admin/cailllev-EDR-Introspection
1
0
Fork 0
mirror of https://github.com/cailllev/EDR-Introspection synced 2026-06-08 13:27:03 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
master
cailllev-EDR-Introspection/docs/LoadLibrary-Tests/MsMpEng-LoadLibrary-ProcMonLog.CSV
T
cailllev 85314ffa31 move files
2025-10-20 19:09:19 +02:00

4197 lines
844 KiB
CSV
Raw Permalink Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
"Time of Day","Process Name","PID","Operation","Path","Result","Detail"
"13:48:27.5486279","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:27.5486430","MsMpEng.exe","3220","RegOpenKey","HKLM\SOFTWARE\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction","SUCCESS","Desired Access: Read/Write"
"13:48:27.5487033","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:27.5487114","MsMpEng.exe","3220","RegOpenKey","HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction","NAME NOT FOUND","Desired Access: Read"
"13:48:27.5487301","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction","NO MORE ENTRIES","Index: 0, Length: 220"
"13:48:27.5487496","MsMpEng.exe","3220","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction","SUCCESS",""
"13:48:27.5771694","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.5771900","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 144’256, Length: 4’096"
"13:48:27.5772238","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 403’816, Length: 4’096"
"13:48:27.5772477","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.5775423","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.5775761","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 399’696, Length: 4’096"
"13:48:27.5776013","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.5835398","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.5835887","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.5836207","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.5836339","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:27.5837392","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\ntdll.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.5837908","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ntdll.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.5838018","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ntdll.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.5838093","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\ntdll.dll","SUCCESS",""
"13:48:27.5846645","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.5846816","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 395’576, Length: 4’096"
"13:48:27.5847044","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.5854297","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.5854567","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:27.5854879","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.5854967","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 148’376, Length: 4’096"
"13:48:27.5855268","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 679’856, Length: 4’096"
"13:48:27.5855498","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.5855746","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:27.5860527","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\ntdll.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.5860818","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\ntdll.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.5860965","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\ntdll.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:59, LastAccessTime: 13.10.2025 13:42:55, LastWriteTime: 30.09.2025 13:54:00, ChangeTime: 01.10.2025 17:29:48, FileAttributes: A, AllocationSize: 1’433’600, EndOfFile: 2’521’976"
"13:48:27.5861087","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\ntdll.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.5861142","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\ntdll.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:59, LastAccessTime: 13.10.2025 13:42:55, LastWriteTime: 30.09.2025 13:54:00, ChangeTime: 01.10.2025 17:29:48, FileAttributes: A, AllocationSize: 1’433’600, EndOfFile: 2’521’976"
"13:48:27.5861221","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ntdll.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.5861303","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\ntdll.dll","SUCCESS",""
"13:48:27.5861475","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\ntdll.dll","SUCCESS",""
"13:48:27.6098690","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\kernel32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6099149","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6099290","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6099395","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\kernel32.dll","SUCCESS",""
"13:48:27.6103226","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\kernel32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6103637","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\kernel32.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6103722","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\kernel32.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:52, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:53:52, ChangeTime: 01.10.2025 17:29:41, FileAttributes: A, AllocationSize: 466’944, EndOfFile: 836’136"
"13:48:27.6103935","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\kernel32.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6104073","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\kernel32.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:52, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:53:52, ChangeTime: 01.10.2025 17:29:41, FileAttributes: A, AllocationSize: 466’944, EndOfFile: 836’136"
"13:48:27.6104186","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel32.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6104270","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\kernel32.dll","SUCCESS",""
"13:48:27.6104488","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\kernel32.dll","SUCCESS",""
"13:48:27.6105220","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\KernelBase.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6105433","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\KernelBase.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6105521","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\KernelBase.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6105714","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\KernelBase.dll","SUCCESS",""
"13:48:27.6107812","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\KernelBase.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6108005","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\KernelBase.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winწ"
"13:48:27.6108165","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\KernelBase.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:52, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:53:52, ChangeTime: 01.10.2025 17:29:47, FileAttributes: A, AllocationSize: 1’785’856, EndOfFile: 4’150’008"
"13:48:27.6108514","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\KernelBase.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winწ"
"13:48:27.6108570","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\KernelBase.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:52, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:53:52, ChangeTime: 01.10.2025 17:29:47, FileAttributes: A, AllocationSize: 1’785’856, EndOfFile: 4’150’008"
"13:48:27.6108649","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\KernelBase.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6108817","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\KernelBase.dll","SUCCESS",""
"13:48:27.6108948","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\KernelBase.dll","SUCCESS",""
"13:48:27.6114914","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\advapi32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6115505","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\advapi32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6115761","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\advapi32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6115853","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\advapi32.dll","SUCCESS",""
"13:48:27.6117397","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\msvcrt.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6117811","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcrt.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6117915","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcrt.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6117997","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\msvcrt.dll","SUCCESS",""
"13:48:27.6118829","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\advapi32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6119405","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\advapi32.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6119516","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\advapi32.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:25, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:53:25, ChangeTime: 01.10.2025 17:29:41, FileAttributes: A, AllocationSize: 393’216, EndOfFile: 745’192"
"13:48:27.6119609","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\advapi32.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6119660","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\advapi32.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:25, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:53:25, ChangeTime: 01.10.2025 17:29:41, FileAttributes: A, AllocationSize: 393’216, EndOfFile: 745’192"
"13:48:27.6119745","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\advapi32.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6119821","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\advapi32.dll","SUCCESS",""
"13:48:27.6120045","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\advapi32.dll","SUCCESS",""
"13:48:27.6120412","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\sechost.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6120716","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\sechost.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6120804","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\sechost.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6120876","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\sechost.dll","SUCCESS",""
"13:48:27.6122052","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\rpcrt4.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6122414","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\rpcrt4.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6122493","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\rpcrt4.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6122567","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\rpcrt4.dll","SUCCESS",""
"13:48:27.6124017","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\msvcrt.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6126810","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\msvcrt.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᅻ"
"13:48:27.6127107","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\msvcrt.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:57, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:53:58, ChangeTime: 01.10.2025 17:29:47, FileAttributes: A, AllocationSize: 405’504, EndOfFile: 699’768"
"13:48:27.6127962","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\msvcrt.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6128189","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\msvcrt.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:57, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:53:58, ChangeTime: 01.10.2025 17:29:47, FileAttributes: A, AllocationSize: 405’504, EndOfFile: 699’768"
"13:48:27.6128333","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcrt.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6129082","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\msvcrt.dll","SUCCESS",""
"13:48:27.6129750","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\msvcrt.dll","SUCCESS",""
"13:48:27.6136426","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\setupapi.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6137211","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\setupapi.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6137333","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\setupapi.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6137415","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\setupapi.dll","SUCCESS",""
"13:48:27.6144921","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\sechost.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6151458","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\sechost.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᅻ"
"13:48:27.6152471","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\sechost.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:09, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:54:09, ChangeTime: 01.10.2025 17:29:41, FileAttributes: A, AllocationSize: 385’024, EndOfFile: 691’520"
"13:48:27.6154232","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\sechost.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᅻ"
"13:48:27.6154744","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\sechost.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:09, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:54:09, ChangeTime: 01.10.2025 17:29:41, FileAttributes: A, AllocationSize: 385’024, EndOfFile: 691’520"
"13:48:27.6157337","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\sechost.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6157806","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\sechost.dll","SUCCESS",""
"13:48:27.6158874","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\sechost.dll","SUCCESS",""
"13:48:27.6159486","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\bcrypt.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6159879","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\bcrypt.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6159980","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\bcrypt.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6160061","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\bcrypt.dll","SUCCESS",""
"13:48:27.6164003","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\fltLib.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6164789","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\fltLib.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6164907","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\fltLib.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6165002","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\fltLib.dll","SUCCESS",""
"13:48:27.6171188","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\newdev.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6171656","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\newdev.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6171766","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\newdev.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6171848","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\newdev.dll","SUCCESS",""
"13:48:27.6177155","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\rpcrt4.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6177819","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\rpcrt4.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6177993","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\rpcrt4.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:06, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:54:06, ChangeTime: 01.10.2025 17:29:41, FileAttributes: A, AllocationSize: 708’608, EndOfFile: 1’162’552"
"13:48:27.6178130","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\rpcrt4.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Win(಼�㈀"
"13:48:27.6178193","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\rpcrt4.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:06, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:54:06, ChangeTime: 01.10.2025 17:29:41, FileAttributes: A, AllocationSize: 708’608, EndOfFile: 1’162’552"
"13:48:27.6178282","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\rpcrt4.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6178359","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\rpcrt4.dll","SUCCESS",""
"13:48:27.6178574","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\rpcrt4.dll","SUCCESS",""
"13:48:27.6178784","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\ucrtbase.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6179311","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ucrtbase.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6179408","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ucrtbase.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6179553","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\ucrtbase.dll","SUCCESS",""
"13:48:27.6180384","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.6180593","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.6186380","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\msdelta.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6187227","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msdelta.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6187581","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msdelta.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6187677","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\msdelta.dll","SUCCESS",""
"13:48:27.6187807","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\setupapi.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6188917","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\setupapi.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6189036","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\setupapi.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:13, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:54:14, ChangeTime: 01.10.2025 17:29:47, FileAttributes: A, AllocationSize: 2’146’304, EndOfFile: 4’794’560"
"13:48:27.6189156","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\setupapi.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6189222","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\setupapi.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:13, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:54:14, ChangeTime: 01.10.2025 17:29:47, FileAttributes: A, AllocationSize: 2’146’304, EndOfFile: 4’794’560"
"13:48:27.6189423","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\setupapi.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6189536","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\setupapi.dll","SUCCESS",""
"13:48:27.6189691","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\setupapi.dll","SUCCESS",""
"13:48:27.6192022","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\cryptsp.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6192430","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\cryptsp.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6192541","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\cryptsp.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6192616","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\cryptsp.dll","SUCCESS",""
"13:48:27.6197451","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\bcrypt.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6198096","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\bcrypt.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6198174","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\cabinet.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6198208","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\bcrypt.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:27, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:53:27, ChangeTime: 01.10.2025 17:29:45, FileAttributes: A, AllocationSize: 90’112, EndOfFile: 166’736"
"13:48:27.6198313","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\bcrypt.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6198377","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\bcrypt.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:27, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:53:27, ChangeTime: 01.10.2025 17:29:45, FileAttributes: A, AllocationSize: 90’112, EndOfFile: 166’736"
"13:48:27.6198567","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\bcrypt.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6198592","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\cabinet.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6198679","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\bcrypt.dll","SUCCESS",""
"13:48:27.6198692","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\cabinet.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6198769","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\cabinet.dll","SUCCESS",""
"13:48:27.6198830","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\bcrypt.dll","SUCCESS",""
"13:48:27.6200180","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.6200461","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.6202065","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\fltLib.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6202608","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\fltLib.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6202686","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\fltLib.dll","BUFFER OVERFLOW","CreationTime: 06.09.2024 06:02:10, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 06.09.2024 06:02:10, ChangeTime: 30.09.2025 17:02:31, FileAttributes: A, AllocationSize: 20’480, EndOfFile: 59’312"
"13:48:27.6202774","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\fltLib.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6202827","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\fltLib.dll","BUFFER OVERFLOW","CreationTime: 06.09.2024 06:02:10, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 06.09.2024 06:02:10, ChangeTime: 30.09.2025 17:02:31, FileAttributes: A, AllocationSize: 20’480, EndOfFile: 59’312"
"13:48:27.6202905","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\fltLib.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6203085","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\fltLib.dll","SUCCESS",""
"13:48:27.6203220","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\fltLib.dll","SUCCESS",""
"13:48:27.6204470","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.6204602","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.6205803","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\newdev.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6206222","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\newdev.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winჶ"
"13:48:27.6206442","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\newdev.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:59, LastAccessTime: 13.10.2025 13:29:14, LastWriteTime: 30.09.2025 13:53:59, ChangeTime: 01.10.2025 17:29:45, FileAttributes: A, AllocationSize: 188’416, EndOfFile: 348’160"
"13:48:27.6206728","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\newdev.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6206802","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\newdev.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:59, LastAccessTime: 13.10.2025 13:29:14, LastWriteTime: 30.09.2025 13:53:59, ChangeTime: 01.10.2025 17:29:45, FileAttributes: A, AllocationSize: 188’416, EndOfFile: 348’160"
"13:48:27.6206893","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\newdev.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6206972","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\newdev.dll","SUCCESS",""
"13:48:27.6207095","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\newdev.dll","SUCCESS",""
"13:48:27.6210475","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\ucrtbase.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6210988","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\ucrtbase.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winჶ"
"13:48:27.6211175","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\ucrtbase.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:28, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:54:28, ChangeTime: 01.10.2025 17:29:41, FileAttributes: A, AllocationSize: 802’816, EndOfFile: 1’373’280"
"13:48:27.6211364","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\ucrtbase.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6211895","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\ucrtbase.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:28, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:54:28, ChangeTime: 01.10.2025 17:29:41, FileAttributes: A, AllocationSize: 802’816, EndOfFile: 1’373’280"
"13:48:27.6212124","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ucrtbase.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6212206","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\ucrtbase.dll","SUCCESS",""
"13:48:27.6212381","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\ucrtbase.dll","SUCCESS",""
"13:48:27.6213952","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.6214089","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.6215052","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\msdelta.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6215325","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\msdelta.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6215394","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\msdelta.dll","BUFFER OVERFLOW","CreationTime: 12.08.2025 20:15:05, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 12.08.2025 20:15:05, ChangeTime: 30.09.2025 17:02:24, FileAttributes: A, AllocationSize: 278’528, EndOfFile: 595’360"
"13:48:27.6215468","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\msdelta.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winჶ"
"13:48:27.6215703","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\msdelta.dll","BUFFER OVERFLOW","CreationTime: 12.08.2025 20:15:05, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 12.08.2025 20:15:05, ChangeTime: 30.09.2025 17:02:24, FileAttributes: A, AllocationSize: 278’528, EndOfFile: 595’360"
"13:48:27.6215811","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msdelta.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6215885","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\msdelta.dll","SUCCESS",""
"13:48:27.6216009","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\msdelta.dll","SUCCESS",""
"13:48:27.6218401","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\cryptsp.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6235566","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\cryptsp.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winწ"
"13:48:27.6235764","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\cryptsp.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:33, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:53:33, ChangeTime: 01.10.2025 17:29:41, FileAttributes: A, AllocationSize: 57’344, EndOfFile: 121’304"
"13:48:27.6235868","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\cryptsp.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6235995","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\cryptsp.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:33, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:53:33, ChangeTime: 01.10.2025 17:29:41, FileAttributes: A, AllocationSize: 57’344, EndOfFile: 121’304"
"13:48:27.6236107","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\cryptsp.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6236193","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\cryptsp.dll","SUCCESS",""
"13:48:27.6236387","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\cryptsp.dll","SUCCESS",""
"13:48:27.6239253","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\cabinet.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6239720","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\cabinet.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6239844","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\cabinet.dll","BUFFER OVERFLOW","CreationTime: 01.04.2024 09:22:11, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 01.04.2024 09:22:11, ChangeTime: 30.09.2025 17:02:31, FileAttributes: A, AllocationSize: 98’304, EndOfFile: 175’024"
"13:48:27.6239953","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\cabinet.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6240004","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\cabinet.dll","BUFFER OVERFLOW","CreationTime: 01.04.2024 09:22:11, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 01.04.2024 09:22:11, ChangeTime: 30.09.2025 17:02:31, FileAttributes: A, AllocationSize: 98’304, EndOfFile: 175’024"
"13:48:27.6240092","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\cabinet.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6240250","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\cabinet.dll","SUCCESS",""
"13:48:27.6240748","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\cabinet.dll","SUCCESS",""
"13:48:27.6309257","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\combase.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6309663","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\combase.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6309906","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\combase.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6310005","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\combase.dll","SUCCESS",""
"13:48:27.6313950","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\SHCore.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6314425","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\SHCore.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6314543","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\combase.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6314565","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\SHCore.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6314787","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\SHCore.dll","SUCCESS",""
"13:48:27.6315075","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\combase.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6315186","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\combase.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:30, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:53:31, ChangeTime: 01.10.2025 17:29:46, FileAttributes: A, AllocationSize: 1’937’408, EndOfFile: 3’674’784"
"13:48:27.6315301","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\combase.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6315361","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\combase.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:30, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:53:31, ChangeTime: 01.10.2025 17:29:46, FileAttributes: A, AllocationSize: 1’937’408, EndOfFile: 3’674’784"
"13:48:27.6315561","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\combase.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6315796","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\combase.dll","SUCCESS",""
"13:48:27.6315957","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\combase.dll","SUCCESS",""
"13:48:27.6323592","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\SHCore.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6324402","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\SHCore.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6324529","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\SHCore.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:14, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:54:14, ChangeTime: 01.10.2025 17:29:46, FileAttributes: A, AllocationSize: 512’000, EndOfFile: 988’984"
"13:48:27.6324633","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\SHCore.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6324685","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\SHCore.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:14, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:54:14, ChangeTime: 01.10.2025 17:29:46, FileAttributes: A, AllocationSize: 512’000, EndOfFile: 988’984"
"13:48:27.6324762","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\SHCore.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6324834","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\SHCore.dll","SUCCESS",""
"13:48:27.6325112","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\SHCore.dll","SUCCESS",""
"13:48:27.6333499","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\cfgmgr32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6334200","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\cfgmgr32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6334334","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\cfgmgr32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6334407","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\cfgmgr32.dll","SUCCESS",""
"13:48:27.6338266","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\WofUtil.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6338278","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\cfgmgr32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6338615","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\WofUtil.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6338667","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\cfgmgr32.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6338749","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\cfgmgr32.dll","BUFFER OVERFLOW","CreationTime: 12.08.2025 20:14:29, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 12.08.2025 20:14:29, ChangeTime: 30.09.2025 17:02:31, FileAttributes: A, AllocationSize: 204’800, EndOfFile: 365’120"
"13:48:27.6338828","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\cfgmgr32.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6338840","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\WofUtil.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6338909","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\cfgmgr32.dll","BUFFER OVERFLOW","CreationTime: 12.08.2025 20:14:29, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 12.08.2025 20:14:29, ChangeTime: 30.09.2025 17:02:31, FileAttributes: A, AllocationSize: 204’800, EndOfFile: 365’120"
"13:48:27.6338935","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\WofUtil.dll","SUCCESS",""
"13:48:27.6338988","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\cfgmgr32.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6339166","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\cfgmgr32.dll","SUCCESS",""
"13:48:27.6339300","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\cfgmgr32.dll","SUCCESS",""
"13:48:27.6340113","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\devrtl.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6340405","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\devrtl.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6340633","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.6340646","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\devrtl.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6340742","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\devrtl.dll","SUCCESS",""
"13:48:27.6340789","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.6341773","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\WofUtil.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6342017","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\WofUtil.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6342197","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\WofUtil.dll","BUFFER OVERFLOW","CreationTime: 01.04.2024 09:22:10, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 01.04.2024 09:22:10, ChangeTime: 30.09.2025 17:02:32, FileAttributes: A, AllocationSize: 24’576, EndOfFile: 61’440"
"13:48:27.6342285","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\WofUtil.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6342337","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\WofUtil.dll","BUFFER OVERFLOW","CreationTime: 01.04.2024 09:22:10, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 01.04.2024 09:22:10, ChangeTime: 30.09.2025 17:02:32, FileAttributes: A, AllocationSize: 24’576, EndOfFile: 61’440"
"13:48:27.6342409","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\WofUtil.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6342480","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\WofUtil.dll","SUCCESS",""
"13:48:27.6342597","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\WofUtil.dll","SUCCESS",""
"13:48:27.6344055","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.6344188","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.6347807","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\devrtl.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6348444","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\devrtl.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᅻ"
"13:48:27.6348546","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\devrtl.dll","BUFFER OVERFLOW","CreationTime: 12.08.2025 20:14:30, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 12.08.2025 20:14:30, ChangeTime: 30.09.2025 17:02:31, FileAttributes: A, AllocationSize: 45’056, EndOfFile: 90’112"
"13:48:27.6348643","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\devrtl.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6348698","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\devrtl.dll","BUFFER OVERFLOW","CreationTime: 12.08.2025 20:14:30, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 12.08.2025 20:14:30, ChangeTime: 30.09.2025 17:02:31, FileAttributes: A, AllocationSize: 45’056, EndOfFile: 90’112"
"13:48:27.6348784","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\devrtl.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6348974","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\devrtl.dll","SUCCESS",""
"13:48:27.6349111","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\devrtl.dll","SUCCESS",""
"13:48:27.6405153","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\drv64.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6406282","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\drv64.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6406763","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\drv64.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6407083","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\drv64.dll","SUCCESS",""
"13:48:27.6409561","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.6409824","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.6571981","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\rsaenh.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6572385","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\rsaenh.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6572487","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\rsaenh.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6572567","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\rsaenh.dll","SUCCESS",""
"13:48:27.6575479","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\rsaenh.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6575986","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\rsaenh.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6576073","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\rsaenh.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:06, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:54:06, ChangeTime: 01.10.2025 17:29:46, FileAttributes: A, AllocationSize: 135’168, EndOfFile: 253’488"
"13:48:27.6576160","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\rsaenh.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6576210","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\rsaenh.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:06, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:54:06, ChangeTime: 01.10.2025 17:29:46, FileAttributes: A, AllocationSize: 135’168, EndOfFile: 253’488"
"13:48:27.6576287","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\rsaenh.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6576365","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\rsaenh.dll","SUCCESS",""
"13:48:27.6576626","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\rsaenh.dll","SUCCESS",""
"13:48:27.6586879","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\cryptbase.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6587335","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\cryptbase.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6587519","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\cryptbase.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6587624","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\cryptbase.dll","SUCCESS",""
"13:48:27.6590178","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\bcryptprimitives.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6590189","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\cryptbase.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6590412","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\cryptbase.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Win"
"13:48:27.6590570","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\cryptbase.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:33, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:53:33, ChangeTime: 01.10.2025 17:29:45, FileAttributes: A, AllocationSize: 20’480, EndOfFile: 59’320"
"13:48:27.6590572","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\bcryptprimitives.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6590696","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\cryptbase.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6590731","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\bcryptprimitives.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6590759","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\cryptbase.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:33, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:53:33, ChangeTime: 01.10.2025 17:29:45, FileAttributes: A, AllocationSize: 20’480, EndOfFile: 59’320"
"13:48:27.6590839","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\cryptbase.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6590922","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\cryptbase.dll","SUCCESS",""
"13:48:27.6591060","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\cryptbase.dll","SUCCESS",""
"13:48:27.6591454","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\bcryptprimitives.dll","SUCCESS",""
"13:48:27.6594151","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\bcryptprimitives.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6594423","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\bcryptprimitives.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6594509","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\bcryptprimitives.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:27, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:53:27, ChangeTime: 01.10.2025 17:29:45, FileAttributes: A, AllocationSize: 368’640, EndOfFile: 637’800"
"13:48:27.6594942","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\bcryptprimitives.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Win怀"
"13:48:27.6595061","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\bcryptprimitives.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:27, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:53:27, ChangeTime: 01.10.2025 17:29:45, FileAttributes: A, AllocationSize: 368’640, EndOfFile: 637’800"
"13:48:27.6595293","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\bcryptprimitives.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6595418","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\bcryptprimitives.dll","SUCCESS",""
"13:48:27.6595573","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\bcryptprimitives.dll","SUCCESS",""
"13:48:27.6786002","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\spinf.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6786532","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\spinf.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6786680","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\spinf.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6786777","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\spinf.dll","SUCCESS",""
"13:48:27.6788949","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.6789179","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.6790385","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\spinf.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6790818","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\spinf.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6790924","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\spinf.dll","BUFFER OVERFLOW","CreationTime: 06.09.2024 06:02:44, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 06.09.2024 06:02:44, ChangeTime: 30.09.2025 17:02:24, FileAttributes: A, AllocationSize: 69’632, EndOfFile: 126’976"
"13:48:27.6791032","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\spinf.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6791098","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\spinf.dll","BUFFER OVERFLOW","CreationTime: 06.09.2024 06:02:44, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 06.09.2024 06:02:44, ChangeTime: 30.09.2025 17:02:24, FileAttributes: A, AllocationSize: 69’632, EndOfFile: 126’976"
"13:48:27.6791193","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\spinf.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6791455","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\spinf.dll","SUCCESS",""
"13:48:27.6791616","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\spinf.dll","SUCCESS",""
"13:48:27.6805104","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\wldp.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6805531","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\wldp.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6805817","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\wldp.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6805916","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\wldp.dll","SUCCESS",""
"13:48:27.6807569","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.6807755","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.6807781","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\msvcp_win.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6808022","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcp_win.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6808097","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcp_win.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6808255","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\msvcp_win.dll","SUCCESS",""
"13:48:27.6809834","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\wldp.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6810355","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\wldp.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winწ"
"13:48:27.6810497","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\wldp.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:30, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:53:30, ChangeTime: 01.10.2025 17:29:42, FileAttributes: A, AllocationSize: 233’472, EndOfFile: 422’920"
"13:48:27.6810614","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\wldp.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6810677","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\wldp.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:30, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:53:30, ChangeTime: 01.10.2025 17:29:42, FileAttributes: A, AllocationSize: 233’472, EndOfFile: 422’920"
"13:48:27.6810773","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\wldp.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6810960","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\wldp.dll","SUCCESS",""
"13:48:27.6811140","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\wldp.dll","SUCCESS",""
"13:48:27.6813632","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\msvcp_win.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6813990","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\msvcp_win.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winწ"
"13:48:27.6814098","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\msvcp_win.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:28, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:54:28, ChangeTime: 01.10.2025 17:29:46, FileAttributes: A, AllocationSize: 278’528, EndOfFile: 641’920"
"13:48:27.6814212","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\msvcp_win.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6814274","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\msvcp_win.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:28, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:54:28, ChangeTime: 01.10.2025 17:29:46, FileAttributes: A, AllocationSize: 278’528, EndOfFile: 641’920"
"13:48:27.6814375","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcp_win.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6814543","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\msvcp_win.dll","SUCCESS",""
"13:48:27.6814735","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\msvcp_win.dll","SUCCESS",""
"13:48:27.6829721","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\spfileq.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6830160","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\spfileq.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6830251","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\spfileq.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6830325","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\spfileq.dll","SUCCESS",""
"13:48:27.6831971","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.6832126","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.6834129","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\spfileq.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6834450","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\spfileq.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6834522","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\spfileq.dll","BUFFER OVERFLOW","CreationTime: 12.08.2025 20:16:39, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 12.08.2025 20:16:40, ChangeTime: 30.09.2025 17:02:24, FileAttributes: A, AllocationSize: 73’728, EndOfFile: 139’264"
"13:48:27.6834609","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\spfileq.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6834747","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\spfileq.dll","BUFFER OVERFLOW","CreationTime: 12.08.2025 20:16:39, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 12.08.2025 20:16:40, ChangeTime: 30.09.2025 17:02:24, FileAttributes: A, AllocationSize: 73’728, EndOfFile: 139’264"
"13:48:27.6838485","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\spfileq.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6838604","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\spfileq.dll","SUCCESS",""
"13:48:27.6838849","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\spfileq.dll","SUCCESS",""
"13:48:27.6848873","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\win32u.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6849423","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\win32u.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6849763","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\win32u.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6849972","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\win32u.dll","SUCCESS",""
"13:48:27.6854787","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\gdi32full.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6855032","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\gdi32full.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6855119","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\gdi32full.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6855298","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\gdi32full.dll","SUCCESS",""
"13:48:27.6855485","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\win32u.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6856346","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\win32u.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6856486","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\win32u.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:35, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:54:35, ChangeTime: 01.10.2025 17:29:48, FileAttributes: A, AllocationSize: 53’248, EndOfFile: 170’872"
"13:48:27.6856698","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\win32u.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6856783","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\win32u.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:35, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:54:35, ChangeTime: 01.10.2025 17:29:48, FileAttributes: A, AllocationSize: 53’248, EndOfFile: 170’872"
"13:48:27.6856905","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\win32u.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6856996","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\win32u.dll","SUCCESS",""
"13:48:27.6857118","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\user32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6857156","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\win32u.dll","SUCCESS",""
"13:48:27.6857601","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\user32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6857694","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\user32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6857763","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\user32.dll","SUCCESS",""
"13:48:27.6861703","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\gdi32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6862206","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\gdi32full.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6862309","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\gdi32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6862462","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\gdi32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6862549","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\gdi32full.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᅻ"
"13:48:27.6862627","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\gdi32.dll","SUCCESS",""
"13:48:27.6862635","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\gdi32full.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:42, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:53:42, ChangeTime: 01.10.2025 17:29:42, FileAttributes: A, AllocationSize: 659’456, EndOfFile: 1’236’920"
"13:48:27.6862873","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\gdi32full.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᅻ"
"13:48:27.6862941","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\gdi32full.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:42, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:53:42, ChangeTime: 01.10.2025 17:29:42, FileAttributes: A, AllocationSize: 659’456, EndOfFile: 1’236’920"
"13:48:27.6863041","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\gdi32full.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6863129","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\gdi32full.dll","SUCCESS",""
"13:48:27.6863269","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\gdi32full.dll","SUCCESS",""
"13:48:27.6863551","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\msvcp_win.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6863820","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcp_win.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6863916","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcp_win.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6864048","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\msvcp_win.dll","SUCCESS",""
"13:48:27.6867690","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\user32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6867828","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\imm32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6868059","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\user32.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Win"
"13:48:27.6868146","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\user32.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:32, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:54:32, ChangeTime: 01.10.2025 17:29:45, FileAttributes: A, AllocationSize: 868’352, EndOfFile: 1’873’232"
"13:48:27.6868211","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\imm32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6868309","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\imm32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6868373","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\user32.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6868411","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\imm32.dll","SUCCESS",""
"13:48:27.6868465","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\user32.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:32, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:54:32, ChangeTime: 01.10.2025 17:29:45, FileAttributes: A, AllocationSize: 868’352, EndOfFile: 1’873’232"
"13:48:27.6868587","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\user32.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6868677","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\user32.dll","SUCCESS",""
"13:48:27.6868933","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\user32.dll","SUCCESS",""
"13:48:27.6873265","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\gdi32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6873769","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\gdi32.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6873885","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\gdi32.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:42, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:53:42, ChangeTime: 01.10.2025 17:29:49, FileAttributes: A, AllocationSize: 69’632, EndOfFile: 187’392"
"13:48:27.6873991","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\gdi32.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᅻ"
"13:48:27.6874054","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\gdi32.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:42, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:53:42, ChangeTime: 01.10.2025 17:29:49, FileAttributes: A, AllocationSize: 69’632, EndOfFile: 187’392"
"13:48:27.6874145","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\gdi32.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6874229","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\gdi32.dll","SUCCESS",""
"13:48:27.6874626","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\gdi32.dll","SUCCESS",""
"13:48:27.6877239","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\imm32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6878021","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\imm32.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6878137","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\imm32.dll","BUFFER OVERFLOW","CreationTime: 12.08.2025 20:15:39, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 12.08.2025 20:15:39, ChangeTime: 30.09.2025 17:02:32, FileAttributes: A, AllocationSize: 102’400, EndOfFile: 203’904"
"13:48:27.6878227","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\imm32.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.6878280","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\imm32.dll","BUFFER OVERFLOW","CreationTime: 12.08.2025 20:15:39, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 12.08.2025 20:15:39, ChangeTime: 30.09.2025 17:02:32, FileAttributes: A, AllocationSize: 102’400, EndOfFile: 203’904"
"13:48:27.6878351","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\imm32.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6878421","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\imm32.dll","SUCCESS",""
"13:48:27.6878620","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\imm32.dll","SUCCESS",""
"13:48:27.6878666","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\uxtheme.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6879086","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\uxtheme.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.6879172","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\uxtheme.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.6879350","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\uxtheme.dll","SUCCESS",""
"13:48:27.6886650","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\uxtheme.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.6887003","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\uxtheme.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winწ"
"13:48:27.6887185","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\uxtheme.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:33, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:54:33, ChangeTime: 01.10.2025 17:29:44, FileAttributes: A, AllocationSize: 360’448, EndOfFile: 688’128"
"13:48:27.6887310","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\uxtheme.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Win?"
