"14:01:36.8613720","cmd.exe","5948","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","SUCCESS",""
"14:01:36.8614218","cmd.exe","5948","Thread Create","","SUCCESS","Thread ID: 6280"
"14:01:36.8620152","cmd.exe","5948","Thread Create","","SUCCESS","Thread ID: 6044"
"14:01:36.8622151","cmd.exe","5948","Thread Exit","","SUCCESS","Thread ID: 8164, User Time: 0.0000000, Kernel Time: 0.0000000"
"14:01:36.8622158","cmd.exe","5948","RegQueryValue","HKLM\System\CurrentControlSet\Control\WMI\Security\72248411-7166-4feb-a386-34d8f35bb637","NAME NOT FOUND","Length: 528"
"14:01:36.8624363","cmd.exe","5948","CreateFile","C:\Users\Public\Downloads\out.txt","SUCCESS","Desired Access: Generic Write, Read Attributes, Disposition: OverwriteIf, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, AllocationSize: 0, OpenResult: Overwritten"
"14:01:36.8627985","cmd.exe","5948","WriteFile","C:\Users\Public\Downloads\out.txt","SUCCESS","Offset: 0, Length: 1, Priority: Normal"
"14:01:36.8629338","cmd.exe","5948","CloseFile","C:\Users\Public\Downloads\out.txt","SUCCESS",""
"14:01:36.8631062","cmd.exe","5948","CreateFile","C:\Users\Public\Downloads\out.txt","SUCCESS","Desired Access: Generic Write, Read Attributes, Disposition: OverwriteIf, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, AllocationSize: 0, OpenResult: Overwritten"
"14:01:36.8632208","cmd.exe","5948","WriteFile","C:\Users\Public\Downloads\out.txt","SUCCESS","Offset: 0, Length: 1, Priority: Normal"
"14:01:36.8632532","cmd.exe","5948","CloseFile","C:\Users\Public\Downloads\out.txt","SUCCESS",""
"14:01:36.8634383","cmd.exe","5948","CreateFile","C:\Users\Public\Downloads\out.txt","SUCCESS","Desired Access: Generic Write, Read Attributes, Disposition: OverwriteIf, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, AllocationSize: 0, OpenResult: Overwritten"
"14:01:36.8635575","cmd.exe","5948","WriteFile","C:\Users\Public\Downloads\out.txt","SUCCESS","Offset: 0, Length: 1, Priority: Normal"
"14:01:36.8636036","cmd.exe","5948","CloseFile","C:\Users\Public\Downloads\out.txt","SUCCESS",""
"14:01:36.8765826","cmd.exe","5948","QueryNameInformationFile","C:\Windows\System32\ntdll.dll","SUCCESS","Name: \Windows\System32\ntdll.dll"
"14:01:36.8766081","cmd.exe","5948","QueryNameInformationFile","C:\Windows\System32\ntdll.dll","SUCCESS","Name: \Windows\System32\ntdll.dll"
"14:01:36.8886912","cmd.exe","5948","QueryNameInformationFile","C:\Windows\System32\ntdll.dll","SUCCESS","Name: \Windows\System32\ntdll.dll"
"14:01:36.8887109","cmd.exe","5948","QueryNameInformationFile","C:\Windows\System32\ntdll.dll","SUCCESS","Name: \Windows\System32\ntdll.dll"
"14:01:36.9034564","cmd.exe","5948","QueryNameInformationFile","C:\Windows\System32\ntdll.dll","SUCCESS","Name: \Windows\System32\ntdll.dll"
"14:01:36.9034780","cmd.exe","5948","QueryNameInformationFile","C:\Windows\System32\ntdll.dll","SUCCESS","Name: \Windows\System32\ntdll.dll"
"14:01:36.9147710","cmd.exe","5948","QueryNameInformationFile","C:\Windows\System32\ntdll.dll","SUCCESS","Name: \Windows\System32\ntdll.dll"
"14:01:36.9148015","cmd.exe","5948","QueryNameInformationFile","C:\Windows\System32\ntdll.dll","SUCCESS","Name: \Windows\System32\ntdll.dll"
"14:01:36.9151351","cmd.exe","5948","CreateFile","C:\Users\Public\Downloads\out.txt","SUCCESS","Desired Access: Generic Write, Read Attributes, Disposition: OverwriteIf, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, AllocationSize: 0, OpenResult: Overwritten"
"14:01:36.9153092","cmd.exe","5948","WriteFile","C:\Users\Public\Downloads\out.txt","SUCCESS","Offset: 0, Length: 1, Priority: Normal"
"14:01:36.9153676","cmd.exe","5948","CloseFile","C:\Users\Public\Downloads\out.txt","SUCCESS",""
"14:01:36.9157019","cmd.exe","5948","Thread Exit","","SUCCESS","Thread ID: 6044, User Time: 0.0000000, Kernel Time: 0.0312500"