"13:48:27.6887372","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\uxtheme.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:33, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:54:33, ChangeTime: 01.10.2025 17:29:44, FileAttributes: A, AllocationSize: 360’448, EndOfFile: 688’128"
"13:48:27.6887455","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\uxtheme.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.6887628","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\uxtheme.dll","SUCCESS",""
"13:48:27.6887766","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\uxtheme.dll","SUCCESS",""
"13:48:27.7030359","MsMpEng.exe","3220","CreateFile","C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6725_none_3e085828e334708b\comctl32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.7030753","MsMpEng.exe","3220","FileSystemControl","C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6725_none_3e085828e334708b\comctl32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.7030866","MsMpEng.exe","3220","FileSystemControl","C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6725_none_3e085828e334708b\comctl32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.7030966","MsMpEng.exe","3220","CloseFile","C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6725_none_3e085828e334708b\comctl32.dll","SUCCESS",""
"13:48:27.7033874","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.7034105","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.7035319","MsMpEng.exe","3220","CreateFile","C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6725_none_3e085828e334708b\comctl32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.7035800","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6725_none_3e085828e334708b\comctl32.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.7035890","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6725_none_3e085828e334708b\comctl32.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:06, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 26.09.2025 09:40:09, ChangeTime: 01.10.2025 17:35:48, FileAttributes: A, AllocationSize: 1’576’960, EndOfFile: 2’696’592"
"13:48:27.7036154","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6725_none_3e085828e334708b\comctl32.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.7036233","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6725_none_3e085828e334708b\comctl32.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:06, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 26.09.2025 09:40:09, ChangeTime: 01.10.2025 17:35:48, FileAttributes: A, AllocationSize: 1’576’960, EndOfFile: 2’696’592"
"13:48:27.7036340","MsMpEng.exe","3220","FileSystemControl","C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6725_none_3e085828e334708b\comctl32.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.7036431","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6725_none_3e085828e334708b\comctl32.dll","SUCCESS",""
"13:48:27.7036586","MsMpEng.exe","3220","CloseFile","C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6725_none_3e085828e334708b\comctl32.dll","SUCCESS",""
"13:48:27.7040260","MsMpEng.exe","3220","CreateFileMapping","C:\Windows\WindowsShell.Manifest","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_READ"
"13:48:27.7040408","MsMpEng.exe","3220","QueryStandardInformationFile","C:\Windows\WindowsShell.Manifest","SUCCESS","AllocationSize: 4’096, EndOfFile: 670, NumberOfLinks: 4, DeletePending: False, Directory: False"
"13:48:27.7060038","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\msctf.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.7060421","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msctf.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.7060525","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msctf.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.7060604","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\msctf.dll","SUCCESS",""
"13:48:27.7063141","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\msctf.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.7063507","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\msctf.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.7063594","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\msctf.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:24, LastAccessTime: 13.10.2025 13:43:00, LastWriteTime: 30.09.2025 13:54:24, ChangeTime: 01.10.2025 17:29:44, FileAttributes: A, AllocationSize: 847’872, EndOfFile: 1’435’240"
"13:48:27.7063681","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\msctf.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.7063732","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\msctf.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:24, LastAccessTime: 13.10.2025 13:43:00, LastWriteTime: 30.09.2025 13:54:24, ChangeTime: 01.10.2025 17:29:44, FileAttributes: A, AllocationSize: 847’872, EndOfFile: 1’435’240"
"13:48:27.7063807","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msctf.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.7063882","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\msctf.dll","SUCCESS",""
"13:48:27.7064106","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\msctf.dll","SUCCESS",""
"13:48:27.7140642","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\kernel.appcore.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.7140893","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel.appcore.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.7140981","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel.appcore.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.7141145","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\kernel.appcore.dll","SUCCESS",""
"13:48:27.7144992","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\kernel.appcore.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.7145217","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\kernel.appcore.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winწ"
"13:48:27.7145426","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\kernel.appcore.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:52, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:53:52, ChangeTime: 01.10.2025 17:29:44, FileAttributes: A, AllocationSize: 53’248, EndOfFile: 121’280"
"13:48:27.7145548","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\kernel.appcore.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.7145695","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\kernel.appcore.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:52, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:53:52, ChangeTime: 01.10.2025 17:29:44, FileAttributes: A, AllocationSize: 53’248, EndOfFile: 121’280"
"13:48:27.7145813","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel.appcore.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.7145899","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\kernel.appcore.dll","SUCCESS",""
"13:48:27.7146173","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\kernel.appcore.dll","SUCCESS",""
"13:48:27.7148925","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\oleaut32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.7149479","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\oleaut32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.7149652","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\oleaut32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.7149770","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\oleaut32.dll","SUCCESS",""
"13:48:27.7154325","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\oleaut32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.7154950","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\oleaut32.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Win"
"13:48:27.7155064","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\oleaut32.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:00, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:54:00, ChangeTime: 01.10.2025 17:29:42, FileAttributes: A, AllocationSize: 483’328, EndOfFile: 889’816"
"13:48:27.7155574","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\oleaut32.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.7158252","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\oleaut32.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:00, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:54:00, ChangeTime: 01.10.2025 17:29:42, FileAttributes: A, AllocationSize: 483’328, EndOfFile: 889’816"
"13:48:27.7158815","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\oleaut32.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.7159262","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\oleaut32.dll","SUCCESS",""
"13:48:27.7159673","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\oleaut32.dll","SUCCESS",""
"13:48:27.7203923","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\TextInputFramework.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.7204151","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\TextInputFramework.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.7204234","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\TextInputFramework.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.7204410","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\TextInputFramework.dll","SUCCESS",""
"13:48:27.7207056","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.7207283","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.7208684","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\TextInputFramework.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.7209567","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\TextInputFramework.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.7210020","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\TextInputFramework.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:24, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:54:24, ChangeTime: 01.10.2025 17:29:43, FileAttributes: A, AllocationSize: 774’144, EndOfFile: 1’369’128"
"13:48:27.7210146","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\TextInputFramework.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.7210210","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\TextInputFramework.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:24, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:54:24, ChangeTime: 01.10.2025 17:29:43, FileAttributes: A, AllocationSize: 774’144, EndOfFile: 1’369’128"
"13:48:27.7210291","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\TextInputFramework.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.7210372","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\TextInputFramework.dll","SUCCESS",""
"13:48:27.7210644","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\TextInputFramework.dll","SUCCESS",""
"13:48:27.7324914","MsMpEng.exe","3220","CreateFileMapping","C:\Windows\Fonts\StaticCache.dat","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_READ"
"13:48:27.7325032","MsMpEng.exe","3220","QueryStandardInformationFile","C:\Windows\Fonts\StaticCache.dat","SUCCESS","AllocationSize: 9’203’712, EndOfFile: 20’381’696, NumberOfLinks: 2, DeletePending: False, Directory: False"
"13:48:27.7378599","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.7378807","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.7412452","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\TextShaping.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.7412831","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\TextShaping.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.7412953","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\TextShaping.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.7413214","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\TextShaping.dll","SUCCESS",""
"13:48:27.7416000","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.7416304","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.7418481","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\TextShaping.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.7418847","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\TextShaping.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᅻ"
"13:48:27.7418945","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\TextShaping.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:37, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:53:37, ChangeTime: 01.10.2025 17:29:48, FileAttributes: A, AllocationSize: 270’336, EndOfFile: 749’328"
"13:48:27.7419051","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\TextShaping.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winწ"
"13:48:27.7419218","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\TextShaping.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:37, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:53:37, ChangeTime: 01.10.2025 17:29:48, FileAttributes: A, AllocationSize: 270’336, EndOfFile: 749’328"
"13:48:27.7419359","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\TextShaping.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.7419493","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\TextShaping.dll","SUCCESS",""
"13:48:27.7419674","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\TextShaping.dll","SUCCESS",""
"13:48:27.7493089","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\windows.storage.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.7493339","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\windows.storage.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.7493442","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\windows.storage.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.7493517","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\windows.storage.dll","SUCCESS",""
"13:48:27.7497009","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\windows.storage.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.7497435","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\windows.storage.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Win"
"13:48:27.7497687","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\windows.storage.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:01, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:54:01, ChangeTime: 01.10.2025 17:29:41, FileAttributes: A, AllocationSize: 4’902’912, EndOfFile: 8’831’584"
"13:48:27.7498270","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\windows.storage.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:27.7503231","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\windows.storage.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:01, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:54:01, ChangeTime: 01.10.2025 17:29:41, FileAttributes: A, AllocationSize: 4’902’912, EndOfFile: 8’831’584"
"13:48:27.7503472","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\windows.storage.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.7503602","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\windows.storage.dll","SUCCESS",""
"13:48:27.7503768","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\windows.storage.dll","SUCCESS",""
"13:48:27.7507536","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\shlwapi.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.7507905","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\shlwapi.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.7507991","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\shlwapi.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.7508065","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\shlwapi.dll","SUCCESS",""
"13:48:27.7514323","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\shlwapi.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.7527477","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\shlwapi.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:27.7527836","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\shlwapi.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:16, LastAccessTime: 13.10.2025 13:47:37, LastWriteTime: 30.09.2025 13:54:16, ChangeTime: 01.10.2025 17:29:40, FileAttributes: A, AllocationSize: 200’704, EndOfFile: 410’504"
"13:48:27.7527960","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\shlwapi.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.7528016","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\shlwapi.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:16, LastAccessTime: 13.10.2025 13:47:37, LastWriteTime: 30.09.2025 13:54:16, ChangeTime: 01.10.2025 17:29:40, FileAttributes: A, AllocationSize: 200’704, EndOfFile: 410’504"
"13:48:27.7528098","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\shlwapi.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.7528175","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\shlwapi.dll","SUCCESS",""
"13:48:27.7528317","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\shlwapi.dll","SUCCESS",""
"13:48:27.7560581","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\ntmarta.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.7560947","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ntmarta.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.7561041","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ntmarta.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.7561117","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\ntmarta.dll","SUCCESS",""
"13:48:27.7565416","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\ntmarta.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.7566698","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\ntmarta.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winწ"
"13:48:27.7566820","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\ntmarta.dll","BUFFER OVERFLOW","CreationTime: 12.08.2025 20:16:22, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 12.08.2025 20:16:23, ChangeTime: 30.09.2025 17:02:31, FileAttributes: A, AllocationSize: 118’784, EndOfFile: 224’632"
"13:48:27.7566929","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\ntmarta.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.7566986","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\ntmarta.dll","BUFFER OVERFLOW","CreationTime: 12.08.2025 20:16:22, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 12.08.2025 20:16:23, ChangeTime: 30.09.2025 17:02:31, FileAttributes: A, AllocationSize: 118’784, EndOfFile: 224’632"
"13:48:27.7567278","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ntmarta.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.7567514","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\ntmarta.dll","SUCCESS",""
"13:48:27.7567694","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\ntmarta.dll","SUCCESS",""
"13:48:27.7574225","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.7574386","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: True, Offset: 120, Length: 1, Fail Immediately: True"
"13:48:27.7574877","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 120, Length: 1"
"13:48:27.7574994","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.7575971","MsMpEng.exe","3220","CreateFileMapping","C:\Windows\System32\drivers\SET9BED.tmp","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_READ"
"13:48:27.7576124","MsMpEng.exe","3220","QueryStandardInformationFile","C:\Windows\System32\drivers\SET9BED.tmp","SUCCESS","AllocationSize: 2’519’040, EndOfFile: 2’518’232, NumberOfLinks: 1, DeletePending: False, Directory: False"
"13:48:27.7600356","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CoreMessaging.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.7600878","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\CoreMessaging.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.7601007","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\CoreMessaging.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.7601089","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CoreMessaging.dll","SUCCESS",""
"13:48:27.7603229","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CoreMessaging.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.7603476","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\CoreMessaging.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.7603550","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\CoreMessaging.dll","BUFFER OVERFLOW","CreationTime: 12.08.2025 20:14:25, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 12.08.2025 20:14:25, ChangeTime: 30.09.2025 17:02:32, FileAttributes: A, AllocationSize: 688’128, EndOfFile: 1’216’272"
"13:48:27.7603631","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\CoreMessaging.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winწ"
"13:48:27.7603904","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\CoreMessaging.dll","BUFFER OVERFLOW","CreationTime: 12.08.2025 20:14:25, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 12.08.2025 20:14:25, ChangeTime: 30.09.2025 17:02:32, FileAttributes: A, AllocationSize: 688’128, EndOfFile: 1’216’272"
"13:48:27.7604018","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\CoreMessaging.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.7604099","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\CoreMessaging.dll","SUCCESS",""
"13:48:27.7604232","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CoreMessaging.dll","SUCCESS",""
"13:48:27.7636945","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CoreUIComponents.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.7637274","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\CoreUIComponents.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.7637908","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\CoreUIComponents.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.7637996","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CoreUIComponents.dll","SUCCESS",""
"13:48:27.7651722","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\WinTypes.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.7652114","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\WinTypes.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.7653998","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\WinTypes.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.7655395","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\WinTypes.dll","SUCCESS",""
"13:48:27.7865004","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.7871100","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\drvstore.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.7871462","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\drvstore.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.7871706","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\drvstore.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.7871826","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\drvstore.dll","SUCCESS",""
"13:48:27.7873186","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.7876666","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CoreUIComponents.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.7876940","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\CoreUIComponents.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.7877300","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\CoreUIComponents.dll","BUFFER OVERFLOW","CreationTime: 30.08.2025 10:09:11, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.08.2025 10:09:11, ChangeTime: 30.09.2025 17:02:32, FileAttributes: A, AllocationSize: 1’310’720, EndOfFile: 3’032’976"
"13:48:27.7877437","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\CoreUIComponents.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.7877567","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\CoreUIComponents.dll","BUFFER OVERFLOW","CreationTime: 30.08.2025 10:09:11, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.08.2025 10:09:11, ChangeTime: 30.09.2025 17:02:32, FileAttributes: A, AllocationSize: 1’310’720, EndOfFile: 3’032’976"
"13:48:27.7877682","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\ole32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.7877734","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\CoreUIComponents.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.7877824","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\CoreUIComponents.dll","SUCCESS",""
"13:48:27.7877996","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CoreUIComponents.dll","SUCCESS",""
"13:48:27.7878091","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ole32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.7878182","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ole32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.7878261","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\ole32.dll","SUCCESS",""
"13:48:27.7880496","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\WinTypes.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.7881130","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\WinTypes.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᅍ"
"13:48:27.7881230","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\WinTypes.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:30, LastAccessTime: 13.10.2025 13:47:37, LastWriteTime: 30.09.2025 13:53:30, ChangeTime: 01.10.2025 17:29:46, FileAttributes: A, AllocationSize: 593’920, EndOfFile: 1’505’496"
"13:48:27.7881329","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\WinTypes.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.7881460","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\WinTypes.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:30, LastAccessTime: 13.10.2025 13:47:37, LastWriteTime: 30.09.2025 13:53:30, ChangeTime: 01.10.2025 17:29:46, FileAttributes: A, AllocationSize: 593’920, EndOfFile: 1’505’496"
"13:48:27.7881849","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\WinTypes.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.7881979","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\WinTypes.dll","SUCCESS",""
"13:48:27.7882121","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\WinTypes.dll","SUCCESS",""
"13:48:27.7883592","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\ole32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.7884133","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\ole32.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winწ"
"13:48:27.7884272","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\ole32.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:31, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:53:31, ChangeTime: 01.10.2025 17:29:47, FileAttributes: A, AllocationSize: 708’608, EndOfFile: 1’687’288"
"13:48:27.7884391","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\ole32.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Win"
"13:48:27.7884529","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\ole32.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:31, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:53:31, ChangeTime: 01.10.2025 17:29:47, FileAttributes: A, AllocationSize: 708’608, EndOfFile: 1’687’288"
"13:48:27.7884661","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ole32.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.7884739","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\ole32.dll","SUCCESS",""
"13:48:27.7885043","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\ole32.dll","SUCCESS",""
"13:48:27.7887420","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.7887659","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.7889541","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\drvstore.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.7889922","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\drvstore.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.7890003","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\drvstore.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:40, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:53:40, ChangeTime: 01.10.2025 17:29:47, FileAttributes: A, AllocationSize: 876’544, EndOfFile: 1’542’672"
"13:48:27.7908322","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\drvstore.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᅍ"
"13:48:27.7908394","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\drvstore.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:40, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:53:40, ChangeTime: 01.10.2025 17:29:47, FileAttributes: A, AllocationSize: 876’544, EndOfFile: 1’542’672"
"13:48:27.7908499","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\drvstore.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.7908575","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\drvstore.dll","SUCCESS",""
"13:48:27.7908806","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\drvstore.dll","SUCCESS",""
"13:48:27.8065418","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.8065827","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.8216806","MsMpEng.exe","3220","Thread Create","","SUCCESS","Thread ID: 9140"
"13:48:27.8228289","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.8228603","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.8231013","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\runonce.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8231398","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\runonce.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.8231492","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\runonce.exe","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:06, LastAccessTime: 13.10.2025 13:29:21, LastWriteTime: 30.09.2025 13:54:06, ChangeTime: 01.10.2025 17:29:48, FileAttributes: A, AllocationSize: 61’440, EndOfFile: 122’880"
"13:48:27.8231701","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\runonce.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.8231760","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\runonce.exe","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:06, LastAccessTime: 13.10.2025 13:29:21, LastWriteTime: 30.09.2025 13:54:06, ChangeTime: 01.10.2025 17:29:48, FileAttributes: A, AllocationSize: 61’440, EndOfFile: 122’880"
"13:48:27.8231856","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\runonce.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.8231951","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\runonce.exe","SUCCESS",""
"13:48:27.8232278","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\runonce.exe","SUCCESS",""
"13:48:27.8261304","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\services.exe","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8261695","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\services.exe","SUCCESS","CreationTime: 30.09.2025 13:54:13, LastAccessTime: 13.10.2025 13:48:26, LastWriteTime: 30.09.2025 13:54:13, ChangeTime: 01.10.2025 17:29:42, FileAttributes: A"
"13:48:27.8261780","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\services.exe","SUCCESS",""
"13:48:27.8262905","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\services.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8263211","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\services.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winჶ"
"13:48:27.8263406","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\services.exe","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:13, LastAccessTime: 13.10.2025 13:48:26, LastWriteTime: 30.09.2025 13:54:13, ChangeTime: 01.10.2025 17:29:42, FileAttributes: A, AllocationSize: 524’288, EndOfFile: 906’376"
"13:48:27.8263515","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\services.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.8263580","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\services.exe","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:13, LastAccessTime: 13.10.2025 13:48:26, LastWriteTime: 30.09.2025 13:54:13, ChangeTime: 01.10.2025 17:29:42, FileAttributes: A, AllocationSize: 524’288, EndOfFile: 906’376"
"13:48:27.8264144","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\services.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.8264333","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\services.exe","SUCCESS",""
"13:48:27.8264628","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\services.exe","SUCCESS",""
"13:48:27.8346701","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\wtsapi32.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8347249","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\wtsapi32.dll","SUCCESS","CreationTime: 30.09.2025 13:54:23, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:54:23, ChangeTime: 01.10.2025 17:29:47, FileAttributes: A"
"13:48:27.8347407","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\wtsapi32.dll","SUCCESS",""
"13:48:27.8348586","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\wtsapi32.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8349088","MsMpEng.exe","3220","CreateFileMapping","C:\Windows\System32\wtsapi32.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE|PAGE_NOCACHE"
"13:48:27.8349357","MsMpEng.exe","3220","CreateFileMapping","C:\Windows\System32\wtsapi32.dll","SUCCESS","SyncType: SyncTypeOther"
"13:48:27.8350376","MsMpEng.exe","3220","Load Image","C:\Windows\System32\wtsapi32.dll","SUCCESS","Image Base: 0x7ff90e510000, Image Size: 0x2a000"
"13:48:27.8353968","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\wtsapi32.dll","SUCCESS",""
"13:48:27.8368735","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\winsta.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8369175","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\winsta.dll","SUCCESS","CreationTime: 30.09.2025 13:54:24, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:54:24, ChangeTime: 01.10.2025 17:29:44, FileAttributes: A"
"13:48:27.8369271","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\winsta.dll","SUCCESS",""
"13:48:27.8371144","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\winsta.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8371670","MsMpEng.exe","3220","CreateFileMapping","C:\Windows\System32\winsta.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE|PAGE_NOCACHE"
"13:48:27.8371865","MsMpEng.exe","3220","CreateFileMapping","C:\Windows\System32\winsta.dll","SUCCESS","SyncType: SyncTypeOther"
"13:48:27.8373002","MsMpEng.exe","3220","Load Image","C:\Windows\System32\winsta.dll","SUCCESS","Image Base: 0x7ff911100000, Image Size: 0x63000"
"13:48:27.8374034","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\winsta.dll","SUCCESS",""
"13:48:27.8383400","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\runonce.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8383833","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\runonce.exe","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.8383982","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\runonce.exe","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.8384067","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\runonce.exe","SUCCESS",""
"13:48:27.8385942","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\ntdll.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8386381","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ntdll.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.8386472","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ntdll.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.8386550","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\ntdll.dll","SUCCESS",""
"13:48:27.8398249","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\grpconv","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:27.8400229","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\grpconv -o","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:27.8403402","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\grpconv","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:27.8406491","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\grpconv -o","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:27.8408413","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\grpconv","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:27.8411750","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\grpconv -o","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:27.8415556","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\grpconv","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:27.8418233","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\grpconv -o","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:27.8466492","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.8469234","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 263’736, Length: 4’096"
"13:48:27.8469672","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 119’536, Length: 4’096"
"13:48:27.8470610","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 255’496, Length: 4’096"
"13:48:27.8470954","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 848’776, Length: 4’096"
"13:48:27.8471154","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 115’416, Length: 4’096"
"13:48:27.8471325","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 832’296, Length: 4’096"
"13:48:27.8471641","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 852’896, Length: 4’096"
"13:48:27.8472315","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.8473085","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.8473288","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.8474541","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.8474933","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.8475541","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.8475783","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.8476799","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.8477274","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.8478381","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.8478497","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.8479435","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.8479546","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.8480213","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.8480298","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.8481434","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.8481550","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 251’376, Length: 4’096"
"13:48:27.8481846","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.8517858","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8518503","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.8518607","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:27.8518700","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.8518758","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:27.8518842","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.8518936","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:27.8519222","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:27.8520017","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8520512","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Win"
"13:48:27.8520884","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:27.8521704","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winჱ"
"13:48:27.8521871","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:27.8522002","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.8522130","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:27.8526818","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:27.8533594","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8533782","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.8533950","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:27.8534191","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.8534434","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:27.8534532","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.8534621","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:27.8534902","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:27.8535744","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8535936","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.8536028","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:27.8540513","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8540726","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.8540812","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:27.8540891","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winჱ"
"13:48:27.8541025","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:27.8541126","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.8541211","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:27.8541921","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:27.8554461","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\kernel32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8554857","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.8555079","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.8555210","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.8555288","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\kernel32.dll","SUCCESS",""
"13:48:27.8556086","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 844’656, Length: 4’096"
"13:48:27.8556392","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\KernelBase.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8556488","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 836’416, Length: 4’096"
"13:48:27.8556589","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\KernelBase.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.8556663","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\KernelBase.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.8556725","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\KernelBase.dll","SUCCESS",""
"13:48:27.8556966","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.8569509","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\advapi32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8570030","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\advapi32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.8570165","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\advapi32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.8570262","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\advapi32.dll","SUCCESS",""
"13:48:27.8577655","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\msvcrt.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8577965","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcrt.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.8578055","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcrt.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.8578135","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\msvcrt.dll","SUCCESS",""
"13:48:27.8579274","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\sechost.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8579629","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\sechost.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.8579715","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\sechost.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.8579785","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\sechost.dll","SUCCESS",""
"13:48:27.8616801","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\rpcrt4.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8617279","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\rpcrt4.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.8617403","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\rpcrt4.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.8617611","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\rpcrt4.dll","SUCCESS",""
"13:48:27.8619105","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\msvcp_win.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8619462","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcp_win.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.8619568","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcp_win.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.8619654","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\msvcp_win.dll","SUCCESS",""
"13:48:27.8671965","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\gdi32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8672557","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\gdi32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.8672682","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\gdi32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.8672772","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\gdi32.dll","SUCCESS",""
"13:48:27.8674147","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\user32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8674461","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\user32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.8674548","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\user32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.8674709","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\user32.dll","SUCCESS",""
"13:48:27.8679100","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\shell32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8679505","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\shell32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.8679593","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\shell32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.8679666","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\shell32.dll","SUCCESS",""
"13:48:27.8681926","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\ucrtbase.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8682651","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ucrtbase.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.8682750","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ucrtbase.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.8682917","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\ucrtbase.dll","SUCCESS",""
"13:48:27.8684329","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\shell32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8684774","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\shell32.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Win"
"13:48:27.8684871","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\shell32.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:15, LastAccessTime: 13.10.2025 13:46:06, LastWriteTime: 30.09.2025 13:54:15, ChangeTime: 01.10.2025 17:29:44, FileAttributes: A, AllocationSize: 4’399’104, EndOfFile: 7’699’432"
"13:48:27.8684978","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\shell32.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.8685157","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\shell32.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:15, LastAccessTime: 13.10.2025 13:46:06, LastWriteTime: 30.09.2025 13:54:15, ChangeTime: 01.10.2025 17:29:44, FileAttributes: A, AllocationSize: 4’399’104, EndOfFile: 7’699’432"
"13:48:27.8685314","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\shell32.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.8685436","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\shell32.dll","SUCCESS",""
"13:48:27.8685886","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\shell32.dll","SUCCESS",""
"13:48:27.8688099","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\win32u.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8688415","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\win32u.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.8688502","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\win32u.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.8688575","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\win32u.dll","SUCCESS",""
"13:48:27.8690106","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\gdi32full.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8690348","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\gdi32full.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.8690430","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\gdi32full.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.8690584","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\gdi32full.dll","SUCCESS",""
"13:48:27.8692846","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\WinTypes.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8693516","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\WinTypes.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.8693647","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\WinTypes.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.8693727","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\WinTypes.dll","SUCCESS",""
"13:48:27.8694757","MsMpEng.exe","3220","CreateFile","C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6725_none_3e085828e334708b\comctl32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8694970","MsMpEng.exe","3220","FileSystemControl","C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6725_none_3e085828e334708b\comctl32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.8695150","MsMpEng.exe","3220","FileSystemControl","C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6725_none_3e085828e334708b\comctl32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.8695220","MsMpEng.exe","3220","CloseFile","C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6725_none_3e085828e334708b\comctl32.dll","SUCCESS",""
"13:48:27.8696145","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\combase.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8696529","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\combase.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.8696607","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\combase.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.8696671","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\combase.dll","SUCCESS",""
"13:48:27.8697570","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\shlwapi.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8697836","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\shlwapi.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.8697910","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\shlwapi.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.8697973","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\shlwapi.dll","SUCCESS",""
"13:48:27.8704046","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\ole32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8704420","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ole32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.8704503","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ole32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.8704817","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\ole32.dll","SUCCESS",""
"13:48:27.8706575","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\SHCore.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8706951","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\SHCore.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.8707031","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\SHCore.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.8707099","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\SHCore.dll","SUCCESS",""
"13:48:27.8721067","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\imm32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8721459","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\imm32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.8721553","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\imm32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.8721632","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\imm32.dll","SUCCESS",""
"13:48:27.8848903","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\windows.storage.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8849237","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\windows.storage.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.8849359","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\windows.storage.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.8849542","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\windows.storage.dll","SUCCESS",""
"13:48:27.8885109","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\kernel.appcore.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8885436","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel.appcore.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.8885548","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel.appcore.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.8885763","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\kernel.appcore.dll","SUCCESS",""
"13:48:27.8897427","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\bcryptprimitives.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8897723","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\bcryptprimitives.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.8897814","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\bcryptprimitives.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.8897976","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\bcryptprimitives.dll","SUCCESS",""
"13:48:27.8908487","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\uxtheme.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8908783","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\uxtheme.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.8908875","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\uxtheme.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.8909061","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\uxtheme.dll","SUCCESS",""
"13:48:27.8972384","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\oleaut32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8972850","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\oleaut32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.8972965","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\oleaut32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.8973129","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\oleaut32.dll","SUCCESS",""
"13:48:27.8996849","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\cfgmgr32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.8997979","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\cfgmgr32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.8998169","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\cfgmgr32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.8998279","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\cfgmgr32.dll","SUCCESS",""
"13:48:27.9025718","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\propsys.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.9026260","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\propsys.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.9026375","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\propsys.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.9026457","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\propsys.dll","SUCCESS",""
"13:48:27.9028773","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\propsys.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.9029077","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\propsys.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.9029152","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\propsys.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:05, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:54:05, ChangeTime: 01.10.2025 17:29:49, FileAttributes: A, AllocationSize: 565’248, EndOfFile: 1’079’912"
"13:48:27.9029305","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\propsys.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.9029375","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\propsys.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:05, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:54:05, ChangeTime: 01.10.2025 17:29:49, FileAttributes: A, AllocationSize: 565’248, EndOfFile: 1’079’912"
"13:48:27.9029476","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\propsys.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.9029562","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\propsys.dll","SUCCESS",""
"13:48:27.9029773","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\propsys.dll","SUCCESS",""
"13:48:27.9038224","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\clbcatq.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.9038562","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\clbcatq.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.9038752","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\clbcatq.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.9038840","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\clbcatq.dll","SUCCESS",""
"13:48:27.9040821","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\clbcatq.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.9041178","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\clbcatq.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Win(찚㈀"
"13:48:27.9041312","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\clbcatq.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:31, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:53:31, ChangeTime: 01.10.2025 17:29:46, FileAttributes: A, AllocationSize: 385’024, EndOfFile: 724’552"
"13:48:27.9041411","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\clbcatq.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winწ"
"13:48:27.9041467","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\clbcatq.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:31, LastAccessTime: 13.10.2025 13:47:36, LastWriteTime: 30.09.2025 13:53:31, ChangeTime: 01.10.2025 17:29:46, FileAttributes: A, AllocationSize: 385’024, EndOfFile: 724’552"
"13:48:27.9041557","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\clbcatq.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.9041652","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\clbcatq.dll","SUCCESS",""
"13:48:27.9041902","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\clbcatq.dll","SUCCESS",""
"13:48:27.9131771","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\profapi.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.9132194","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\profapi.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.9132305","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\profapi.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.9132381","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\profapi.dll","SUCCESS",""
"13:48:27.9134907","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\profapi.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.9135363","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\profapi.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᅼ"
"13:48:27.9135771","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\profapi.dll","BUFFER OVERFLOW","CreationTime: 12.08.2025 20:16:15, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 12.08.2025 20:16:15, ChangeTime: 30.09.2025 17:02:31, FileAttributes: A, AllocationSize: 90’112, EndOfFile: 179’136"
"13:48:27.9135920","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\profapi.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.9135976","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\profapi.dll","BUFFER OVERFLOW","CreationTime: 12.08.2025 20:16:15, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 12.08.2025 20:16:15, ChangeTime: 30.09.2025 17:02:31, FileAttributes: A, AllocationSize: 90’112, EndOfFile: 179’136"
"13:48:27.9136051","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\profapi.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.9136123","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\profapi.dll","SUCCESS",""
"13:48:27.9136258","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\profapi.dll","SUCCESS",""
"13:48:27.9393615","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\Windows.StateRepositoryPS.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.9394573","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\Windows.StateRepositoryPS.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.9394780","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\Windows.StateRepositoryPS.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.9395134","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\Windows.StateRepositoryPS.dll","SUCCESS",""
"13:48:27.9401344","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\Windows.StateRepositoryPS.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.9401628","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\Windows.StateRepositoryPS.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.9401721","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\Windows.StateRepositoryPS.dll","BUFFER OVERFLOW","CreationTime: 30.08.2025 10:11:03, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.08.2025 10:11:03, ChangeTime: 30.09.2025 17:02:21, FileAttributes: A, AllocationSize: 233’472, EndOfFile: 819’608"
"13:48:27.9401911","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\Windows.StateRepositoryPS.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.9401970","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\Windows.StateRepositoryPS.dll","BUFFER OVERFLOW","CreationTime: 30.08.2025 10:11:03, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.08.2025 10:11:03, ChangeTime: 30.09.2025 17:02:21, FileAttributes: A, AllocationSize: 233’472, EndOfFile: 819’608"
"13:48:27.9402069","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\Windows.StateRepositoryPS.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.9402162","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\Windows.StateRepositoryPS.dll","SUCCESS",""
"13:48:27.9402454","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\Windows.StateRepositoryPS.dll","SUCCESS",""
"13:48:27.9631334","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\edputil.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.9632045","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\edputil.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.9632372","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\edputil.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.9632581","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\edputil.dll","SUCCESS",""
"13:48:27.9638337","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\edputil.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.9638741","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\edputil.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.9638841","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\edputil.dll","BUFFER OVERFLOW","CreationTime: 12.08.2025 20:15:17, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 12.08.2025 20:15:17, ChangeTime: 30.09.2025 17:02:24, FileAttributes: A, AllocationSize: 81’920, EndOfFile: 167’936"
"13:48:27.9638934","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\edputil.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.9638987","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\edputil.dll","BUFFER OVERFLOW","CreationTime: 12.08.2025 20:15:17, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 12.08.2025 20:15:17, ChangeTime: 30.09.2025 17:02:24, FileAttributes: A, AllocationSize: 81’920, EndOfFile: 167’936"
"13:48:27.9639075","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\edputil.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.9639165","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\edputil.dll","SUCCESS",""
"13:48:27.9639522","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\edputil.dll","SUCCESS",""
"13:48:27.9646724","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\urlmon.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.9647356","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\urlmon.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.9647594","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\urlmon.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.9647744","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\urlmon.dll","SUCCESS",""
"13:48:27.9651470","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.9652157","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.9652887","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\iertutil.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.9653151","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\iertutil.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.9653313","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\iertutil.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.9653412","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\iertutil.dll","SUCCESS",""
"13:48:27.9653771","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\urlmon.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.9654258","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\urlmon.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.9654390","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\urlmon.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:47, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:53:47, ChangeTime: 01.10.2025 17:29:49, FileAttributes: A, AllocationSize: 1’130’496, EndOfFile: 1’921’024"
"13:48:27.9654648","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\urlmon.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.9654737","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\urlmon.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:47, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:53:47, ChangeTime: 01.10.2025 17:29:49, FileAttributes: A, AllocationSize: 1’130’496, EndOfFile: 1’921’024"
"13:48:27.9654872","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\urlmon.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.9654988","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\urlmon.dll","SUCCESS",""
"13:48:27.9655321","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\urlmon.dll","SUCCESS",""
"13:48:27.9660518","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\iertutil.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.9660945","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\iertutil.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.9661025","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\iertutil.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:48, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:53:48, ChangeTime: 01.10.2025 17:29:44, FileAttributes: A, AllocationSize: 1’216’512, EndOfFile: 2’918’640"
"13:48:27.9661107","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\iertutil.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.9661159","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\iertutil.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:48, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:53:48, ChangeTime: 01.10.2025 17:29:44, FileAttributes: A, AllocationSize: 1’216’512, EndOfFile: 2’918’640"
"13:48:27.9661339","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\iertutil.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.9661469","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\iertutil.dll","SUCCESS",""
"13:48:27.9661615","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\iertutil.dll","SUCCESS",""
"13:48:27.9665746","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\srvcli.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.9666171","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\srvcli.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.9666408","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\srvcli.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.9666551","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\srvcli.dll","SUCCESS",""
"13:48:27.9669618","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\srvcli.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.9670101","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\srvcli.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Win"
"13:48:27.9670230","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\srvcli.dll","BUFFER OVERFLOW","CreationTime: 06.09.2024 06:02:44, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 06.09.2024 06:02:44, ChangeTime: 30.09.2025 17:02:31, FileAttributes: A, AllocationSize: 65’536, EndOfFile: 146’080"
"13:48:27.9670369","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\srvcli.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winწ"
"13:48:27.9670462","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\srvcli.dll","BUFFER OVERFLOW","CreationTime: 06.09.2024 06:02:44, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 06.09.2024 06:02:44, ChangeTime: 30.09.2025 17:02:31, FileAttributes: A, AllocationSize: 65’536, EndOfFile: 146’080"
"13:48:27.9670673","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\srvcli.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.9670824","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\srvcli.dll","SUCCESS",""
"13:48:27.9671031","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\srvcli.dll","SUCCESS",""
"13:48:27.9672008","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\netutils.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.9672298","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\netutils.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.9672395","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\netutils.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.9672469","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\netutils.dll","SUCCESS",""
"13:48:27.9676479","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\netutils.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.9677081","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\netutils.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᅼ"
"13:48:27.9677225","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\netutils.dll","BUFFER OVERFLOW","CreationTime: 12.08.2025 20:16:04, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 12.08.2025 20:16:04, ChangeTime: 30.09.2025 17:02:31, FileAttributes: A, AllocationSize: 28’672, EndOfFile: 63’336"
"13:48:27.9677380","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\netutils.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winწ"
"13:48:27.9677582","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\netutils.dll","BUFFER OVERFLOW","CreationTime: 12.08.2025 20:16:04, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 12.08.2025 20:16:04, ChangeTime: 30.09.2025 17:02:31, FileAttributes: A, AllocationSize: 28’672, EndOfFile: 63’336"
"13:48:27.9677731","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\netutils.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.9677868","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\netutils.dll","SUCCESS",""
"13:48:27.9678439","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\netutils.dll","SUCCESS",""
"13:48:27.9721593","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\sspicli.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.9722298","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\sspicli.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.9722412","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\sspicli.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.9722509","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\sspicli.dll","SUCCESS",""
"13:48:27.9725350","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\sspicli.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.9725959","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\sspicli.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᅼ"
"13:48:27.9726070","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\sspicli.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:52, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:53:52, ChangeTime: 01.10.2025 17:29:48, FileAttributes: A, AllocationSize: 151’552, EndOfFile: 307’200"
"13:48:27.9726182","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\sspicli.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᅼ"
"13:48:27.9726320","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\sspicli.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:52, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.09.2025 13:53:52, ChangeTime: 01.10.2025 17:29:48, FileAttributes: A, AllocationSize: 151’552, EndOfFile: 307’200"
"13:48:27.9726448","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\sspicli.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.9726542","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\sspicli.dll","SUCCESS",""
"13:48:27.9726707","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\sspicli.dll","SUCCESS",""
"13:48:27.9800473","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\virtdisk.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.9800961","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\virtdisk.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.9801095","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\virtdisk.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.9801200","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\virtdisk.dll","SUCCESS",""
"13:48:27.9803349","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.9803580","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.9805848","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\virtdisk.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.9806591","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\virtdisk.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᅼ"
"13:48:27.9807015","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\virtdisk.dll","BUFFER OVERFLOW","CreationTime: 30.08.2025 10:10:39, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.08.2025 10:10:39, ChangeTime: 30.09.2025 17:02:21, FileAttributes: A, AllocationSize: 49’152, EndOfFile: 103’832"
"13:48:27.9807171","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\virtdisk.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.9807323","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\virtdisk.dll","BUFFER OVERFLOW","CreationTime: 30.08.2025 10:10:39, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 30.08.2025 10:10:39, ChangeTime: 30.09.2025 17:02:21, FileAttributes: A, AllocationSize: 49’152, EndOfFile: 103’832"
"13:48:27.9807481","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\virtdisk.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.9807586","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\virtdisk.dll","SUCCESS",""
"13:48:27.9807769","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\virtdisk.dll","SUCCESS",""
"13:48:27.9826642","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\wldp.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.9827308","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\wldp.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:27.9827539","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\wldp.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:27.9827648","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\wldp.dll","SUCCESS",""
"13:48:27.9880251","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:27.9880560","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:27.9883606","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\grpconv.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:27.9884272","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\grpconv.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.9884388","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\grpconv.exe","BUFFER OVERFLOW","CreationTime: 01.04.2024 09:22:17, LastAccessTime: 13.10.2025 13:29:21, LastWriteTime: 01.04.2024 09:22:17, ChangeTime: 30.09.2025 17:02:35, FileAttributes: A, AllocationSize: 12’288, EndOfFile: 45’056"
"13:48:27.9884499","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\grpconv.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:27.9884644","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\grpconv.exe","BUFFER OVERFLOW","CreationTime: 01.04.2024 09:22:17, LastAccessTime: 13.10.2025 13:29:21, LastWriteTime: 01.04.2024 09:22:17, ChangeTime: 30.09.2025 17:02:35, FileAttributes: A, AllocationSize: 12’288, EndOfFile: 45’056"
"13:48:27.9884780","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\grpconv.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:27.9884881","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\grpconv.exe","SUCCESS",""
"13:48:27.9885044","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\grpconv.exe","SUCCESS",""
"13:48:28.0042802","MsMpEng.exe","3220","CreateFileMapping","C:\Windows\System32\en-US\grpconv.exe.mui","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_READ"
"13:48:28.0042927","MsMpEng.exe","3220","QueryStandardInformationFile","C:\Windows\System32\en-US\grpconv.exe.mui","SUCCESS","AllocationSize: 4’096, EndOfFile: 3’072, NumberOfLinks: 2, DeletePending: False, Directory: False"
"13:48:28.0048210","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\grpconv.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0048550","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\grpconv.exe","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.0048650","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\grpconv.exe","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.0048969","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\grpconv.exe","SUCCESS",""
"13:48:28.0050482","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\ntdll.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0050860","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ntdll.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.0051060","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ntdll.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.0051174","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\ntdll.dll","SUCCESS",""
"13:48:28.0055984","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0056270","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","CreationTime: 01.04.2024 09:26:07, LastAccessTime: 13.08.2025 20:52:27, LastWriteTime: 01.04.2024 09:26:07, ChangeTime: 12.08.2025 21:35:30, FileAttributes: D"
"13:48:28.0056356","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS",""
"13:48:28.0057689","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0057844","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","CreationTime: 01.04.2024 18:17:28, LastAccessTime: 13.10.2025 13:32:53, LastWriteTime: 12.08.2025 20:38:19, ChangeTime: 12.08.2025 20:38:19, FileAttributes: DNCI"
"13:48:28.0058009","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS",""
"13:48:28.0058804","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0059048","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2\{????????????????????????????????????}","SUCCESS","FileInformationClass: FileBothDirectoryInformation, Filter: {????????????????????????????????????}, 2: {127D0A1D-4EF2-11D1-8608-00C04FC295EE}"
"13:48:28.0059990","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:28.0060720","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0060890","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\CatRoot","SUCCESS","Information: DACL"
"13:48:28.0061069","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot","SUCCESS",""
"13:48:28.0061960","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:28.0063817","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0064082","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\catroot2","SUCCESS","Information: DACL"
"13:48:28.0064189","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:28.0068237","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2","SUCCESS","FileInformationClass: FileBothDirectoryInformation, 1: {F750E6C3-38EE-11D1-85E5-00C04FC295EE}"
"13:48:28.0092005","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:28.0096665","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0096864","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\CatRoot","SUCCESS","Information: DACL"
"13:48:28.0096950","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot","SUCCESS",""
"13:48:28.0097856","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:28.0098965","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0099148","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\catroot2","SUCCESS","Information: DACL"
"13:48:28.0099340","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:28.0110987","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~en-GB~10.0.26100.1591.cat","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0111248","MsMpEng.exe","3220","QueryNetworkOpenInformationFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~en-GB~10.0.26100.1591.cat","SUCCESS","CreationTime: 06.09.2024 06:05:08, LastAccessTime: 13.10.2025 13:44:11, LastWriteTime: 06.09.2024 05:59:20, ChangeTime: 12.08.2025 21:30:48, AllocationSize: 01.01.1601 02:00:00, EndOfFile: 01.01.1601 02:00:00, FileAttributes: A"
"13:48:28.0111327","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~en-GB~10.0.26100.1591.cat","SUCCESS",""
"13:48:28.0112696","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.5074.cat","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0112923","MsMpEng.exe","3220","QueryNetworkOpenInformationFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.5074.cat","SUCCESS","CreationTime: 30.08.2025 10:16:17, LastAccessTime: 13.10.2025 13:44:11, LastWriteTime: 30.08.2025 10:04:47, ChangeTime: 30.08.2025 10:21:59, AllocationSize: 01.01.1601 02:00:00, EndOfFile: 01.01.1601 02:00:00, FileAttributes: A"
"13:48:28.0113004","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.5074.cat","SUCCESS",""
"13:48:28.0114297","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.6725.cat","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0114588","MsMpEng.exe","3220","QueryNetworkOpenInformationFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.6725.cat","SUCCESS","CreationTime: 30.09.2025 16:57:54, LastAccessTime: 13.10.2025 13:44:11, LastWriteTime: 30.09.2025 16:45:09, ChangeTime: 30.09.2025 17:06:31, AllocationSize: 01.01.1601 02:00:00, EndOfFile: 01.01.1601 02:00:00, FileAttributes: A"
"13:48:28.0114663","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.6725.cat","SUCCESS",""
"13:48:28.0114915","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2","NO MORE FILES","FileInformationClass: FileBothDirectoryInformation"
"13:48:28.0115170","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:28.0116491","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.5074.cat","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0116657","MsMpEng.exe","3220","QueryNetworkOpenInformationFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.5074.cat","SUCCESS","CreationTime: 30.08.2025 10:16:17, LastAccessTime: 13.10.2025 13:44:11, LastWriteTime: 30.08.2025 10:04:47, ChangeTime: 30.08.2025 10:21:59, AllocationSize: 01.01.1601 02:00:00, EndOfFile: 01.01.1601 02:00:00, FileAttributes: A"
"13:48:28.0116729","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.5074.cat","SUCCESS",""
"13:48:28.0117447","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.5074.cat","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Disallow Exclusive, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0117768","MsMpEng.exe","3220","QueryStandardInformationFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.5074.cat","SUCCESS","AllocationSize: 32’768, EndOfFile: 68’167, NumberOfLinks: 3, DeletePending: False, Directory: False"
"13:48:28.0117855","MsMpEng.exe","3220","CreateFileMapping","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.5074.cat","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE|PAGE_NOCACHE"
"13:48:28.0117934","MsMpEng.exe","3220","QueryStandardInformationFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.5074.cat","SUCCESS","AllocationSize: 32’768, EndOfFile: 68’167, NumberOfLinks: 3, DeletePending: False, Directory: False"
"13:48:28.0118056","MsMpEng.exe","3220","CreateFileMapping","\Device\HarddiskVolume4曘;","SUCCESS","SyncType: SyncTypeOther"
"13:48:28.0119523","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.5074.cat","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:28.0119611","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.5074.cat","BUFFER OVERFLOW","CreationTime: 30.08.2025 10:16:17, LastAccessTime: 13.10.2025 13:44:11, LastWriteTime: 30.08.2025 10:04:47, ChangeTime: 30.08.2025 10:21:59, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 68’167"
"13:48:28.0120931","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.6725.cat","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0121091","MsMpEng.exe","3220","QueryNetworkOpenInformationFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.6725.cat","SUCCESS","CreationTime: 30.09.2025 16:57:54, LastAccessTime: 13.10.2025 13:44:11, LastWriteTime: 30.09.2025 16:45:09, ChangeTime: 30.09.2025 17:06:31, AllocationSize: 01.01.1601 02:00:00, EndOfFile: 01.01.1601 02:00:00, FileAttributes: A"
"13:48:28.0121241","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.6725.cat","SUCCESS",""
"13:48:28.0121690","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\kernel32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0121961","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.0122012","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.6725.cat","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Disallow Exclusive, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0122189","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.0122329","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\kernel32.dll","SUCCESS",""
"13:48:28.0122461","MsMpEng.exe","3220","QueryStandardInformationFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.6725.cat","SUCCESS","AllocationSize: 32’768, EndOfFile: 68’180, NumberOfLinks: 3, DeletePending: False, Directory: False"
"13:48:28.0122561","MsMpEng.exe","3220","CreateFileMapping","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.6725.cat","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE|PAGE_NOCACHE"
"13:48:28.0122637","MsMpEng.exe","3220","QueryStandardInformationFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.6725.cat","SUCCESS","AllocationSize: 32’768, EndOfFile: 68’180, NumberOfLinks: 3, DeletePending: False, Directory: False"
"13:48:28.0122760","MsMpEng.exe","3220","CreateFileMapping","\Device\HarddiskVolume4ꗔ","SUCCESS","SyncType: SyncTypeOther"
"13:48:28.0123650","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.6725.cat","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:28.0123759","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.6725.cat","BUFFER OVERFLOW","CreationTime: 30.09.2025 16:57:54, LastAccessTime: 13.10.2025 13:44:11, LastWriteTime: 30.09.2025 16:45:09, ChangeTime: 30.09.2025 17:06:31, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 68’180"
"13:48:28.0123909","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\KernelBase.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0124182","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\KernelBase.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.0124275","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\KernelBase.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.0124364","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\KernelBase.dll","SUCCESS",""
"13:48:28.0125050","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~en-GB~10.0.26100.1591.cat","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0125239","MsMpEng.exe","3220","QueryNetworkOpenInformationFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~en-GB~10.0.26100.1591.cat","SUCCESS","CreationTime: 06.09.2024 06:05:08, LastAccessTime: 13.10.2025 13:44:11, LastWriteTime: 06.09.2024 05:59:20, ChangeTime: 12.08.2025 21:30:48, AllocationSize: 01.01.1601 02:00:00, EndOfFile: 01.01.1601 02:00:00, FileAttributes: A"
"13:48:28.0125304","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~en-GB~10.0.26100.1591.cat","SUCCESS",""
"13:48:28.0126349","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~en-GB~10.0.26100.1591.cat","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Disallow Exclusive, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0126563","MsMpEng.exe","3220","QueryStandardInformationFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~en-GB~10.0.26100.1591.cat","SUCCESS","AllocationSize: 40’960, EndOfFile: 87’970, NumberOfLinks: 3, DeletePending: False, Directory: False"
"13:48:28.0126721","MsMpEng.exe","3220","CreateFileMapping","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~en-GB~10.0.26100.1591.cat","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE|PAGE_NOCACHE"
"13:48:28.0126812","MsMpEng.exe","3220","QueryStandardInformationFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~en-GB~10.0.26100.1591.cat","SUCCESS","AllocationSize: 40’960, EndOfFile: 87’970, NumberOfLinks: 3, DeletePending: False, Directory: False"
"13:48:28.0126940","MsMpEng.exe","3220","CreateFileMapping","\Device\HarddiskVolume4뎨","SUCCESS","SyncType: SyncTypeOther"
"13:48:28.0128182","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~en-GB~10.0.26100.1591.cat","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:28.0128270","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~en-GB~10.0.26100.1591.cat","BUFFER OVERFLOW","CreationTime: 06.09.2024 06:05:08, LastAccessTime: 13.10.2025 13:44:11, LastWriteTime: 06.09.2024 05:59:20, ChangeTime: 12.08.2025 21:30:48, FileAttributes: A, AllocationSize: 40’960, EndOfFile: 87’970"
"13:48:28.0128677","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.5074.cat","SUCCESS",""
"13:48:28.0129061","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.6725.cat","SUCCESS",""
"13:48:28.0129452","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~en-GB~10.0.26100.1591.cat","SUCCESS",""
"13:48:28.0130287","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.5074.cat","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Open For Backup, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0130647","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.5074.cat","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.0131316","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.5074.cat","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: RH, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0131620","MsMpEng.exe","3220","QueryStandardInformationFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.5074.cat","SUCCESS","AllocationSize: 32’768, EndOfFile: 68’167, NumberOfLinks: 3, DeletePending: False, Directory: False"
"13:48:28.0131707","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.5074.cat","SUCCESS","CreationTime: 30.08.2025 10:16:17, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 30.08.2025 10:04:47, ChangeTime: 30.08.2025 10:21:59, FileAttributes: A"
"13:48:28.0131824","MsMpEng.exe","3220","ReadFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.5074.cat","SUCCESS","Offset: 0, Length: 68’167, Priority: Normal"
"13:48:28.0136797","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\advapi32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0137181","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\advapi32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.0137288","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\advapi32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.0137374","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\advapi32.dll","SUCCESS",""
"13:48:28.0138794","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\msvcrt.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0139273","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcrt.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.0139403","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcrt.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.0139707","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\msvcrt.dll","SUCCESS",""
"13:48:28.0141277","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\sechost.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0141774","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\sechost.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.0141871","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\sechost.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.0142081","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\sechost.dll","SUCCESS",""
"13:48:28.0143059","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\rpcrt4.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0144061","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.5074.cat","SUCCESS",""
"13:48:28.0144222","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0111~31bf3856ad364e35~amd64~en-GB~10.0.26100.5074.cat","SUCCESS",""
"13:48:28.0144848","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\rpcrt4.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.0144973","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\rpcrt4.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.0145070","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\rpcrt4.dll","SUCCESS",""
"13:48:28.0147675","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\user32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0147962","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\user32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.0148143","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\user32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.0148169","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\en-US\grpconv.exe.mui","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0148217","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\user32.dll","SUCCESS",""
"13:48:28.0148382","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\en-US\grpconv.exe.mui","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.0148497","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\en-US\grpconv.exe.mui","SUCCESS",""
"13:48:28.0148752","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\en-US\grpconv.exe.mui","SUCCESS",""
"13:48:28.0149734","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\win32u.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0150797","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\win32u.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.0150940","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\win32u.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.0151036","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\win32u.dll","SUCCESS",""
"13:48:28.0154734","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\gdi32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0155249","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\gdi32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.0155353","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\gdi32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.0155443","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\gdi32.dll","SUCCESS",""
"13:48:28.0156942","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\gdi32full.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0157157","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\gdi32full.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.0157231","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\gdi32full.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.0157306","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\gdi32full.dll","SUCCESS",""
"13:48:28.0158285","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\msvcp_win.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0158469","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcp_win.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.0158535","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcp_win.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.0158597","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\msvcp_win.dll","SUCCESS",""
"13:48:28.0160074","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\ucrtbase.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0160319","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ucrtbase.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.0160399","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ucrtbase.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.0168866","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\ucrtbase.dll","SUCCESS",""
"13:48:28.0174862","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\shell32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0176858","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\shell32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.0177148","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\shell32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.0177265","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\shell32.dll","SUCCESS",""
"13:48:28.0182979","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\WinTypes.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0183767","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\WinTypes.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.0183953","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\WinTypes.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.0184058","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\WinTypes.dll","SUCCESS",""
"13:48:28.0198161","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\imm32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0198546","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\imm32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.0198636","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\imm32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.0198712","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\imm32.dll","SUCCESS",""
"13:48:28.0199743","MsMpEng.exe","3220","CreateFile","C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6725_none_3e085828e334708b\comctl32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0199956","MsMpEng.exe","3220","FileSystemControl","C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6725_none_3e085828e334708b\comctl32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.0200038","MsMpEng.exe","3220","FileSystemControl","C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6725_none_3e085828e334708b\comctl32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.0200194","MsMpEng.exe","3220","CloseFile","C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6725_none_3e085828e334708b\comctl32.dll","SUCCESS",""
"13:48:28.0201140","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\combase.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0202701","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\combase.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.0202843","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\combase.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.0203061","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\combase.dll","SUCCESS",""
"13:48:28.0204664","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\shlwapi.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0205163","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\shlwapi.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.0205283","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\shlwapi.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.0205483","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\shlwapi.dll","SUCCESS",""
"13:48:28.0254379","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\kernel.appcore.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0254602","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel.appcore.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.0254695","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel.appcore.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.0254771","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\kernel.appcore.dll","SUCCESS",""
"13:48:28.0257540","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\bcryptprimitives.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0257761","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\bcryptprimitives.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.0258005","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\bcryptprimitives.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.0258105","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\bcryptprimitives.dll","SUCCESS",""
"13:48:28.0270441","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\uxtheme.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0270816","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\uxtheme.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.0270936","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\uxtheme.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.0271013","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\uxtheme.dll","SUCCESS",""
"13:48:28.0286892","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\ole32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.0287268","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ole32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.0287378","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ole32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.0287457","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\ole32.dll","SUCCESS",""
"13:48:28.0340751","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:28.0341071","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:28.0346317","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:28.0346543","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:28.3342979","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\runonce.exe","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Open For Backup, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.3344175","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\runonce.exe","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.3345044","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\runonce.exe","SUCCESS","Desired Access: Read Data/List Directory, Read EA, Read Attributes, Synchronize, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.3345523","MsMpEng.exe","3220","QueryEAFile","C:\Windows\System32\runonce.exe","BUFFER OVERFLOW",""
"13:48:28.3345903","MsMpEng.exe","3220","QueryEAFile","C:\Windows\System32\runonce.exe","SUCCESS",""
"13:48:28.3346020","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\runonce.exe","SUCCESS","Control: FSCTL_QUERY_USN_JOURNAL"
"13:48:28.3346147","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\runonce.exe","SUCCESS",""
"13:48:28.3346358","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\runonce.exe","SUCCESS",""
"13:48:28.3563838","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:28.3564103","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:28.3898769","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.3899185","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:28.3899397","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:28.3899493","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:28.3900002","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:28.3900367","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.3900483","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.3900732","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.3901603","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.3901784","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:28.3901853","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:28.3902050","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:28.3902102","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:28.3902190","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.3902267","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.3902383","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.3903599","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.3903847","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:28.3903918","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:28.3903994","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:28.3904205","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:28.3904454","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.3904563","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.3904729","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.3905725","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.3905983","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.3906072","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.3907981","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\wintrust.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.3908339","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\wintrust.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.3908549","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\wintrust.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.3909303","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\wintrust.dll","SUCCESS",""
"13:48:28.3910627","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\crypt32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.3910981","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\crypt32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.3911167","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\crypt32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.3911292","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\crypt32.dll","SUCCESS",""
"13:48:28.3912624","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\msasn1.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.3912986","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msasn1.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.3913117","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msasn1.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.3913213","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\msasn1.dll","SUCCESS",""
"13:48:28.3914343","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.3914514","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\drivers\NeacSafe64.sys","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.3914587","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.3914651","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS",""
"13:48:28.4062534","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\wintrust.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4063170","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\wintrust.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:28.4063250","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\wintrust.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:40, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 30.09.2025 13:54:40, ChangeTime: 01.10.2025 17:29:49, FileAttributes: A, AllocationSize: 299’008, EndOfFile: 530’344"
"13:48:28.4063657","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\wintrust.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Win,"
"13:48:28.4063736","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\wintrust.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:40, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 30.09.2025 13:54:40, ChangeTime: 01.10.2025 17:29:49, FileAttributes: A, AllocationSize: 299’008, EndOfFile: 530’344"
"13:48:28.4064095","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\wintrust.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.4064335","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\wintrust.dll","SUCCESS",""
"13:48:28.4065552","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\wintrust.dll","SUCCESS",""
"13:48:28.4070978","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\crypt32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4071431","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\crypt32.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᅄ"
"13:48:28.4071665","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\crypt32.dll","BUFFER OVERFLOW","CreationTime: 30.08.2025 10:09:13, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 30.08.2025 10:09:13, ChangeTime: 30.09.2025 17:02:31, FileAttributes: A, AllocationSize: 909’312, EndOfFile: 1’534’408"
"13:48:28.4071832","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\crypt32.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:28.4071900","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\crypt32.dll","BUFFER OVERFLOW","CreationTime: 30.08.2025 10:09:13, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 30.08.2025 10:09:13, ChangeTime: 30.09.2025 17:02:31, FileAttributes: A, AllocationSize: 909’312, EndOfFile: 1’534’408"
"13:48:28.4072064","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\crypt32.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.4072169","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\crypt32.dll","SUCCESS",""
"13:48:28.4072333","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\crypt32.dll","SUCCESS",""
"13:48:28.4073460","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.4074062","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\msasn1.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4074363","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\msasn1.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:28.4074449","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\msasn1.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:57, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 30.09.2025 13:53:57, ChangeTime: 01.10.2025 17:29:49, FileAttributes: A, AllocationSize: 40’960, EndOfFile: 88’248"
"13:48:28.4074530","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\msasn1.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᅄ"
"13:48:28.4074658","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\msasn1.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:53:57, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 30.09.2025 13:53:57, ChangeTime: 01.10.2025 17:29:49, FileAttributes: A, AllocationSize: 40’960, EndOfFile: 88’248"
"13:48:28.4074768","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msasn1.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.4074841","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\msasn1.dll","SUCCESS",""
"13:48:28.4074966","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\msasn1.dll","SUCCESS",""
"13:48:28.4075532","MsMpEng.exe","3220","RegOpenKey","HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment","REPARSE","Desired Access: Read"
"13:48:28.4076521","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4076751","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\drivers\NeacSafe64.sys","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winწ"
"13:48:28.4076830","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\drivers\NeacSafe64.sys","BUFFER OVERFLOW","CreationTime: 10.10.2025 23:07:07, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 13:48:27, ChangeTime: 13.10.2025 13:48:27, FileAttributes: A, AllocationSize: 2’519’040, EndOfFile: 2’518’232"
"13:48:28.4076908","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\drivers\NeacSafe64.sys","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:28.4076964","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\drivers\NeacSafe64.sys","BUFFER OVERFLOW","CreationTime: 10.10.2025 23:07:07, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 13:48:27, ChangeTime: 13.10.2025 13:48:27, FileAttributes: A, AllocationSize: 2’519’040, EndOfFile: 2’518’232"
"13:48:28.4077111","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.4077213","MsMpEng.exe","3220","RegOpenKey","HKLM\System\CurrentControlSet\Control\Session Manager\Environment","SUCCESS","Desired Access: Read"
"13:48:28.4077252","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS",""
"13:48:28.4077370","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS",""
"13:48:28.4078235","MsMpEng.exe","3220","RegQueryKey","HKLM\System\CurrentControlSet\Control\Session Manager\Environment","SUCCESS","Query: Cached, SubKeys: 0, Values: 15"
"13:48:28.4078596","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4078989","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\drivers\NeacSafe64.sys","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᅄ"
"13:48:28.4079086","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\drivers\NeacSafe64.sys","BUFFER OVERFLOW","CreationTime: 10.10.2025 23:07:07, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 13:48:27, ChangeTime: 13.10.2025 13:48:27, FileAttributes: A, AllocationSize: 2’519’040, EndOfFile: 2’518’232"
"13:48:28.4079167","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\drivers\NeacSafe64.sys","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:28.4079216","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\drivers\NeacSafe64.sys","BUFFER OVERFLOW","CreationTime: 10.10.2025 23:07:07, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 13:48:27, ChangeTime: 13.10.2025 13:48:27, FileAttributes: A, AllocationSize: 2’519’040, EndOfFile: 2’518’232"
"13:48:28.4079287","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.4079379","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS",""
"13:48:28.4079578","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS",""
"13:48:28.4079653","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment","SUCCESS","Index: 0, Type: REG_EXPAND_SZ"
"13:48:28.4080685","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4081275","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\drivers\NeacSafe64.sys","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:28.4081348","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\drivers\NeacSafe64.sys","BUFFER OVERFLOW","CreationTime: 10.10.2025 23:07:07, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 13:48:27, ChangeTime: 13.10.2025 13:48:27, FileAttributes: A, AllocationSize: 2’519’040, EndOfFile: 2’518’232"
"13:48:28.4081438","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\drivers\NeacSafe64.sys","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:28.4081492","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\drivers\NeacSafe64.sys","BUFFER OVERFLOW","CreationTime: 10.10.2025 23:07:07, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 13:48:27, ChangeTime: 13.10.2025 13:48:27, FileAttributes: A, AllocationSize: 2’519’040, EndOfFile: 2’518’232"
"13:48:28.4081565","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.4081602","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment\ComSpec","SUCCESS","Type: REG_EXPAND_SZ, Length: 60, Data: %SystemRoot%\system32\cmd.exe"
"13:48:28.4081655","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS",""
"13:48:28.4081871","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS",""
"13:48:28.4082884","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4083152","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.4083252","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS",""
"13:48:28.4084074","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Open For Backup, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4084385","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\drivers\NeacSafe64.sys","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.4085031","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Desired Access: Read Data/List Directory, Read EA, Read Attributes, Synchronize, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4085268","MsMpEng.exe","3220","QueryEAFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS",""
"13:48:28.4085447","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS",""
"13:48:28.4086514","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS",""
"13:48:28.4087427","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment","SUCCESS","Index: 1, Type: REG_SZ"
"13:48:28.4089002","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment\DriverData","SUCCESS","Type: REG_SZ, Length: 78, Data: C:\Windows\System32\Drivers\DriverData"
"13:48:28.4090547","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment","SUCCESS","Index: 2, Type: REG_SZ"
"13:48:28.4091814","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment\OS","SUCCESS","Type: REG_SZ, Length: 22, Data: Windows_NT"
"13:48:28.4093401","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment","SUCCESS","Index: 3, Type: REG_EXPAND_SZ"
"13:48:28.4095410","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment\Path","BUFFER OVERFLOW","Length: 144"
"13:48:28.4095466","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Open For Backup, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4096645","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment\Path","SUCCESS","Type: REG_EXPAND_SZ, Length: 514, Data: "
"13:48:28.4097914","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment","SUCCESS","Index: 4, Type: REG_SZ"
"13:48:28.4099007","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment\PATHEXT","SUCCESS","Type: REG_SZ, Length: 108, Data: .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC"
"13:48:28.4099163","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\drivers\NeacSafe64.sys","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.4100824","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment","SUCCESS","Index: 5, Type: REG_SZ"
"13:48:28.4101942","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment\PROCESSOR_ARCHITECTURE","SUCCESS","Type: REG_SZ, Length: 12, Data: AMD64"
"13:48:28.4103225","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment","SUCCESS","Index: 6, Type: REG_EXPAND_SZ"
"13:48:28.4104192","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment\PSModulePath","BUFFER OVERFLOW","Length: 144"
"13:48:28.4106832","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment\PSModulePath","SUCCESS","Type: REG_EXPAND_SZ, Length: 188, Data: "
"13:48:28.4108727","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment","SUCCESS","Index: 7, Type: REG_EXPAND_SZ"
"13:48:28.4111180","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment\TEMP","SUCCESS","Type: REG_EXPAND_SZ, Length: 36, Data: %SystemRoot%\TEMP"
"13:48:28.4114699","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment","SUCCESS","Index: 8, Type: REG_EXPAND_SZ"
"13:48:28.4119680","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment\TMP","SUCCESS","Type: REG_EXPAND_SZ, Length: 36, Data: %SystemRoot%\TEMP"
"13:48:28.4121491","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment","SUCCESS","Index: 9, Type: REG_SZ"
"13:48:28.4122589","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment\USERNAME","SUCCESS","Type: REG_SZ, Length: 14, Data: SYSTEM"
"13:48:28.4123776","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment","SUCCESS","Index: 10, Type: REG_EXPAND_SZ"
"13:48:28.4124750","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment\windir","SUCCESS","Type: REG_EXPAND_SZ, Length: 26, Data: %SystemRoot%"
"13:48:28.4126314","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment","SUCCESS","Index: 11, Type: REG_SZ"
"13:48:28.4127466","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment\NUMBER_OF_PROCESSORS","SUCCESS","Type: REG_SZ, Length: 4, Data: 4"
"13:48:28.4129272","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment","SUCCESS","Index: 12, Type: REG_SZ"
"13:48:28.4130339","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment\PROCESSOR_LEVEL","SUCCESS","Type: REG_SZ, Length: 6, Data: 25"
"13:48:28.4131439","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment","SUCCESS","Index: 13, Type: REG_SZ"
"13:48:28.4132525","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment\PROCESSOR_IDENTIFIER","SUCCESS","Type: REG_SZ, Length: 100, Data: AMD64 Family 25 Model 33 Stepping 0, AuthenticAMD"
"13:48:28.4133289","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment","SUCCESS","Index: 14, Type: REG_SZ"
"13:48:28.4134232","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\Session Manager\Environment\PROCESSOR_REVISION","SUCCESS","Type: REG_SZ, Length: 10, Data: 2100"
"13:48:28.4135187","MsMpEng.exe","3220","RegCloseKey","HKLM\System\CurrentControlSet\Control\Session Manager\Environment","SUCCESS",""
"13:48:28.4136168","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.4144746","MsMpEng.exe","3220","RegOpenKey","HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SFC","REPARSE","Desired Access: Read"
"13:48:28.4145954","MsMpEng.exe","3220","RegOpenKey","HKLM\System\CurrentControlSet\Control\Session Manager\SFC","NAME NOT FOUND","Desired Access: Read"
"13:48:28.4147199","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.4148243","MsMpEng.exe","3220","RegOpenKey","HKLM\Software\Microsoft\Windows\CurrentVersion","SUCCESS","Desired Access: Read"
"13:48:28.4149953","MsMpEng.exe","3220","RegQueryKey","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion","SUCCESS","Query: Cached, SubKeys: 167, Values: 11"
"13:48:28.4152459","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion","SUCCESS","Index: 0, Type: REG_SZ"
"13:48:28.4154152","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir","SUCCESS","Type: REG_SZ, Length: 34, Data: C:\Program Files"
"13:48:28.4156536","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion","SUCCESS","Index: 1, Type: REG_SZ"
"13:48:28.4159412","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir","SUCCESS","Type: REG_SZ, Length: 60, Data: C:\Program Files\Common Files"
"13:48:28.4161412","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Desired Access: Read Data/List Directory, Read EA, Read Attributes, Synchronize, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4161750","MsMpEng.exe","3220","QueryEAFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS",""
"13:48:28.4161887","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS",""
"13:48:28.4162088","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS",""
"13:48:28.4163839","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Open For Backup, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4164077","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\drivers\NeacSafe64.sys","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.4164790","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion","SUCCESS","Index: 2, Type: REG_SZ"
"13:48:28.4166301","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)","SUCCESS","Type: REG_SZ, Length: 46, Data: C:\Program Files (x86)"
"13:48:28.4166895","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4167274","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion","SUCCESS","Index: 3, Type: REG_SZ"
"13:48:28.4168452","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)","SUCCESS","Type: REG_SZ, Length: 72, Data: C:\Program Files (x86)\Common Files"
"13:48:28.4170713","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion","SUCCESS","Index: 4, Type: REG_SZ"
"13:48:28.4172534","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir","SUCCESS","Type: REG_SZ, Length: 60, Data: C:\Program Files\Common Files"
"13:48:28.4174126","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion","SUCCESS","Index: 5, Type: REG_EXPAND_SZ"
"13:48:28.4176792","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DevicePath","SUCCESS","Type: REG_EXPAND_SZ, Length: 34, Data: %SystemRoot%\inf"
"13:48:28.4178130","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion","SUCCESS","Index: 6, Type: REG_EXPAND_SZ"
"13:48:28.4179072","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\MediaPathUnexpanded","SUCCESS","Type: REG_EXPAND_SZ, Length: 38, Data: %SystemRoot%\Media"
"13:48:28.4179942","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion","SUCCESS","Index: 7, Type: REG_EXPAND_SZ"
"13:48:28.4181129","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesPath","SUCCESS","Type: REG_EXPAND_SZ, Length: 30, Data: %ProgramFiles%"
"13:48:28.4182246","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion","SUCCESS","Index: 8, Type: REG_SZ"
"13:48:28.4183162","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir","SUCCESS","Type: REG_SZ, Length: 34, Data: C:\Program Files"
"13:48:28.4184081","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion","SUCCESS","Index: 9, Type: REG_SZ"
"13:48:28.4185178","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SM_ConfigureProgramsName","SUCCESS","Type: REG_SZ, Length: 64, Data: Set Program Access and Defaults"
"13:48:28.4186417","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion","SUCCESS","Index: 10, Type: REG_SZ"
"13:48:28.4187391","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SM_GamesName","SUCCESS","Type: REG_SZ, Length: 12, Data: Games"
"13:48:28.4189601","MsMpEng.exe","3220","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion","SUCCESS",""
"13:48:28.4190797","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.4191727","MsMpEng.exe","3220","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList","SUCCESS","Desired Access: Read"
"13:48:28.4192705","MsMpEng.exe","3220","RegQueryKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList","SUCCESS","Query: Cached, SubKeys: 4, Values: 4"
"13:48:28.4193577","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList","SUCCESS","Index: 0, Type: REG_EXPAND_SZ"
"13:48:28.4194418","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","CreationTime: 10.10.2025 23:07:07, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 13:48:27, ChangeTime: 13.10.2025 13:48:27, FileAttributes: A"
"13:48:28.4194487","MsMpEng.exe","3220","QueryStandardInformationFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","AllocationSize: 2’519’040, EndOfFile: 2’518’232, NumberOfLinks: 1, DeletePending: False, Directory: False"
"13:48:28.4195080","MsMpEng.exe","3220","ReadFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Offset: 0, Length: 4’096, Priority: Normal"
"13:48:28.4197308","MsMpEng.exe","3220","ReadFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Offset: 2’510’848, Length: 7’384, Priority: Normal"
"13:48:28.4197999","MsMpEng.exe","3220","ReadFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Offset: 2’506’752, Length: 4’096, Priority: Normal"
"13:48:28.4200447","MsMpEng.exe","3220","ReadFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Offset: 4’096, Length: 520’192, Priority: Normal"
"13:48:28.4213650","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default","SUCCESS","Type: REG_EXPAND_SZ, Length: 56, Data: %SystemDrive%\Users\Default"
"13:48:28.4214361","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList","SUCCESS","Index: 1, Type: REG_EXPAND_SZ"
"13:48:28.4215221","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProfilesDirectory","SUCCESS","Type: REG_EXPAND_SZ, Length: 40, Data: %SystemDrive%\Users"
"13:48:28.4216075","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList","SUCCESS","Index: 2, Type: REG_EXPAND_SZ"
"13:48:28.4216941","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData","SUCCESS","Type: REG_EXPAND_SZ, Length: 52, Data: %SystemDrive%\ProgramData"
"13:48:28.4217760","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList","SUCCESS","Index: 3, Type: REG_EXPAND_SZ"
"13:48:28.4218530","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public","SUCCESS","Type: REG_EXPAND_SZ, Length: 54, Data: %SystemDrive%\Users\Public"
"13:48:28.4219514","MsMpEng.exe","3220","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList","SUCCESS",""
"13:48:28.4221313","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.4222249","MsMpEng.exe","3220","RegCreateKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList","SUCCESS","Desired Access: Read, Disposition: REG_OPENED_EXISTING_KEY"
"13:48:28.4223180","MsMpEng.exe","3220","RegQueryKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList","SUCCESS","Query: Cached, SubKeys: 4, Values: 4"
"13:48:28.4224012","MsMpEng.exe","3220","RegEnumKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList","SUCCESS","Index: 0, Name: S-1-5-18"
"13:48:28.4224820","MsMpEng.exe","3220","RegQueryKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.4225533","MsMpEng.exe","3220","RegOpenKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18","SUCCESS","Desired Access: Read"
"13:48:28.4226493","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath","SUCCESS","Type: REG_EXPAND_SZ, Length: 86, Data: %systemroot%\system32\config\systemprofile"
"13:48:28.4228042","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\config\systemprofile\ntuser.dat","NAME NOT FOUND","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:28.4228791","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\config\systemprofile\ntuser.dat","NAME NOT FOUND","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:28.4229713","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\config\systemprofile\ntuser.dat","NAME NOT FOUND","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:28.4230427","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\config\systemprofile","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4230629","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\config\systemprofile","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:28.4230704","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\config\systemprofile","BUFFER OVERFLOW","CreationTime: 01.04.2024 09:26:07, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 01.04.2024 09:26:07, ChangeTime: 12.08.2025 21:35:30, FileAttributes: D, AllocationSize: 0, EndOfFile: 0"
"13:48:28.4231071","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\config\systemprofile\ntuser.dat","NO SUCH FILE","FileInformationClass: FileIdFullDirectoryInformation, Filter: ntuser.dat"
"13:48:28.4231256","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\config\systemprofile","SUCCESS",""
"13:48:28.4232891","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\config\systemprofile\AppData\Local\VirtualStore","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:28.4233149","MsMpEng.exe","3220","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18","SUCCESS",""
"13:48:28.4243416","MsMpEng.exe","3220","ReadFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Offset: 524’288, Length: 524’288, Priority: Normal"
"13:48:28.4244103","MsMpEng.exe","3220","RegEnumKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList","SUCCESS","Index: 1, Name: S-1-5-19"
"13:48:28.4249018","MsMpEng.exe","3220","RegQueryKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.4250263","MsMpEng.exe","3220","RegOpenKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19","SUCCESS","Desired Access: Read"
"13:48:28.4251111","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19\ProfileImagePath","SUCCESS","Type: REG_EXPAND_SZ, Length: 84, Data: %systemroot%\ServiceProfiles\LocalService"
"13:48:28.4253192","MsMpEng.exe","3220","CreateFile","C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4253529","MsMpEng.exe","3220","QueryNetworkOpenInformationFile","C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT","SUCCESS","CreationTime: 12.08.2025 20:37:21, LastAccessTime: 13.10.2025 13:30:48, LastWriteTime: 13.10.2025 13:30:48, ChangeTime: 12.08.2025 20:37:21, AllocationSize: 01.01.1601 02:00:00, EndOfFile: 01.01.1601 02:00:00, FileAttributes: A"
"13:48:28.4253621","MsMpEng.exe","3220","CloseFile","C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT","SUCCESS",""
"13:48:28.4254391","MsMpEng.exe","3220","CreateFile","C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4254585","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT","SUCCESS","CreationTime: 12.08.2025 20:37:21, LastAccessTime: 13.10.2025 13:30:48, LastWriteTime: 13.10.2025 13:30:48, ChangeTime: 12.08.2025 20:37:21, FileAttributes: A"
"13:48:28.4254748","MsMpEng.exe","3220","CloseFile","C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT","SUCCESS",""
"13:48:28.4256222","MsMpEng.exe","3220","CreateFile","C:\Windows\ServiceProfiles\LocalService\AppData\Local\VirtualStore","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:28.4256454","MsMpEng.exe","3220","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19","SUCCESS",""
"13:48:28.4257623","MsMpEng.exe","3220","RegEnumKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList","SUCCESS","Index: 2, Name: S-1-5-20"
"13:48:28.4258432","MsMpEng.exe","3220","RegQueryKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.4259287","MsMpEng.exe","3220","RegOpenKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20","SUCCESS","Desired Access: Read"
"13:48:28.4260427","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20\ProfileImagePath","SUCCESS","Type: REG_EXPAND_SZ, Length: 88, Data: %systemroot%\ServiceProfiles\NetworkService"
"13:48:28.4263013","MsMpEng.exe","3220","CreateFile","C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4263369","MsMpEng.exe","3220","QueryNetworkOpenInformationFile","C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT","SUCCESS","CreationTime: 12.08.2025 20:37:21, LastAccessTime: 13.10.2025 13:30:48, LastWriteTime: 13.10.2025 13:30:48, ChangeTime: 12.08.2025 20:37:21, AllocationSize: 01.01.1601 02:00:00, EndOfFile: 01.01.1601 02:00:00, FileAttributes: A"
"13:48:28.4263451","MsMpEng.exe","3220","CloseFile","C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT","SUCCESS",""
"13:48:28.4264220","MsMpEng.exe","3220","CreateFile","C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4264481","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT","SUCCESS","CreationTime: 12.08.2025 20:37:21, LastAccessTime: 13.10.2025 13:30:48, LastWriteTime: 13.10.2025 13:30:48, ChangeTime: 12.08.2025 20:37:21, FileAttributes: A"
"13:48:28.4264585","MsMpEng.exe","3220","CloseFile","C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT","SUCCESS",""
"13:48:28.4265934","MsMpEng.exe","3220","CreateFile","C:\Windows\ServiceProfiles\NetworkService\AppData\Local\VirtualStore","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:28.4266165","MsMpEng.exe","3220","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20","SUCCESS",""
"13:48:28.4266730","MsMpEng.exe","3220","ReadFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Offset: 1’048’576, Length: 524’288, Priority: Normal"
"13:48:28.4268823","MsMpEng.exe","3220","RegEnumKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList","SUCCESS","Index: 3, Name: S-1-5-21-4172013786-3171869251-2938521833-1000"
"13:48:28.4269624","MsMpEng.exe","3220","RegQueryKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.4270477","MsMpEng.exe","3220","RegOpenKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-4172013786-3171869251-2938521833-1000","SUCCESS","Desired Access: Read"
"13:48:28.4271583","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-4172013786-3171869251-2938521833-1000\ProfileImagePath","SUCCESS","Type: REG_EXPAND_SZ, Length: 32, Data: C:\Users\hacker"
"13:48:28.4273472","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\NTUSER.DAT","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4273808","MsMpEng.exe","3220","QueryNetworkOpenInformationFile","C:\Users\hacker\NTUSER.DAT","SUCCESS","CreationTime: 12.08.2025 19:41:55, LastAccessTime: 13.10.2025 13:30:45, LastWriteTime: 13.10.2025 13:30:45, ChangeTime: 12.08.2025 19:41:55, AllocationSize: 01.01.1601 02:00:00, EndOfFile: 01.01.1601 02:00:00, FileAttributes: HANCI"
"13:48:28.4273875","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\NTUSER.DAT","SUCCESS",""
"13:48:28.4275274","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\NTUSER.DAT","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4275571","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Users\hacker\NTUSER.DAT","SUCCESS","CreationTime: 12.08.2025 19:41:55, LastAccessTime: 13.10.2025 13:30:45, LastWriteTime: 13.10.2025 13:30:45, ChangeTime: 12.08.2025 19:41:55, FileAttributes: HANCI"
"13:48:28.4275853","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\NTUSER.DAT","SUCCESS",""
"13:48:28.4277164","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\AppData\Local\VirtualStore","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4277425","MsMpEng.exe","3220","QueryNetworkOpenInformationFile","C:\Users\hacker\AppData\Local\VirtualStore","SUCCESS","CreationTime: 12.08.2025 19:42:01, LastAccessTime: 13.10.2025 13:32:41, LastWriteTime: 12.08.2025 19:42:01, ChangeTime: 12.08.2025 19:42:01, AllocationSize: 01.01.1601 02:00:00, EndOfFile: 01.01.1601 02:00:00, FileAttributes: D"
"13:48:28.4277490","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\AppData\Local\VirtualStore","SUCCESS",""
"13:48:28.4278028","MsMpEng.exe","3220","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-4172013786-3171869251-2938521833-1000","SUCCESS",""
"13:48:28.4278821","MsMpEng.exe","3220","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList","SUCCESS",""
"13:48:28.4279826","MsMpEng.exe","3220","RegQueryKey","HKU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.4280614","MsMpEng.exe","3220","RegOpenKey","HKU\S-1-5-18","REPARSE","Desired Access: Read"
"13:48:28.4281164","MsMpEng.exe","3220","RegOpenKey","HKU\.DEFAULT","SUCCESS","Desired Access: Read"
"13:48:28.4282185","MsMpEng.exe","3220","RegCloseKey","HKU\.DEFAULT","SUCCESS",""
"13:48:28.4282944","MsMpEng.exe","3220","RegQueryKey","HKU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.4283872","MsMpEng.exe","3220","RegOpenKey","HKU\S-1-5-18","REPARSE","Desired Access: Read"
"13:48:28.4285679","MsMpEng.exe","3220","RegOpenKey","HKU\.DEFAULT","SUCCESS","Desired Access: Read"
"13:48:28.4286557","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.4287260","MsMpEng.exe","3220","RegOpenKey","HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Desired Access: Read"
"13:48:28.4287863","MsMpEng.exe","3220","RegQueryKey","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Query: Cached, SubKeys: 0, Values: 12"
"13:48:28.4288690","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 0, Type: REG_SZ"
"13:48:28.4289558","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Administrative Tools","BUFFER OVERFLOW","Length: 144"
"13:48:28.4290272","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Administrative Tools","SUCCESS","Type: REG_SZ, Length: 148, Data: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools"
"13:48:28.4290763","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 1, Type: REG_SZ"
"13:48:28.4291735","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common AppData","SUCCESS","Type: REG_SZ, Length: 30, Data: C:\ProgramData"
"13:48:28.4292670","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 2, Type: REG_SZ"
"13:48:28.4293966","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Desktop","SUCCESS","Type: REG_SZ, Length: 48, Data: C:\Users\Public\Desktop"
"13:48:28.4295015","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 3, Type: REG_SZ"
"13:48:28.4295811","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Documents","SUCCESS","Type: REG_SZ, Length: 52, Data: C:\Users\Public\Documents"
"13:48:28.4297692","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 4, Type: REG_SZ"
"13:48:28.4299565","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Programs","SUCCESS","Type: REG_SZ, Length: 106, Data: C:\ProgramData\Microsoft\Windows\Start Menu\Programs"
"13:48:28.4300556","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 5, Type: REG_SZ"
"13:48:28.4301819","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Start Menu","SUCCESS","Type: REG_SZ, Length: 88, Data: C:\ProgramData\Microsoft\Windows\Start Menu"
"13:48:28.4302873","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 6, Type: REG_SZ"
"13:48:28.4303502","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Startup","SUCCESS","Type: REG_SZ, Length: 122, Data: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
"13:48:28.4304065","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 7, Type: REG_SZ"
"13:48:28.4304453","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Templates","SUCCESS","Type: REG_SZ, Length: 86, Data: C:\ProgramData\Microsoft\Windows\Templates"
"13:48:28.4305291","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 8, Type: REG_SZ"
"13:48:28.4305746","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\CommonMusic","SUCCESS","Type: REG_SZ, Length: 44, Data: C:\Users\Public\Music"
"13:48:28.4306404","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 9, Type: REG_SZ"
"13:48:28.4306780","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\CommonPictures","SUCCESS","Type: REG_SZ, Length: 50, Data: C:\Users\Public\Pictures"
"13:48:28.4307358","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 10, Type: REG_SZ"
"13:48:28.4307971","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\CommonVideo","SUCCESS","Type: REG_SZ, Length: 46, Data: C:\Users\Public\Videos"
"13:48:28.4308607","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 11, Type: REG_SZ"
"13:48:28.4309026","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\OEM Links","SUCCESS","Type: REG_SZ, Length: 50, Data: C:\ProgramData\OEM\Links"
"13:48:28.4309918","MsMpEng.exe","3220","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS",""
"13:48:28.4310712","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.4311488","MsMpEng.exe","3220","RegOpenKey","HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Desired Access: Read"
"13:48:28.4312410","MsMpEng.exe","3220","RegQueryKey","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Query: Cached, SubKeys: 1, Values: 11"
"13:48:28.4313617","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 0, Type: REG_EXPAND_SZ"
"13:48:28.4314059","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common AppData","SUCCESS","Type: REG_EXPAND_SZ, Length: 28, Data: %ProgramData%"
"13:48:28.4314964","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 1, Type: REG_EXPAND_SZ"
"13:48:28.4315793","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Desktop","SUCCESS","Type: REG_EXPAND_SZ, Length: 34, Data: %PUBLIC%\Desktop"
"13:48:28.4316446","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 2, Type: REG_EXPAND_SZ"
"13:48:28.4316960","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Documents","SUCCESS","Type: REG_EXPAND_SZ, Length: 38, Data: %PUBLIC%\Documents"
"13:48:28.4317255","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 3, Type: REG_EXPAND_SZ"
"13:48:28.4317660","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Programs","SUCCESS","Type: REG_EXPAND_SZ, Length: 104, Data: %ProgramData%\Microsoft\Windows\Start Menu\Programs"
"13:48:28.4318276","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 4, Type: REG_EXPAND_SZ"
"13:48:28.4318622","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Start Menu","SUCCESS","Type: REG_EXPAND_SZ, Length: 86, Data: %ProgramData%\Microsoft\Windows\Start Menu"
"13:48:28.4319047","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 5, Type: REG_EXPAND_SZ"
"13:48:28.4319574","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Startup","SUCCESS","Type: REG_EXPAND_SZ, Length: 120, Data: %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup"
"13:48:28.4320504","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 6, Type: REG_EXPAND_SZ"
"13:48:28.4321108","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Templates","SUCCESS","Type: REG_EXPAND_SZ, Length: 84, Data: %ProgramData%\Microsoft\Windows\Templates"
"13:48:28.4321768","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 7, Type: REG_EXPAND_SZ"
"13:48:28.4322428","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\CommonMusic","SUCCESS","Type: REG_EXPAND_SZ, Length: 30, Data: %PUBLIC%\Music"
"13:48:28.4323192","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 8, Type: REG_EXPAND_SZ"
"13:48:28.4323704","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\CommonPictures","SUCCESS","Type: REG_EXPAND_SZ, Length: 36, Data: %PUBLIC%\Pictures"
"13:48:28.4324145","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 9, Type: REG_EXPAND_SZ"
"13:48:28.4324526","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\CommonVideo","SUCCESS","Type: REG_EXPAND_SZ, Length: 32, Data: %PUBLIC%\Videos"
"13:48:28.4325872","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 10, Type: REG_EXPAND_SZ"
"13:48:28.4326543","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{3D644C9B-1FB8-4f30-9B45-F670235F79C0}","SUCCESS","Type: REG_EXPAND_SZ, Length: 38, Data: %PUBLIC%\Downloads"
"13:48:28.4327177","MsMpEng.exe","3220","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS",""
"13:48:28.4329686","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4329878","MsMpEng.exe","3220","QueryNetworkOpenInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, AllocationSize: 01.01.1601 02:00:00, EndOfFile: 01.01.1601 02:00:00, FileAttributes: A"
"13:48:28.4329947","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.4330808","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4331008","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:28.4331079","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:28.4331154","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:28.4331211","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:28.4331609","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.4331753","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.4332059","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.4332784","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4332948","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:28.4333103","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:28.4333380","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:28.4333455","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:28.4333560","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.4333654","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.4333878","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.4334828","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4335090","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winწ"
"13:48:28.4335188","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:28.4335268","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:28.4335337","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:28.4335411","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.4336662","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.4336931","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.4337882","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4338155","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.4338267","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.4339536","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4339669","MsMpEng.exe","3220","QueryNetworkOpenInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, AllocationSize: 01.01.1601 02:00:00, EndOfFile: 01.01.1601 02:00:00, FileAttributes: A"
"13:48:28.4339729","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.4341558","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Open For Backup, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4341883","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.4342808","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4343140","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A"
"13:48:28.4343208","MsMpEng.exe","3220","QueryStandardInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","AllocationSize: 380’928, EndOfFile: 378’880, NumberOfLinks: 1, DeletePending: False, Directory: False"
"13:48:28.4345916","MsMpEng.exe","3220","CreateFile","C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\4F992D724B6D33EA543475A51B3D00E9","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:28.4346264","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 0, Length: 4’096, Priority: Normal"
"13:48:28.4348375","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 372’736, Length: 6’144, Priority: Normal"
"13:48:28.4348629","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 376’832, Length: 2’048, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.4383576","MsMpEng.exe","3220","ReadFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Offset: 1’572’864, Length: 524’288, Priority: Normal"
"13:48:28.4403465","MsMpEng.exe","3220","ReadFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Offset: 2’097’152, Length: 421’080, Priority: Normal"
"13:48:28.4424770","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.4425339","MsMpEng.exe","3220","QueryEAFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS",""
"13:48:28.4430154","MsMpEng.exe","3220","ReadFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Offset: 0, Length: 4’096, Priority: Normal"
"13:48:28.4436904","MsMpEng.exe","3220","ReadFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Offset: 4’096, Length: 262’144, Priority: Normal"
"13:48:28.4445385","MsMpEng.exe","3220","ReadFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Offset: 266’240, Length: 258’048, Priority: Normal"
"13:48:28.4449553","MsMpEng.exe","3220","ReadFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Offset: 524’288, Length: 4’096, Priority: Normal"
"13:48:28.4462681","MsMpEng.exe","3220","ReadFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Offset: 528’384, Length: 262’144, Priority: Normal"
"13:48:28.4490840","MsMpEng.exe","3220","ReadFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Offset: 790’528, Length: 258’048, Priority: Normal"
"13:48:28.4494464","MsMpEng.exe","3220","ReadFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Offset: 1’048’576, Length: 4’096, Priority: Normal"
"13:48:28.4515156","MsMpEng.exe","3220","ReadFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Offset: 1’052’672, Length: 262’144, Priority: Normal"
"13:48:28.4534980","MsMpEng.exe","3220","ReadFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Offset: 1’314’816, Length: 258’048, Priority: Normal"
"13:48:28.4548680","MsMpEng.exe","3220","ReadFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Offset: 1’572’864, Length: 4’096, Priority: Normal"
"13:48:28.4712170","MsMpEng.exe","3220","ReadFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Offset: 1’576’960, Length: 262’144, Priority: Normal"
"13:48:28.4717004","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 270’336, Length: 4’096, Priority: Normal"
"13:48:28.4717113","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 270’336, Length: 4’096, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.4754079","MsMpEng.exe","3220","ReadFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Offset: 1’839’104, Length: 258’048, Priority: Normal"
"13:48:28.4755787","MsMpEng.exe","3220","ReadFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Offset: 2’097’152, Length: 4’096, Priority: Normal"
"13:48:28.4756729","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 274’432, Length: 4’096, Priority: Normal"
"13:48:28.4757056","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 274’432, Length: 4’096, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.4782713","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 81’920, Length: 4’096, Priority: Normal"
"13:48:28.4782805","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 81’920, Length: 4’096, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.4799448","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 299’008, Length: 4’096, Priority: Normal"
"13:48:28.4800188","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 266’240, Length: 8’192, Priority: Normal"
"13:48:28.4800254","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 266’240, Length: 4’096, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.4803941","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 184’320, Length: 8’192, Priority: Normal"
"13:48:28.4805170","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 184’320, Length: 8’192, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.4811251","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 86’016, Length: 4’096, Priority: Normal"
"13:48:28.4811442","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 86’016, Length: 4’096, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.4814332","MsMpEng.exe","3220","ReadFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Offset: 2’101’248, Length: 262’144, Priority: Normal"
"13:48:28.4814413","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 258’048, Length: 8’192, Priority: Normal"
"13:48:28.4814503","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 258’048, Length: 8’192, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.4829081","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 4’096, Length: 4’096, Priority: Normal"
"13:48:28.4829172","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 4’096, Length: 4’096, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.4844314","MsMpEng.exe","3220","ReadFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Offset: 2’363’392, Length: 147’456, Priority: Normal"
"13:48:28.4847561","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 192’512, Length: 4’096, Priority: Normal"
"13:48:28.4847635","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 192’512, Length: 4’096, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.4907578","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 278’528, Length: 4’096, Priority: Normal"
"13:48:28.4907659","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 278’528, Length: 4’096, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.4909934","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 282’624, Length: 4’096, Priority: Normal"
"13:48:28.4910086","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 282’624, Length: 4’096, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.4914409","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 303’104, Length: 4’096, Priority: Normal"
"13:48:28.4914889","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 307’200, Length: 8’192, Priority: Normal"
"13:48:28.4914958","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 311’296, Length: 4’096, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.4917225","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS",""
"13:48:28.4997512","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\grpconv.exe","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Open For Backup, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.5004346","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\grpconv.exe","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.5005107","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\grpconv.exe","SUCCESS","Desired Access: Read Data/List Directory, Read EA, Read Attributes, Synchronize, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.5005522","MsMpEng.exe","3220","QueryEAFile","C:\Windows\System32\grpconv.exe","BUFFER OVERFLOW",""
"13:48:28.5005841","MsMpEng.exe","3220","QueryEAFile","C:\Windows\System32\grpconv.exe","SUCCESS",""
"13:48:28.5005935","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\grpconv.exe","SUCCESS","Control: FSCTL_QUERY_USN_JOURNAL"
"13:48:28.5006036","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\grpconv.exe","SUCCESS",""
"13:48:28.5006223","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\grpconv.exe","SUCCESS",""
"13:48:28.5010695","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 286’720, Length: 12’288, Priority: Normal"
"13:48:28.5010797","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 286’720, Length: 12’288, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.5011187","MsMpEng.exe","3220","QueryStreamInformationFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS",""
"13:48:28.5011355","MsMpEng.exe","3220","QueryEAFile","C:\Windows\System32\drivers\NeacSafe64.sys","NO EAS ON FILE",""
"13:48:28.5012298","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.5012525","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\drivers\NeacSafe64.sys","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:28.5012596","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\drivers\NeacSafe64.sys","BUFFER OVERFLOW","CreationTime: 10.10.2025 23:07:07, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 13:48:27, ChangeTime: 13.10.2025 13:48:27, FileAttributes: A, AllocationSize: 2’519’040, EndOfFile: 2’518’232"
"13:48:28.5012676","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\drivers\NeacSafe64.sys","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:28.5012816","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\drivers\NeacSafe64.sys","BUFFER OVERFLOW","CreationTime: 10.10.2025 23:07:07, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 13:48:27, ChangeTime: 13.10.2025 13:48:27, FileAttributes: A, AllocationSize: 2’519’040, EndOfFile: 2’518’232"
"13:48:28.5012920","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.5013032","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS",""
"13:48:28.5014134","MsMpEng.exe","3220","QueryStreamInformationFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS",""
"13:48:28.5014255","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS",""
"13:48:28.5015104","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS",""
"13:48:28.5015555","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS",""
"13:48:28.5015875","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\drivers\NeacSafe64.sys","SUCCESS",""
"13:48:28.5023434","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 90’112, Length: 16’384, Priority: Normal"
"13:48:28.5023527","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 90’112, Length: 16’384, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.5050418","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 180’224, Length: 4’096, Priority: Normal"
"13:48:28.5050503","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 180’224, Length: 4’096, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.5154011","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 122’880, Length: 8’192, Priority: Normal"
"13:48:28.5154100","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 122’880, Length: 8’192, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.5157404","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 131’072, Length: 4’096, Priority: Normal"
"13:48:28.5157490","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 131’072, Length: 4’096, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.5216395","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 151’552, Length: 8’192, Priority: Normal"
"13:48:28.5216482","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 151’552, Length: 8’192, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.5220309","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 159’744, Length: 4’096, Priority: Normal"
"13:48:28.5220402","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 159’744, Length: 4’096, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.5224797","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 118’784, Length: 8’192, Priority: Normal"
"13:48:28.5224958","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 118’784, Length: 4’096, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.5229576","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 135’168, Length: 8’192, Priority: Normal"
"13:48:28.5229661","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 135’168, Length: 8’192, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.5233907","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 196’608, Length: 4’096, Priority: Normal"
"13:48:28.5233984","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 196’608, Length: 4’096, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.5816734","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 147’456, Length: 8’192, Priority: Normal"
"13:48:28.5817915","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 147’456, Length: 4’096, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.5859428","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:28.5859767","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:28.5861841","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\dllhost.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.5862274","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\dllhost.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:28.5862526","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\dllhost.exe","BUFFER OVERFLOW","CreationTime: 06.09.2024 06:02:01, LastAccessTime: 13.10.2025 13:47:55, LastWriteTime: 06.09.2024 06:02:01, ChangeTime: 30.09.2025 17:02:31, FileAttributes: A, AllocationSize: 16’384, EndOfFile: 50’504"
"13:48:28.5862732","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\dllhost.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:28.5862836","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\dllhost.exe","BUFFER OVERFLOW","CreationTime: 06.09.2024 06:02:01, LastAccessTime: 13.10.2025 13:47:55, LastWriteTime: 06.09.2024 06:02:01, ChangeTime: 30.09.2025 17:02:31, FileAttributes: A, AllocationSize: 16’384, EndOfFile: 50’504"
"13:48:28.5863043","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\dllhost.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.5863134","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\dllhost.exe","SUCCESS",""
"13:48:28.5863462","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\dllhost.exe","SUCCESS",""
"13:48:28.5900437","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 143’360, Length: 8’192, Priority: Normal"
"13:48:28.5900552","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 143’360, Length: 4’096, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.5920450","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 176’128, Length: 8’192, Priority: Normal"
"13:48:28.5920547","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 176’128, Length: 4’096, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.5947811","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\dllhost.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.5948617","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\dllhost.exe","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.5948958","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\dllhost.exe","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.5949062","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\dllhost.exe","SUCCESS",""
"13:48:28.5950322","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\ntdll.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.5950735","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ntdll.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.5950857","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ntdll.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.5950943","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\ntdll.dll","SUCCESS",""
"13:48:28.5981343","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 167’936, Length: 8’192, Priority: Normal"
"13:48:28.5981508","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 167’936, Length: 8’192, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.6070772","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\kernel32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.6071160","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.6071286","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.6071369","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\kernel32.dll","SUCCESS",""
"13:48:28.6121278","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\KernelBase.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.6122298","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\KernelBase.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.6122424","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\KernelBase.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.6123531","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\KernelBase.dll","SUCCESS",""
"13:48:28.6129480","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\ucrtbase.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.6129924","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ucrtbase.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.6130017","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ucrtbase.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.6130097","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\ucrtbase.dll","SUCCESS",""
"13:48:28.6132184","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\combase.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.6132582","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\combase.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.6132671","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\combase.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.6132841","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\combase.dll","SUCCESS",""
"13:48:28.6136157","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\rpcrt4.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.6136602","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\rpcrt4.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.6136698","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\rpcrt4.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.6136777","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\rpcrt4.dll","SUCCESS",""
"13:48:28.6189603","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\kernel.appcore.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.6189920","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel.appcore.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.6190007","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel.appcore.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.6190193","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\kernel.appcore.dll","SUCCESS",""
"13:48:28.6193094","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\msvcrt.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.6193913","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcrt.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.6194041","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcrt.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.6194224","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\msvcrt.dll","SUCCESS",""
"13:48:28.6200416","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\bcryptprimitives.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.6200739","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\bcryptprimitives.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.6200819","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\bcryptprimitives.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.6200891","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\bcryptprimitives.dll","SUCCESS",""
"13:48:28.6212853","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\clbcatq.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.6213403","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\clbcatq.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.6213520","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\clbcatq.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.6213599","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\clbcatq.dll","SUCCESS",""
"13:48:28.6218875","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 8’192, Length: 4’096, Priority: Normal"
"13:48:28.6219066","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 8’192, Length: 4’096, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.6245301","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 49’152, Length: 8’192, Priority: Normal"
"13:48:28.6245410","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 49’152, Length: 8’192, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.6250414","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 12’288, Length: 16’384, Priority: Normal"
"13:48:28.6250541","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 12’288, Length: 16’384, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.6256793","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 106’496, Length: 4’096, Priority: Normal"
"13:48:28.6256954","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 106’496, Length: 4’096, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.6300488","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\sechost.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.6300824","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\sechost.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.6300998","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\sechost.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.6301108","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\sechost.dll","SUCCESS",""
"13:48:28.6358922","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\user32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.6359349","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\user32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.6359469","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\user32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.6359549","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\user32.dll","SUCCESS",""
"13:48:28.6363891","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\msvcp_win.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.6364245","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcp_win.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.6364335","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcp_win.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.6364409","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\msvcp_win.dll","SUCCESS",""
"13:48:28.6366093","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\win32u.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.6366539","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\win32u.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.6366632","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\win32u.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.6366716","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\win32u.dll","SUCCESS",""
"13:48:28.6369623","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\gdi32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.6370018","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\gdi32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.6370107","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\gdi32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.6370179","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\gdi32.dll","SUCCESS",""
"13:48:28.6371212","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\gdi32full.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.6371417","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\gdi32full.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.6371494","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\gdi32full.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.6371563","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\gdi32full.dll","SUCCESS",""
"13:48:28.6413040","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\imm32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.6413435","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\imm32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.6413543","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\imm32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.6413623","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\imm32.dll","SUCCESS",""
"13:48:28.6433909","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\uxtheme.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.6434593","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\uxtheme.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.6434799","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\uxtheme.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.6435026","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\uxtheme.dll","SUCCESS",""
"13:48:28.6563799","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\thumbcache.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.6564041","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\thumbcache.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.6564125","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\thumbcache.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.6564202","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\thumbcache.dll","SUCCESS",""
"13:48:28.6566489","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:28.6566744","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:28.6567824","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\thumbcache.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.6568138","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\thumbcache.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᅾ"
"13:48:28.6568215","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\thumbcache.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:26, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 30.09.2025 13:54:26, ChangeTime: 01.10.2025 17:29:42, FileAttributes: A, AllocationSize: 249’856, EndOfFile: 460’176"
"13:48:28.6568301","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\thumbcache.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᅾ"
"13:48:28.6568355","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\thumbcache.dll","BUFFER OVERFLOW","CreationTime: 30.09.2025 13:54:26, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 30.09.2025 13:54:26, ChangeTime: 01.10.2025 17:29:42, FileAttributes: A, AllocationSize: 249’856, EndOfFile: 460’176"
"13:48:28.6568436","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\thumbcache.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.6568586","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\thumbcache.dll","SUCCESS",""
"13:48:28.6568792","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\thumbcache.dll","SUCCESS",""
"13:48:28.6625567","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\propsys.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.6626091","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\propsys.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.6626200","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\propsys.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.6626280","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\propsys.dll","SUCCESS",""
"13:48:28.6659004","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:28.6659286","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:28.6842378","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.6842833","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.6842958","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.6843267","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:28.6844439","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\ntdll.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.6844901","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ntdll.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.6845007","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ntdll.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.6866075","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\ntdll.dll","SUCCESS",""
"13:48:28.6898340","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:28.6898609","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:28.6909623","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.6909946","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:28.6910272","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:28.6910507","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 675’736, Length: 4’096"
"13:48:28.6910773","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:28.6910890","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:28.6995947","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 77’824, Length: 8’192, Priority: Normal"
"13:48:28.6996076","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 77’824, Length: 4’096, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.7001719","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\kernel32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7002146","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.7002287","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.7002369","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\kernel32.dll","SUCCESS",""
"13:48:28.7003416","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\KernelBase.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7003644","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\KernelBase.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.7003721","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\KernelBase.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.7003787","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\KernelBase.dll","SUCCESS",""
"13:48:28.7036676","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\ucrtbase.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7037841","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ucrtbase.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.7038049","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ucrtbase.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.7038133","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\ucrtbase.dll","SUCCESS",""
"13:48:28.7075571","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\msvcp140.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7076064","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcp140.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.7076191","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcp140.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.7076271","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\msvcp140.dll","SUCCESS",""
"13:48:28.7078366","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:28.7078541","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:28.7080516","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\msvcp140.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7080833","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\msvcp140.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:28.7080951","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\msvcp140.dll","BUFFER OVERFLOW","CreationTime: 11.06.2025 05:21:56, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 11.06.2025 05:21:56, ChangeTime: 12.08.2025 21:24:20, FileAttributes: A, AllocationSize: 561’152, EndOfFile: 557’728"
"13:48:28.7081031","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\msvcp140.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:28.7081083","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\msvcp140.dll","BUFFER OVERFLOW","CreationTime: 11.06.2025 05:21:56, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 11.06.2025 05:21:56, ChangeTime: 12.08.2025 21:24:20, FileAttributes: A, AllocationSize: 561’152, EndOfFile: 557’728"
"13:48:28.7081175","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcp140.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.7081348","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\msvcp140.dll","SUCCESS",""
"13:48:28.7081504","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\msvcp140.dll","SUCCESS",""
"13:48:28.7084358","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\vcruntime140.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7084673","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\vcruntime140.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.7084759","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\vcruntime140.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.7084831","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\vcruntime140.dll","SUCCESS",""
"13:48:28.7086279","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:28.7086543","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:28.7089639","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\vcruntime140.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7089869","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\vcruntime140.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:28.7090026","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\vcruntime140.dll","BUFFER OVERFLOW","CreationTime: 11.06.2025 05:21:58, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 11.06.2025 05:21:58, ChangeTime: 12.08.2025 21:04:34, FileAttributes: A, AllocationSize: 126’976, EndOfFile: 124’544"
"13:48:28.7090163","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\vcruntime140.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:28.7090222","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\vcruntime140.dll","BUFFER OVERFLOW","CreationTime: 11.06.2025 05:21:58, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 11.06.2025 05:21:58, ChangeTime: 12.08.2025 21:04:34, FileAttributes: A, AllocationSize: 126’976, EndOfFile: 124’544"
"13:48:28.7090296","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\vcruntime140.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.7090383","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\vcruntime140.dll","SUCCESS",""
"13:48:28.7090514","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\vcruntime140.dll","SUCCESS",""
"13:48:28.7093326","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\vcruntime140_1.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7093662","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\vcruntime140_1.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.7093815","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\vcruntime140_1.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.7093894","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\vcruntime140_1.dll","SUCCESS",""
"13:48:28.7095300","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:28.7095431","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:28.7096549","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\vcruntime140_1.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7097119","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\vcruntime140_1.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:28.7097224","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\vcruntime140_1.dll","BUFFER OVERFLOW","CreationTime: 11.06.2025 05:21:58, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 11.06.2025 05:21:58, ChangeTime: 12.08.2025 21:24:20, FileAttributes: A, AllocationSize: 53’248, EndOfFile: 49’792"
"13:48:28.7097395","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\vcruntime140_1.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:28.7097472","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\vcruntime140_1.dll","BUFFER OVERFLOW","CreationTime: 11.06.2025 05:21:58, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 11.06.2025 05:21:58, ChangeTime: 12.08.2025 21:24:20, FileAttributes: A, AllocationSize: 53’248, EndOfFile: 49’792"
"13:48:28.7097553","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\vcruntime140_1.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.7097652","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\vcruntime140_1.dll","SUCCESS",""
"13:48:28.7097785","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\vcruntime140_1.dll","SUCCESS",""
"13:48:28.7132480","MsMpEng.exe","3220","Thread Create","","SUCCESS","Thread ID: 7424"
"13:48:28.7136831","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7137169","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","SUCCESS","CreationTime: 10.10.2025 15:34:53, LastAccessTime: 13.10.2025 13:27:12, LastWriteTime: 13.10.2025 11:45:59, ChangeTime: 13.10.2025 11:45:59, FileAttributes: A"
"13:48:28.7137235","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","SUCCESS",""
"13:48:28.7137960","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7138149","MsMpEng.exe","3220","CreateFileMapping","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE|PAGE_NOCACHE"
"13:48:28.7139295","MsMpEng.exe","3220","QueryEAFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","SUCCESS",""
"13:48:28.7139676","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","SUCCESS","Offset: 46’080, Length: 12’288, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.7140155","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","SUCCESS","Offset: 153’088, Length: 45’056, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.7146151","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7146334","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A"
"13:48:28.7146598","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:28.7149542","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7149905","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:28.7149994","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:28.7150074","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:28.7150132","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:28.7150305","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.7150408","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:28.7150544","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:28.7151310","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7151659","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:28.7151768","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:28.7151861","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:28.7151914","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:28.7151998","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.7152173","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:28.7152292","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:28.7153061","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7153490","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:28.7153616","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:28.7153696","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winწ"
"13:48:28.7153752","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:28.7153961","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.7154069","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:28.7154236","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:28.7155815","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7156119","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.7156222","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:28.7156390","MsMpEng.exe","3220","QueryStandardInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","SUCCESS","AllocationSize: 241’664, EndOfFile: 240’128, NumberOfLinks: 1, DeletePending: False, Directory: False"
"13:48:28.7156578","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","INVALID DEVICE REQUEST","Control: 0x90390 (Device:0x9 Function:228 Method: 0)"
"13:48:28.7156678","MsMpEng.exe","3220","QueryAttributeInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","SUCCESS","FileSystemAttributes: Case Preserved, Case Sensitive, Unicode, ACLs, Compression, Named Streams, EFS, Object IDs, Reparse Points, Sparse Files, Quotas, Transactions, 0x3c02e00, MaximumComponentNameLength: 255, FileSystemName: NTFS"
"13:48:28.7161664","MsMpEng.exe","3220","QueryEAFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","SUCCESS",""
"13:48:28.7163940","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7164226","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:28.7164830","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:28.7165135","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:28.7165240","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:28.7165336","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.7165420","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:28.7166074","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:28.7193027","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:28.7193162","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:28.7193270","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.7194074","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:28.7194339","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 222’536, Length: 4’096"
"13:48:28.7194587","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 86’576, Length: 4’096"
"13:48:28.7194836","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 700’456, Length: 4’096"
"13:48:28.7195263","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:28.7196113","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 28’672, Length: 350’208, Priority: Normal"
"13:48:28.7196377","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 28’672, Length: 344’064, I/O Flags: Non-cached, Paging I/O, Priority: Normal"
"13:48:28.7205235","MsMpEng.exe","3220","RegOpenKey","HKLM\Software\Microsoft\Windows\CurrentVersion\Setup","SUCCESS","Desired Access: Read"
"13:48:28.7205392","MsMpEng.exe","3220","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\MinimizeFootprint","NAME NOT FOUND","Length: 20"
"13:48:28.7205696","MsMpEng.exe","3220","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup","SUCCESS",""
"13:48:28.7205905","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","INVALID DEVICE REQUEST","Control: 0x90390 (Device:0x9 Function:228 Method: 0)"
"13:48:28.7206014","MsMpEng.exe","3220","QueryAttributeInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","SUCCESS","FileSystemAttributes: Case Preserved, Case Sensitive, Unicode, ACLs, Compression, Named Streams, EFS, Object IDs, Reparse Points, Sparse Files, Quotas, Transactions, 0x3c02e00, MaximumComponentNameLength: 255, FileSystemName: NTFS"
"13:48:28.7212630","MsMpEng.exe","3220","QueryStandardInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","SUCCESS","AllocationSize: 241’664, EndOfFile: 240’128, NumberOfLinks: 1, DeletePending: False, Directory: False"
"13:48:28.7213481","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","INVALID DEVICE REQUEST","Control: 0x90390 (Device:0x9 Function:228 Method: 0)"
"13:48:28.7213990","MsMpEng.exe","3220","QueryAttributeInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","SUCCESS","FileSystemAttributes: Case Preserved, Case Sensitive, Unicode, ACLs, Compression, Named Streams, EFS, Object IDs, Reparse Points, Sparse Files, Quotas, Transactions, 0x3c02e00, MaximumComponentNameLength: 255, FileSystemName: NTFS"
"13:48:28.7218911","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7218980","MsMpEng.exe","3220","QueryEAFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","SUCCESS",""
"13:48:28.7230054","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","INVALID DEVICE REQUEST","Control: 0x90390 (Device:0x9 Function:228 Method: 0)"
"13:48:28.7230162","MsMpEng.exe","3220","QueryAttributeInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","SUCCESS","FileSystemAttributes: Case Preserved, Case Sensitive, Unicode, ACLs, Compression, Named Streams, EFS, Object IDs, Reparse Points, Sparse Files, Quotas, Transactions, 0x3c02e00, MaximumComponentNameLength: 255, FileSystemName: NTFS"
"13:48:28.7238717","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll","SUCCESS",""
"13:48:28.7239752","MsMpEng.exe","3220","Thread Exit","","SUCCESS","Thread ID: 7424, User Time: 0.0000000, Kernel Time: 0.0000000"
"13:48:28.7241532","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7241967","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","CreationTime: 01.04.2024 09:26:07, LastAccessTime: 13.08.2025 20:52:27, LastWriteTime: 01.04.2024 09:26:07, ChangeTime: 12.08.2025 21:35:30, FileAttributes: D"
"13:48:28.7242057","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS",""
"13:48:28.7243988","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7244757","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","CreationTime: 01.04.2024 18:17:28, LastAccessTime: 13.10.2025 13:32:53, LastWriteTime: 12.08.2025 20:38:19, ChangeTime: 12.08.2025 20:38:19, FileAttributes: DNCI"
"13:48:28.7244921","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS",""
"13:48:28.7247909","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7248278","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2\{????????????????????????????????????}","SUCCESS","FileInformationClass: FileBothDirectoryInformation, Filter: {????????????????????????????????????}, 2: {127D0A1D-4EF2-11D1-8608-00C04FC295EE}"
"13:48:28.7250488","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:28.7252960","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7253216","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\CatRoot","SUCCESS","Information: DACL"
"13:48:28.7253306","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot","SUCCESS",""
"13:48:28.7254538","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:28.7258632","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7258887","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\catroot2","SUCCESS","Information: DACL"
"13:48:28.7258979","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:28.7259076","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\kernel.appcore.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7259496","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel.appcore.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.7259638","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel.appcore.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.7259728","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\kernel.appcore.dll","SUCCESS",""
"13:48:28.7260887","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\msvcrt.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7261202","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcrt.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.7261376","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcrt.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.7261461","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\msvcrt.dll","SUCCESS",""
"13:48:28.7266267","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2","SUCCESS","FileInformationClass: FileBothDirectoryInformation, 1: {F750E6C3-38EE-11D1-85E5-00C04FC295EE}"
"13:48:28.7267873","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:28.7268679","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7268898","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\CatRoot","SUCCESS","Information: DACL"
"13:48:28.7268982","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot","SUCCESS",""
"13:48:28.7270382","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:28.7272135","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7272541","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\catroot2","SUCCESS","Information: DACL"
"13:48:28.7272669","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:28.7281850","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2","NO MORE FILES","FileInformationClass: FileBothDirectoryInformation"
"13:48:28.7282154","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:28.7283620","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7283798","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","CreationTime: 01.04.2024 09:26:07, LastAccessTime: 13.08.2025 20:52:27, LastWriteTime: 01.04.2024 09:26:07, ChangeTime: 12.08.2025 21:35:30, FileAttributes: D"
"13:48:28.7283967","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS",""
"13:48:28.7285158","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7285332","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","CreationTime: 01.04.2024 18:17:28, LastAccessTime: 13.10.2025 13:32:53, LastWriteTime: 12.08.2025 20:38:19, ChangeTime: 12.08.2025 20:38:19, FileAttributes: DNCI"
"13:48:28.7285405","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS",""
"13:48:28.7286659","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7287031","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2\{????????????????????????????????????}","SUCCESS","FileInformationClass: FileBothDirectoryInformation, Filter: {????????????????????????????????????}, 2: {127D0A1D-4EF2-11D1-8608-00C04FC295EE}"
"13:48:28.7288092","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:28.7289418","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7289649","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\CatRoot","SUCCESS","Information: DACL"
"13:48:28.7289830","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot","SUCCESS",""
"13:48:28.7290740","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:28.7294544","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7294795","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\catroot2","SUCCESS","Information: DACL"
"13:48:28.7295194","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:28.7297893","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2","SUCCESS","FileInformationClass: FileBothDirectoryInformation, 1: {F750E6C3-38EE-11D1-85E5-00C04FC295EE}"
"13:48:28.7299503","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:28.7300319","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7300500","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\CatRoot","SUCCESS","Information: DACL"
"13:48:28.7300712","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot","SUCCESS",""
"13:48:28.7302044","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:28.7303356","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7303686","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\catroot2","SUCCESS","Information: DACL"
"13:48:28.7303775","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:28.7315119","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2","NO MORE FILES","FileInformationClass: FileBothDirectoryInformation"
"13:48:28.7315303","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:28.7316001","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7317051","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:28.7317283","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 45’376, Length: 4’096"
"13:48:28.7317708","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:28.7318043","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:28.7318144","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 181’336, Length: 4’096"
"13:48:28.7318359","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:28.7318589","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:28.7318657","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: True, Offset: 120, Length: 1, Fail Immediately: True"
"13:48:28.7319331","MsMpEng.exe","3220","WriteFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 856’992, Length: 24"
"13:48:28.7319481","MsMpEng.exe","3220","WriteFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 857’016, Length: 4’096"
"13:48:28.7319793","MsMpEng.exe","3220","WriteFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 861’112, Length: 24"
"13:48:28.7319887","MsMpEng.exe","3220","WriteFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 861’136, Length: 4’096"
"13:48:28.7320071","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 120, Length: 1"
"13:48:28.7320148","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:28.7323135","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7323495","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7351906","MsMpEng.exe","3220","QueryStreamInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7352136","MsMpEng.exe","3220","QueryEAFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","NO EAS ON FILE",""
"13:48:28.7357756","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7357981","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7359235","MsMpEng.exe","3220","RegCloseKey","HKU\.DEFAULT","SUCCESS",""
"13:48:28.7360628","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\drivers\SET9BED.tmp","NAME NOT FOUND","Desired Access: Read Data/List Directory, Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Open For Backup, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:28.7361289","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.7361395","MsMpEng.exe","3220","RegOpenKey","HKLM\SYSTEM\CurrentControlSet\Control\hivelist","REPARSE","Desired Access: Read"
"13:48:28.7361504","MsMpEng.exe","3220","RegOpenKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Desired Access: Read"
"13:48:28.7361645","MsMpEng.exe","3220","RegQueryKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Query: Cached, SubKeys: 0, Values: 35"
"13:48:28.7361817","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Index: 0, Type: REG_SZ"
"13:48:28.7361917","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\MACHINE\HARDWARE","SUCCESS","Type: REG_SZ, Length: 2, Data: "
"13:48:28.7362029","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Index: 1, Type: REG_SZ"
"13:48:28.7362091","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\MACHINE\SOFTWARE","SUCCESS","Type: REG_SZ, Length: 116, Data: \Device\HarddiskVolume4\Windows\System32\config\SOFTWARE"
"13:48:28.7362173","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Index: 2, Type: REG_SZ"
"13:48:28.7362226","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\MACHINE\SYSTEM","SUCCESS","Type: REG_SZ, Length: 112, Data: \Device\HarddiskVolume4\Windows\System32\config\SYSTEM"
"13:48:28.7362296","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Index: 3, Type: REG_SZ"
"13:48:28.7362428","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\MACHINE\BCD00000000","SUCCESS","Type: REG_SZ, Length: 96, Data: \Device\HarddiskVolume2\EFI\Microsoft\Boot\BCD"
"13:48:28.7362550","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Index: 4, Type: REG_SZ"
"13:48:28.7362607","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\.DEFAULT","SUCCESS","Type: REG_SZ, Length: 114, Data: \Device\HarddiskVolume4\Windows\System32\config\DEFAULT"
"13:48:28.7362782","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Index: 5, Type: REG_SZ"
"13:48:28.7362838","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\MACHINE\SECURITY","SUCCESS","Type: REG_SZ, Length: 116, Data: \Device\HarddiskVolume4\Windows\System32\config\SECURITY"
"13:48:28.7362914","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Index: 6, Type: REG_SZ"
"13:48:28.7363063","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\MACHINE\SAM","SUCCESS","Type: REG_SZ, Length: 106, Data: \Device\HarddiskVolume4\Windows\System32\config\SAM"
"13:48:28.7363142","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Index: 7, Type: REG_SZ"
"13:48:28.7363197","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-20","BUFFER OVERFLOW","Length: 144"
"13:48:28.7363437","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-20","SUCCESS","Type: REG_SZ, Length: 150, Data: \Device\HarddiskVolume4\Windows\ServiceProfiles\NetworkService\NTUSER.DAT"
"13:48:28.7363651","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Index: 8, Type: REG_SZ"
"13:48:28.7363736","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-19","BUFFER OVERFLOW","Length: 144"
"13:48:28.7363808","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-19","SUCCESS","Type: REG_SZ, Length: 146, Data: \Device\HarddiskVolume4\Windows\ServiceProfiles\LocalService\NTUSER.DAT"
"13:48:28.7363907","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Index: 9, Type: REG_SZ"
"13:48:28.7363969","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-21-4172013786-3171869251-2938521833-1000","SUCCESS","Type: REG_SZ, Length: 98, Data: \Device\HarddiskVolume4\Users\hacker\NTUSER.DAT"
"13:48:28.7364096","MsMpEng.exe","3220","RegQueryKey","HKU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.7364235","MsMpEng.exe","3220","RegOpenKey","HKCU","SUCCESS","Desired Access: Read"
"13:48:28.7364379","MsMpEng.exe","3220","RegCloseKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS",""
"13:48:28.7364664","MsMpEng.exe","3220","RegQueryKey","HKCU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.7364866","MsMpEng.exe","3220","RegOpenKey","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Desired Access: Read"
"13:48:28.7365361","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData","SUCCESS","Type: REG_EXPAND_SZ, Length: 56, Data: %USERPROFILE%\AppData\Local"
"13:48:28.7365535","MsMpEng.exe","3220","RegCloseKey","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS",""
"13:48:28.7365765","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.7365866","MsMpEng.exe","3220","RegOpenKey","HKLM\SYSTEM\CurrentControlSet\Control\hivelist","REPARSE","Desired Access: Read"
"13:48:28.7365964","MsMpEng.exe","3220","RegOpenKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Desired Access: Read"
"13:48:28.7366071","MsMpEng.exe","3220","RegQueryKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Query: Cached, SubKeys: 0, Values: 35"
"13:48:28.7366182","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Index: 0, Type: REG_SZ"
"13:48:28.7366435","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\MACHINE\HARDWARE","SUCCESS","Type: REG_SZ, Length: 2, Data: "
"13:48:28.7366549","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Index: 1, Type: REG_SZ"
"13:48:28.7366675","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\MACHINE\SOFTWARE","SUCCESS","Type: REG_SZ, Length: 116, Data: \Device\HarddiskVolume4\Windows\System32\config\SOFTWARE"
"13:48:28.7366792","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Index: 2, Type: REG_SZ"
"13:48:28.7366858","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\MACHINE\SYSTEM","SUCCESS","Type: REG_SZ, Length: 112, Data: \Device\HarddiskVolume4\Windows\System32\config\SYSTEM"
"13:48:28.7366926","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Index: 3, Type: REG_SZ"
"13:48:28.7367133","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\MACHINE\BCD00000000","SUCCESS","Type: REG_SZ, Length: 96, Data: \Device\HarddiskVolume2\EFI\Microsoft\Boot\BCD"
"13:48:28.7367285","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Index: 4, Type: REG_SZ"
"13:48:28.7367630","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\.DEFAULT","SUCCESS","Type: REG_SZ, Length: 114, Data: \Device\HarddiskVolume4\Windows\System32\config\DEFAULT"
"13:48:28.7368103","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Index: 5, Type: REG_SZ"
"13:48:28.7368282","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\MACHINE\SECURITY","SUCCESS","Type: REG_SZ, Length: 116, Data: \Device\HarddiskVolume4\Windows\System32\config\SECURITY"
"13:48:28.7368407","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Index: 6, Type: REG_SZ"
"13:48:28.7368468","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\MACHINE\SAM","SUCCESS","Type: REG_SZ, Length: 106, Data: \Device\HarddiskVolume4\Windows\System32\config\SAM"
"13:48:28.7368549","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Index: 7, Type: REG_SZ"
"13:48:28.7368603","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-20","BUFFER OVERFLOW","Length: 144"
"13:48:28.7368747","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-20","SUCCESS","Type: REG_SZ, Length: 150, Data: \Device\HarddiskVolume4\Windows\ServiceProfiles\NetworkService\NTUSER.DAT"
"13:48:28.7368898","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Index: 8, Type: REG_SZ"
"13:48:28.7368959","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-19","BUFFER OVERFLOW","Length: 144"
"13:48:28.7369027","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-19","SUCCESS","Type: REG_SZ, Length: 146, Data: \Device\HarddiskVolume4\Windows\ServiceProfiles\LocalService\NTUSER.DAT"
"13:48:28.7369121","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Index: 9, Type: REG_SZ"
"13:48:28.7369183","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-21-4172013786-3171869251-2938521833-1000","SUCCESS","Type: REG_SZ, Length: 98, Data: \Device\HarddiskVolume4\Users\hacker\NTUSER.DAT"
"13:48:28.7369276","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\hivelist","BUFFER OVERFLOW","Index: 10, Length: 144"
"13:48:28.7369408","MsMpEng.exe","3220","RegEnumValue","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Index: 10, Type: REG_SZ"
"13:48:28.7370464","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-21-4172013786-3171869251-2938521833-1000_Classes","BUFFER OVERFLOW","Length: 144"
"13:48:28.7370642","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-21-4172013786-3171869251-2938521833-1000_Classes","SUCCESS","Type: REG_SZ, Length: 166, Data: \Device\HarddiskVolume4\Users\hacker\AppData\Local\Microsoft\Windows\UsrClass.dat"
"13:48:28.7370973","MsMpEng.exe","3220","RegQueryKey","HKU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.7371065","MsMpEng.exe","3220","RegOpenKey","HKCU\Software\Classes","SUCCESS","Desired Access: Read"
"13:48:28.7371213","MsMpEng.exe","3220","RegCloseKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS",""
"13:48:28.7371423","MsMpEng.exe","3220","RegQueryKey","HKCU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.7371523","MsMpEng.exe","3220","RegOpenKey","HKCU\Environment","SUCCESS","Desired Access: Read"
"13:48:28.7371638","MsMpEng.exe","3220","RegQueryKey","HKCU\Environment","SUCCESS","Query: Cached, SubKeys: 0, Values: 4"
"13:48:28.7371713","MsMpEng.exe","3220","RegEnumValue","HKCU\Environment","SUCCESS","Index: 0, Type: REG_EXPAND_SZ"
"13:48:28.7371785","MsMpEng.exe","3220","RegQueryValue","HKCU\Environment\Path","BUFFER OVERFLOW","Length: 144"
"13:48:28.7371873","MsMpEng.exe","3220","RegQueryValue","HKCU\Environment\Path","SUCCESS","Type: REG_EXPAND_SZ, Length: 156, Data: "
"13:48:28.7372078","MsMpEng.exe","3220","RegEnumValue","HKCU\Environment","SUCCESS","Index: 1, Type: REG_EXPAND_SZ"
"13:48:28.7372155","MsMpEng.exe","3220","RegQueryValue","HKCU\Environment\TEMP","SUCCESS","Type: REG_EXPAND_SZ, Length: 66, Data: %USERPROFILE%\AppData\Local\Temp"
"13:48:28.7372286","MsMpEng.exe","3220","RegEnumValue","HKCU\Environment","SUCCESS","Index: 2, Type: REG_EXPAND_SZ"
"13:48:28.7372340","MsMpEng.exe","3220","RegQueryValue","HKCU\Environment\TMP","SUCCESS","Type: REG_EXPAND_SZ, Length: 66, Data: %USERPROFILE%\AppData\Local\Temp"
"13:48:28.7372429","MsMpEng.exe","3220","RegEnumValue","HKCU\Environment","SUCCESS","Index: 3, Type: REG_EXPAND_SZ"
"13:48:28.7372484","MsMpEng.exe","3220","RegQueryValue","HKCU\Environment\OneDrive","SUCCESS","Type: REG_EXPAND_SZ, Length: 50, Data: C:\Users\hacker\OneDrive"
"13:48:28.7372658","MsMpEng.exe","3220","RegCloseKey","HKCU\Environment","SUCCESS",""
"13:48:28.7372761","MsMpEng.exe","3220","RegQueryKey","HKCU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.7372831","MsMpEng.exe","3220","RegOpenKey","HKCU\Volatile Environment","SUCCESS","Desired Access: Read"
"13:48:28.7372942","MsMpEng.exe","3220","RegQueryKey","HKCU\Volatile Environment","SUCCESS","Query: Cached, SubKeys: 1, Values: 9"
"13:48:28.7373007","MsMpEng.exe","3220","RegEnumValue","HKCU\Volatile Environment","SUCCESS","Index: 0, Type: REG_SZ"
"13:48:28.7373073","MsMpEng.exe","3220","RegQueryValue","HKCU\Volatile Environment\LOGONSERVER","SUCCESS","Type: REG_SZ, Length: 24, Data: \\WINDOWS11"
"13:48:28.7373233","MsMpEng.exe","3220","RegEnumValue","HKCU\Volatile Environment","SUCCESS","Index: 1, Type: REG_SZ"
"13:48:28.7373304","MsMpEng.exe","3220","RegQueryValue","HKCU\Volatile Environment\USERDOMAIN","SUCCESS","Type: REG_SZ, Length: 20, Data: WINDOWS11"
"13:48:28.7373403","MsMpEng.exe","3220","RegEnumValue","HKCU\Volatile Environment","SUCCESS","Index: 2, Type: REG_SZ"
"13:48:28.7373459","MsMpEng.exe","3220","RegQueryValue","HKCU\Volatile Environment\USERNAME","SUCCESS","Type: REG_SZ, Length: 14, Data: hacker"
"13:48:28.7373543","MsMpEng.exe","3220","RegEnumValue","HKCU\Volatile Environment","SUCCESS","Index: 3, Type: REG_SZ"
"13:48:28.7373596","MsMpEng.exe","3220","RegQueryValue","HKCU\Volatile Environment\USERPROFILE","SUCCESS","Type: REG_SZ, Length: 32, Data: C:\Users\hacker"
"13:48:28.7373675","MsMpEng.exe","3220","RegEnumValue","HKCU\Volatile Environment","SUCCESS","Index: 4, Type: REG_SZ"
"13:48:28.7373729","MsMpEng.exe","3220","RegQueryValue","HKCU\Volatile Environment\HOMEPATH","SUCCESS","Type: REG_SZ, Length: 28, Data: \Users\hacker"
"13:48:28.7373876","MsMpEng.exe","3220","RegEnumValue","HKCU\Volatile Environment","SUCCESS","Index: 5, Type: REG_SZ"
"13:48:28.7373954","MsMpEng.exe","3220","RegQueryValue","HKCU\Volatile Environment\HOMEDRIVE","SUCCESS","Type: REG_SZ, Length: 6, Data: C:"
"13:48:28.7374048","MsMpEng.exe","3220","RegEnumValue","HKCU\Volatile Environment","SUCCESS","Index: 6, Type: REG_SZ"
"13:48:28.7374602","MsMpEng.exe","3220","RegQueryValue","HKCU\Volatile Environment\APPDATA","SUCCESS","Type: REG_SZ, Length: 64, Data: C:\Users\hacker\AppData\Roaming"
"13:48:28.7374867","MsMpEng.exe","3220","RegEnumValue","HKCU\Volatile Environment","SUCCESS","Index: 7, Type: REG_SZ"
"13:48:28.7374960","MsMpEng.exe","3220","RegQueryValue","HKCU\Volatile Environment\LOCALAPPDATA","SUCCESS","Type: REG_SZ, Length: 60, Data: C:\Users\hacker\AppData\Local"
"13:48:28.7375067","MsMpEng.exe","3220","RegEnumValue","HKCU\Volatile Environment","SUCCESS","Index: 8, Type: REG_SZ"
"13:48:28.7375128","MsMpEng.exe","3220","RegQueryValue","HKCU\Volatile Environment\USERDOMAIN_ROAMINGPROFILE","SUCCESS","Type: REG_SZ, Length: 20, Data: WINDOWS11"
"13:48:28.7375255","MsMpEng.exe","3220","RegCloseKey","HKCU\Volatile Environment","SUCCESS",""
"13:48:28.7375356","MsMpEng.exe","3220","RegQueryKey","HKCU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.7375514","MsMpEng.exe","3220","RegOpenKey","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Desired Access: Read"
"13:48:28.7375801","MsMpEng.exe","3220","RegQueryKey","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Query: Cached, SubKeys: 0, Values: 31"
"13:48:28.7375873","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 0, Type: REG_SZ"
"13:48:28.7375941","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\!Do not use this registry key","SUCCESS","Type: REG_SZ, Length: 130, Data: Use the SHGetFolderPath or SHGetKnownFolderPath function instead"
"13:48:28.7376117","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 1, Type: REG_SZ"
"13:48:28.7376185","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData","SUCCESS","Type: REG_SZ, Length: 64, Data: C:\Users\hacker\AppData\Roaming"
"13:48:28.7376286","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 2, Type: REG_SZ"
"13:48:28.7376346","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Local AppData","SUCCESS","Type: REG_SZ, Length: 60, Data: C:\Users\hacker\AppData\Local"
"13:48:28.7376426","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 3, Type: REG_SZ"
"13:48:28.7376482","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\CD Burning","SUCCESS","Type: REG_SZ, Length: 116, Data: C:\Users\hacker\AppData\Local\Microsoft\Windows\Burn\Burn"
"13:48:28.7376562","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 4, Type: REG_SZ"
"13:48:28.7376682","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}","SUCCESS","Type: REG_SZ, Length: 120, Data: C:\Users\hacker\AppData\Roaming\Microsoft\Windows\Libraries"
"13:48:28.7376787","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 5, Type: REG_SZ"
"13:48:28.7376842","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\My Video","SUCCESS","Type: REG_SZ, Length: 46, Data: C:\Users\hacker\Videos"
"13:48:28.7376922","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 6, Type: REG_SZ"
"13:48:28.7376975","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\My Pictures","SUCCESS","Type: REG_SZ, Length: 50, Data: C:\Users\hacker\Pictures"
"13:48:28.7377062","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 7, Type: REG_SZ"
"13:48:28.7377114","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Desktop","SUCCESS","Type: REG_SZ, Length: 48, Data: C:\Users\hacker\Desktop"
"13:48:28.7377189","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 8, Type: REG_SZ"
"13:48:28.7377296","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\History","SUCCESS","Type: REG_SZ, Length: 112, Data: C:\Users\hacker\AppData\Local\Microsoft\Windows\History"
"13:48:28.7377399","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 9, Type: REG_SZ"
"13:48:28.7377453","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\NetHood","BUFFER OVERFLOW","Length: 144"
"13:48:28.7377519","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\NetHood","SUCCESS","Type: REG_SZ, Length: 136, Data: C:\Users\hacker\AppData\Roaming\Microsoft\Windows\Network Shortcuts"
"13:48:28.7377597","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 10, Type: REG_SZ"
"13:48:28.7377654","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\{56784854-C6CB-462B-8169-88E350ACB882}","SUCCESS","Type: REG_SZ, Length: 50, Data: C:\Users\hacker\Contacts"
"13:48:28.7377739","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 11, Type: REG_SZ"
"13:48:28.7377795","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\{00BCFC5A-ED94-4E48-96A1-3F6217F21990}","SUCCESS","Type: REG_SZ, Length: 122, Data: C:\Users\hacker\AppData\Local\Microsoft\Windows\RoamingTiles"
"13:48:28.7377938","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 12, Type: REG_SZ"
"13:48:28.7378002","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies","SUCCESS","Type: REG_SZ, Length: 120, Data: C:\Users\hacker\AppData\Local\Microsoft\Windows\INetCookies"
"13:48:28.7378085","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 13, Type: REG_SZ"
"13:48:28.7378138","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Favorites","SUCCESS","Type: REG_SZ, Length: 52, Data: C:\Users\hacker\Favorites"
"13:48:28.7378216","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 14, Type: REG_SZ"
"13:48:28.7378268","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\SendTo","SUCCESS","Type: REG_SZ, Length: 114, Data: C:\Users\hacker\AppData\Roaming\Microsoft\Windows\SendTo"
"13:48:28.7378341","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 15, Type: REG_SZ"
"13:48:28.7378394","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Start Menu","SUCCESS","Type: REG_SZ, Length: 122, Data: C:\Users\hacker\AppData\Roaming\Microsoft\Windows\Start Menu"
"13:48:28.7378543","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 16, Type: REG_SZ"
"13:48:28.7378605","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\My Music","SUCCESS","Type: REG_SZ, Length: 44, Data: C:\Users\hacker\Music"
"13:48:28.7378687","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 17, Type: REG_SZ"
"13:48:28.7378739","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Programs","BUFFER OVERFLOW","Length: 144"
"13:48:28.7378805","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Programs","SUCCESS","Type: REG_SZ, Length: 140, Data: C:\Users\hacker\AppData\Roaming\Microsoft\Windows\Start Menu\Programs"
"13:48:28.7378882","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 18, Type: REG_SZ"
"13:48:28.7378936","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Recent","SUCCESS","Type: REG_SZ, Length: 114, Data: C:\Users\hacker\AppData\Roaming\Microsoft\Windows\Recent"
"13:48:28.7379012","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 19, Type: REG_SZ"
"13:48:28.7379117","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\PrintHood","BUFFER OVERFLOW","Length: 144"
"13:48:28.7379201","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\PrintHood","SUCCESS","Type: REG_SZ, Length: 136, Data: C:\Users\hacker\AppData\Roaming\Microsoft\Windows\Printer Shortcuts"
"13:48:28.7379285","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 20, Type: REG_SZ"
"13:48:28.7379342","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}","SUCCESS","Type: REG_SZ, Length: 50, Data: C:\Users\hacker\Searches"
"13:48:28.7379433","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 21, Type: REG_SZ"
"13:48:28.7379487","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\{374DE290-123F-4565-9164-39C4925E467B}","SUCCESS","Type: REG_SZ, Length: 52, Data: C:\Users\hacker\Downloads"
"13:48:28.7379572","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 22, Type: REG_SZ"
"13:48:28.7379625","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\{A520A1A4-1780-4FF6-BD18-167343C5AF16}","SUCCESS","Type: REG_SZ, Length: 66, Data: C:\Users\hacker\AppData\LocalLow"
"13:48:28.7379771","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 23, Type: REG_SZ"
"13:48:28.7379832","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Startup","BUFFER OVERFLOW","Length: 144"
"13:48:28.7379912","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Startup","SUCCESS","Type: REG_SZ, Length: 156, Data: C:\Users\hacker\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
"13:48:28.7379995","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 24, Type: REG_SZ"
"13:48:28.7380049","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Administrative Tools","BUFFER OVERFLOW","Length: 144"
"13:48:28.7380114","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Administrative Tools","SUCCESS","Type: REG_SZ, Length: 182, Data: C:\Users\hacker\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools"
"13:48:28.7380196","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 25, Type: REG_SZ"
"13:48:28.7380250","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Personal","SUCCESS","Type: REG_SZ, Length: 52, Data: C:\Users\hacker\Documents"
"13:48:28.7380396","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 26, Type: REG_SZ"
"13:48:28.7380457","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}","SUCCESS","Type: REG_SZ, Length: 44, Data: C:\Users\hacker\Links"
"13:48:28.7380544","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 27, Type: REG_SZ"
"13:48:28.7380596","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache","SUCCESS","Type: REG_SZ, Length: 116, Data: C:\Users\hacker\AppData\Local\Microsoft\Windows\INetCache"
"13:48:28.7380692","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 28, Type: REG_SZ"
"13:48:28.7380745","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Templates","SUCCESS","Type: REG_SZ, Length: 120, Data: C:\Users\hacker\AppData\Roaming\Microsoft\Windows\Templates"
"13:48:28.7380821","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 29, Type: REG_SZ"
"13:48:28.7380931","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}","SUCCESS","Type: REG_SZ, Length: 56, Data: C:\Users\hacker\Saved Games"
"13:48:28.7381039","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS","Index: 30, Type: REG_SZ"
"13:48:28.7381096","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Fonts","SUCCESS","Type: REG_SZ, Length: 34, Data: C:\WINDOWS\Fonts"
"13:48:28.7381198","MsMpEng.exe","3220","RegCloseKey","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","SUCCESS",""
"13:48:28.7381281","MsMpEng.exe","3220","RegQueryKey","HKCU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.7381357","MsMpEng.exe","3220","RegOpenKey","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Desired Access: Read"
"13:48:28.7381460","MsMpEng.exe","3220","RegQueryKey","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Query: Cached, SubKeys: 0, Values: 20"
"13:48:28.7381591","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 0, Type: REG_EXPAND_SZ"
"13:48:28.7381665","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData","SUCCESS","Type: REG_EXPAND_SZ, Length: 60, Data: %USERPROFILE%\AppData\Roaming"
"13:48:28.7381763","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 1, Type: REG_EXPAND_SZ"
"13:48:28.7381819","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Cache","SUCCESS","Type: REG_EXPAND_SZ, Length: 112, Data: %USERPROFILE%\AppData\Local\Microsoft\Windows\INetCache"
"13:48:28.7382524","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 2, Type: REG_EXPAND_SZ"
"13:48:28.7382629","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Cookies","SUCCESS","Type: REG_EXPAND_SZ, Length: 116, Data: %USERPROFILE%\AppData\Local\Microsoft\Windows\INetCookies"
"13:48:28.7382839","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 3, Type: REG_EXPAND_SZ"
"13:48:28.7382909","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Desktop","SUCCESS","Type: REG_EXPAND_SZ, Length: 44, Data: %USERPROFILE%\Desktop"
"13:48:28.7383003","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 4, Type: REG_EXPAND_SZ"
"13:48:28.7383057","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Favorites","SUCCESS","Type: REG_EXPAND_SZ, Length: 48, Data: %USERPROFILE%\Favorites"
"13:48:28.7383137","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 5, Type: REG_EXPAND_SZ"
"13:48:28.7383190","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\History","SUCCESS","Type: REG_EXPAND_SZ, Length: 108, Data: %USERPROFILE%\AppData\Local\Microsoft\Windows\History"
"13:48:28.7383272","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 6, Type: REG_EXPAND_SZ"
"13:48:28.7383395","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData","SUCCESS","Type: REG_EXPAND_SZ, Length: 56, Data: %USERPROFILE%\AppData\Local"
"13:48:28.7383514","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 7, Type: REG_EXPAND_SZ"
"13:48:28.7383579","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\My Music","SUCCESS","Type: REG_EXPAND_SZ, Length: 40, Data: %USERPROFILE%\Music"
"13:48:28.7383658","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 8, Type: REG_EXPAND_SZ"
"13:48:28.7383712","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\My Pictures","SUCCESS","Type: REG_EXPAND_SZ, Length: 46, Data: %USERPROFILE%\Pictures"
"13:48:28.7383789","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 9, Type: REG_EXPAND_SZ"
"13:48:28.7383841","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\My Video","SUCCESS","Type: REG_EXPAND_SZ, Length: 42, Data: %USERPROFILE%\Videos"
"13:48:28.7384017","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 10, Type: REG_EXPAND_SZ"
"13:48:28.7384099","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\NetHood","SUCCESS","Type: REG_EXPAND_SZ, Length: 132, Data: %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Network Shortcuts"
"13:48:28.7384197","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 11, Type: REG_EXPAND_SZ"
"13:48:28.7384259","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Personal","SUCCESS","Type: REG_EXPAND_SZ, Length: 48, Data: %USERPROFILE%\Documents"
"13:48:28.7384359","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 12, Type: REG_EXPAND_SZ"
"13:48:28.7384416","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\PrintHood","SUCCESS","Type: REG_EXPAND_SZ, Length: 132, Data: %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Printer Shortcuts"
"13:48:28.7384642","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 13, Type: REG_EXPAND_SZ"
"13:48:28.7384819","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Programs","BUFFER OVERFLOW","Length: 144"
"13:48:28.7384906","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Programs","SUCCESS","Type: REG_EXPAND_SZ, Length: 136, Data: %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs"
"13:48:28.7384996","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 14, Type: REG_EXPAND_SZ"
"13:48:28.7385051","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Recent","SUCCESS","Type: REG_EXPAND_SZ, Length: 110, Data: %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent"
"13:48:28.7385153","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 15, Type: REG_EXPAND_SZ"
"13:48:28.7385290","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\SendTo","SUCCESS","Type: REG_EXPAND_SZ, Length: 110, Data: %USERPROFILE%\AppData\Roaming\Microsoft\Windows\SendTo"
"13:48:28.7385503","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 16, Type: REG_EXPAND_SZ"
"13:48:28.7385676","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Start Menu","SUCCESS","Type: REG_EXPAND_SZ, Length: 118, Data: %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu"
"13:48:28.7385903","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 17, Type: REG_EXPAND_SZ"
"13:48:28.7385996","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup","BUFFER OVERFLOW","Length: 144"
"13:48:28.7386083","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup","SUCCESS","Type: REG_EXPAND_SZ, Length: 152, Data: %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
"13:48:28.7386167","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 18, Type: REG_EXPAND_SZ"
"13:48:28.7386223","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Templates","SUCCESS","Type: REG_EXPAND_SZ, Length: 116, Data: %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Templates"
"13:48:28.7386305","MsMpEng.exe","3220","RegEnumValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS","Index: 19, Type: REG_EXPAND_SZ"
"13:48:28.7386527","MsMpEng.exe","3220","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{374DE290-123F-4565-9164-39C4925E467B}","SUCCESS","Type: REG_EXPAND_SZ, Length: 48, Data: %USERPROFILE%\Downloads"
"13:48:28.7386664","MsMpEng.exe","3220","RegCloseKey","HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders","SUCCESS",""
"13:48:28.7386807","MsMpEng.exe","3220","RegCloseKey","HKCU","SUCCESS",""
"13:48:28.7387061","MsMpEng.exe","3220","RegCloseKey","HKCU\Software\Classes","SUCCESS",""
"13:48:28.7387344","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.7387561","MsMpEng.exe","3220","RegOpenKey","HKLM\SYSTEM\CurrentControlSet\Control\hivelist","REPARSE","Desired Access: Read"
"13:48:28.7387762","MsMpEng.exe","3220","RegOpenKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Desired Access: Read"
"13:48:28.7387889","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-21-4172013786-3171869251-2938521833-1000","SUCCESS","Type: REG_SZ, Length: 98, Data: \Device\HarddiskVolume4\Users\hacker\NTUSER.DAT"
"13:48:28.7388415","MsMpEng.exe","3220","RegQueryKey","HKU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.7388895","MsMpEng.exe","3220","RegOpenKey","HKCU","SUCCESS","Desired Access: Read"
"13:48:28.7389065","MsMpEng.exe","3220","RegCloseKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS",""
"13:48:28.7389145","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.7389211","MsMpEng.exe","3220","RegOpenKey","HKLM\SYSTEM\CurrentControlSet\Control\hivelist","REPARSE","Desired Access: Read"
"13:48:28.7389293","MsMpEng.exe","3220","RegOpenKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Desired Access: Read"
"13:48:28.7389381","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-21-4172013786-3171869251-2938521833-1000_Classes","BUFFER OVERFLOW","Length: 144"
"13:48:28.7389843","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-21-4172013786-3171869251-2938521833-1000_Classes","SUCCESS","Type: REG_SZ, Length: 166, Data: \Device\HarddiskVolume4\Users\hacker\AppData\Local\Microsoft\Windows\UsrClass.dat"
"13:48:28.7390375","MsMpEng.exe","3220","RegQueryKey","HKU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.7390918","MsMpEng.exe","3220","RegOpenKey","HKCU\Software\Classes","SUCCESS","Desired Access: Read"
"13:48:28.7391128","MsMpEng.exe","3220","RegCloseKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS",""
"13:48:28.7393535","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Open For Backup, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7393842","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.7394502","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7394850","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A"
"13:48:28.7394935","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 0, Length: 512, Priority: Normal"
"13:48:28.7395081","MsMpEng.exe","3220","QueryStandardInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","AllocationSize: 380’928, EndOfFile: 378’880, NumberOfLinks: 1, DeletePending: False, Directory: False"
"13:48:28.7395335","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 0, Length: 64, Priority: Normal"
"13:48:28.7395904","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 272, Length: 28, Priority: Normal"
"13:48:28.7396358","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 0, Length: 4’096, Priority: Normal"
"13:48:28.7397768","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7398065","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7399169","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7399524","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7400261","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7400669","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.7400735","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7401629","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","NOT A DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.7402399","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.7403014","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7403201","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.7403289","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS",""
"13:48:28.7404410","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7404587","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS",""
"13:48:28.7406256","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7406784","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.7406900","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS",""
"13:48:28.7407828","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7408331","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.7408465","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS",""
"13:48:28.7409301","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.7410086","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7411956","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.7412144","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS",""
"13:48:28.7413168","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7413549","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS",""
"13:48:28.7414419","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7414673","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.7414760","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS",""
"13:48:28.7415551","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7416005","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.7416211","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS",""
"13:48:28.7417197","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.7417880","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7418063","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.7418250","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:28.7418960","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7419122","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:28.7419790","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7420146","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.7420344","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:28.7421119","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7421403","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.7421495","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:28.7422778","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.7423534","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7423819","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.7423912","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:28.7424634","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7424789","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:28.7425914","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7426246","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.7426316","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:28.7427065","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7427267","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.7427491","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:28.7428650","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.7431174","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7431884","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.7432054","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:28.7432834","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7433079","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:28.7434197","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7434633","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.7434707","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:28.7435491","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7435834","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.7435928","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:28.7436667","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.7437296","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7437566","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.7437655","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:28.7438820","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7439112","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:28.7439786","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7440009","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.7440072","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:28.7441213","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7441415","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.7441503","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:28.7442189","MsMpEng.exe","3220","CreateFile","C:\Users","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.7442821","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7443100","MsMpEng.exe","3220","FileSystemControl","C:\Users","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.7443190","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:28.7443851","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7444010","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:28.7444651","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7444979","MsMpEng.exe","3220","DeviceIoControl","C:\Users","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.7445042","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:28.7445867","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7446136","MsMpEng.exe","3220","FileSystemControl","C:\Users","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.7446228","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:28.7446965","MsMpEng.exe","3220","CreateFile","C:\","SUCCESS","Desired Access: Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7447232","MsMpEng.exe","3220","QueryNameInformationFile","C:\","SUCCESS","Name: \"
"13:48:28.7447412","MsMpEng.exe","3220","QueryAttributeInformationVolume","C:\","SUCCESS","FileSystemAttributes: Case Preserved, Case Sensitive, Unicode, ACLs, Compression, Named Streams, EFS, Object IDs, Reparse Points, Sparse Files, Quotas, Transactions, 0x3c02e00, MaximumComponentNameLength: 255, FileSystemName: NTFS"
"13:48:28.7447503","MsMpEng.exe","3220","CloseFile","C:\","SUCCESS",""
"13:48:28.7448286","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7448610","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7449587","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7449876","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7450919","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7451194","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7451909","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7452145","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.7452207","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7452865","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","NOT A DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.7455915","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.7457070","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7457267","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.7457357","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS",""
"13:48:28.7458159","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7458344","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS",""
"13:48:28.7459025","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7459539","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.7459874","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS",""
"13:48:28.7460974","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7461214","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.7461298","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS",""
"13:48:28.7462148","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.7462754","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7463001","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.7463091","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS",""
"13:48:28.7463756","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7463986","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS",""
"13:48:28.7464606","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7464834","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.7464895","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS",""
"13:48:28.7465545","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7465893","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.7465975","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS",""
"13:48:28.7466621","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.7467212","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7467361","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.7467436","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:28.7468348","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7468582","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:28.7469527","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7469822","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.7469907","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:28.7473531","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7473887","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.7474173","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:28.7475161","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.7475951","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7476136","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.7476230","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:28.7476888","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7477161","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:28.7478065","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7479147","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.7479226","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:28.7480143","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7480356","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.7480442","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:28.7481137","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.7481771","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7482053","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.7482138","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:28.7482801","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7482961","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:28.7484759","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7485050","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.7485120","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:28.7486166","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7486382","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.7486567","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:28.7487301","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.7487954","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7488132","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.7488219","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:28.7488854","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7491222","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:28.7492076","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7492327","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.7492391","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:28.7493034","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7493268","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.7493377","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:28.7496489","MsMpEng.exe","3220","CreateFile","C:\Users","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.7497192","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7497489","MsMpEng.exe","3220","FileSystemControl","C:\Users","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.7497581","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:28.7498255","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7498500","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:28.7499186","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7499437","MsMpEng.exe","3220","DeviceIoControl","C:\Users","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.7499503","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:28.7500475","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7500661","MsMpEng.exe","3220","FileSystemControl","C:\Users","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.7500749","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:28.7501453","MsMpEng.exe","3220","CreateFile","C:\","SUCCESS","Desired Access: Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Free Space Query, Attributes: n/a, ShareMode: None, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7501729","MsMpEng.exe","3220","QuerySizeInformationVolume","C:\","SUCCESS","TotalAllocationUnits: 20’646’655, AvailableAllocationUnits: 5’331’773, SectorsPerAllocationUnit: 8, BytesPerSector: 512"
"13:48:28.7501804","MsMpEng.exe","3220","CloseFile","C:\","SUCCESS",""
"13:48:28.7502491","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7502770","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7503784","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: True, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:28.7503877","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:28.7504024","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:28.7504179","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 82’456, Length: 4’096"
"13:48:28.7504428","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:28.7506266","MsMpEng.exe","3220","CreateFile","C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\4F992D724B6D33EA543475A51B3D00E9","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:28.7506805","MsMpEng.exe","3220","RegCloseKey","HKCU","SUCCESS",""
"13:48:28.7507667","MsMpEng.exe","3220","RegCloseKey","HKCU\Software\Classes","SUCCESS",""
"13:48:28.7511378","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7511747","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:28.7511923","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:28.7512035","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:28.7512088","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:28.7512164","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.7512261","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7512435","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7513327","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7513516","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:28.7513829","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:28.7513945","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:28.7513998","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:28.7514115","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.7514198","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7514434","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7515235","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7515468","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: WinÄ"
"13:48:28.7515724","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:28.7515815","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winწ"
"13:48:28.7515869","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:28.7515937","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.7516014","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7516203","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7517666","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7517917","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.7518120","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7520298","MsMpEng.exe","3220","RegQueryKey","HKU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.7520408","MsMpEng.exe","3220","RegOpenKey","HKU\S-1-5-18","REPARSE","Desired Access: Read"
"13:48:28.7520507","MsMpEng.exe","3220","RegOpenKey","HKU\.DEFAULT","SUCCESS","Desired Access: Read"
"13:48:28.7520730","MsMpEng.exe","3220","RegCloseKey","HKU\.DEFAULT","SUCCESS",""
"13:48:28.7520835","MsMpEng.exe","3220","RegQueryKey","HKU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.7520898","MsMpEng.exe","3220","RegOpenKey","HKU\S-1-5-18","REPARSE","Desired Access: Read"
"13:48:28.7520973","MsMpEng.exe","3220","RegOpenKey","HKU\.DEFAULT","SUCCESS","Desired Access: Read"
"13:48:28.7522784","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7522935","MsMpEng.exe","3220","QueryNetworkOpenInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, AllocationSize: 01.01.1601 02:00:00, EndOfFile: 01.01.1601 02:00:00, FileAttributes: A"
"13:48:28.7522999","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7525831","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7526318","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:28.7526524","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:28.7526619","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:28.7526674","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:28.7526749","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.7526840","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7527038","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7527926","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7528107","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Win(돭噷ᦅ"
"13:48:28.7528412","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:28.7528523","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Win譖ᐢ㰵"
"13:48:28.7528583","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:28.7528657","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.7528894","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7529058","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7529833","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7530007","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:28.7530764","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:28.7530870","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Win"
"13:48:28.7530926","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:28.7530999","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.7531080","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7531201","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7532132","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7532314","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.7532402","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7533782","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7533949","MsMpEng.exe","3220","QueryNetworkOpenInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, AllocationSize: 01.01.1601 02:00:00, EndOfFile: 01.01.1601 02:00:00, FileAttributes: A"
"13:48:28.7534011","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.7535848","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Open For Backup, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7536109","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.7536825","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.7537077","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A"
"13:48:28.7537137","MsMpEng.exe","3220","QueryStandardInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","AllocationSize: 380’928, EndOfFile: 378’880, NumberOfLinks: 1, DeletePending: False, Directory: False"
"13:48:28.7539135","MsMpEng.exe","3220","CreateFile","C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\4F992D724B6D33EA543475A51B3D00E9","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:28.7539514","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 0, Length: 4’096, Priority: Normal"
"13:48:28.7542573","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 372’736, Length: 6’144, Priority: Normal"
"13:48:28.7542599","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:28.7542866","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:28.7608054","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 270’336, Length: 4’096, Priority: Normal"
"13:48:28.7608648","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 274’432, Length: 4’096, Priority: Normal"
"13:48:28.7609497","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 81’920, Length: 4’096, Priority: Normal"
"13:48:28.7622318","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 299’008, Length: 4’096, Priority: Normal"
"13:48:28.7623118","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 266’240, Length: 8’192, Priority: Normal"
"13:48:28.7623358","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 184’320, Length: 8’192, Priority: Normal"
"13:48:28.7626149","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 86’016, Length: 4’096, Priority: Normal"
"13:48:28.7626448","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 258’048, Length: 8’192, Priority: Normal"
"13:48:28.7639483","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 4’096, Length: 4’096, Priority: Normal"
"13:48:28.7640578","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 192’512, Length: 4’096, Priority: Normal"
"13:48:28.7640962","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 278’528, Length: 4’096, Priority: Normal"
"13:48:28.7641225","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 282’624, Length: 4’096, Priority: Normal"
"13:48:28.7643172","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 303’104, Length: 4’096, Priority: Normal"
"13:48:28.7643524","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 307’200, Length: 8’192, Priority: Normal"
"13:48:28.7661203","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 286’720, Length: 12’288, Priority: Normal"
"13:48:28.7661950","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 90’112, Length: 16’384, Priority: Normal"
"13:48:28.7668461","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 180’224, Length: 4’096, Priority: Normal"
"13:48:28.7673193","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 122’880, Length: 8’192, Priority: Normal"
"13:48:28.7673553","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 131’072, Length: 4’096, Priority: Normal"
"13:48:28.7673801","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 151’552, Length: 8’192, Priority: Normal"
"13:48:28.7674216","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 159’744, Length: 4’096, Priority: Normal"
"13:48:28.7675363","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 118’784, Length: 8’192, Priority: Normal"
"13:48:28.7678037","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 135’168, Length: 8’192, Priority: Normal"
"13:48:28.7679884","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 196’608, Length: 4’096, Priority: Normal"
"13:48:28.7701537","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 147’456, Length: 8’192, Priority: Normal"
"13:48:28.7702776","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 143’360, Length: 8’192, Priority: Normal"
"13:48:28.7708886","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 176’128, Length: 8’192, Priority: Normal"
"13:48:28.7712423","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 167’936, Length: 8’192, Priority: Normal"
"13:48:28.7751833","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 8’192, Length: 4’096, Priority: Normal"
"13:48:28.7757414","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 49’152, Length: 8’192, Priority: Normal"
"13:48:28.7758013","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 12’288, Length: 16’384, Priority: Normal"
"13:48:28.7759441","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 106’496, Length: 4’096, Priority: Normal"
"13:48:28.7947009","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 77’824, Length: 8’192, Priority: Normal"
"13:48:28.8019678","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winწ"
"13:48:28.8019824","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","BUFFER OVERFLOW","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880"
"13:48:28.8019944","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:28.8021145","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 28’672, Length: 350’208, Priority: Normal"
"13:48:28.8033241","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8050546","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8050728","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","CreationTime: 01.04.2024 09:26:07, LastAccessTime: 13.08.2025 20:52:27, LastWriteTime: 01.04.2024 09:26:07, ChangeTime: 12.08.2025 21:35:30, FileAttributes: D"
"13:48:28.8050875","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS",""
"13:48:28.8052086","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8052287","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","CreationTime: 01.04.2024 18:17:28, LastAccessTime: 13.10.2025 13:32:53, LastWriteTime: 12.08.2025 20:38:19, ChangeTime: 12.08.2025 20:38:19, FileAttributes: DNCI"
"13:48:28.8052352","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS",""
"13:48:28.8053105","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8053479","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2\{????????????????????????????????????}","SUCCESS","FileInformationClass: FileBothDirectoryInformation, Filter: {????????????????????????????????????}, 2: {127D0A1D-4EF2-11D1-8608-00C04FC295EE}"
"13:48:28.8054288","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:28.8055297","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8055501","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\CatRoot","SUCCESS","Information: DACL"
"13:48:28.8055668","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot","SUCCESS",""
"13:48:28.8057002","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:28.8057993","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8058226","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\catroot2","SUCCESS","Information: DACL"
"13:48:28.8058323","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:28.8060900","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2","SUCCESS","FileInformationClass: FileBothDirectoryInformation, 1: {F750E6C3-38EE-11D1-85E5-00C04FC295EE}"
"13:48:28.8061908","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:28.8062616","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8063136","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\CatRoot","SUCCESS","Information: DACL"
"13:48:28.8063248","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot","SUCCESS",""
"13:48:28.8064251","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:28.8065450","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8065981","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\catroot2","SUCCESS","Information: DACL"
"13:48:28.8066108","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:28.8068131","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2","NO MORE FILES","FileInformationClass: FileBothDirectoryInformation"
"13:48:28.8068462","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:28.8069926","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8070099","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","CreationTime: 01.04.2024 09:26:07, LastAccessTime: 13.08.2025 20:52:27, LastWriteTime: 01.04.2024 09:26:07, ChangeTime: 12.08.2025 21:35:30, FileAttributes: D"
"13:48:28.8070252","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS",""
"13:48:28.8071719","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8071879","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","CreationTime: 01.04.2024 18:17:28, LastAccessTime: 13.10.2025 13:32:53, LastWriteTime: 12.08.2025 20:38:19, ChangeTime: 12.08.2025 20:38:19, FileAttributes: DNCI"
"13:48:28.8071946","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS",""
"13:48:28.8072870","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8073131","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2\{????????????????????????????????????}","SUCCESS","FileInformationClass: FileBothDirectoryInformation, Filter: {????????????????????????????????????}, 2: {127D0A1D-4EF2-11D1-8608-00C04FC295EE}"
"13:48:28.8073979","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:28.8074904","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8075188","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\CatRoot","SUCCESS","Information: DACL"
"13:48:28.8075351","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot","SUCCESS",""
"13:48:28.8077142","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:28.8078991","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8079327","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\catroot2","SUCCESS","Information: DACL"
"13:48:28.8079418","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:28.8081193","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2","SUCCESS","FileInformationClass: FileBothDirectoryInformation, 1: {F750E6C3-38EE-11D1-85E5-00C04FC295EE}"
"13:48:28.8082070","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:28.8082939","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8083143","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\CatRoot","SUCCESS","Information: DACL"
"13:48:28.8083224","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot","SUCCESS",""
"13:48:28.8083917","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:28.8084795","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8084975","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\catroot2","SUCCESS","Information: DACL"
"13:48:28.8085052","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:28.8087031","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2","NO MORE FILES","FileInformationClass: FileBothDirectoryInformation"
"13:48:28.8087298","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:28.8087751","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.8088803","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:28.8089237","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:28.8089453","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:28.8089651","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:28.8089773","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:28.8089836","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: True, Offset: 120, Length: 1, Fail Immediately: True"
"13:48:28.8090456","MsMpEng.exe","3220","WriteFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 865’232, Length: 24"
"13:48:28.8090628","MsMpEng.exe","3220","WriteFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 865’256, Length: 4’096"
"13:48:28.8090932","MsMpEng.exe","3220","WriteFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 869’352, Length: 24"
"13:48:28.8091013","MsMpEng.exe","3220","WriteFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 869’376, Length: 4’096"
"13:48:28.8091127","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 120, Length: 1"
"13:48:28.8091191","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:28.8093614","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8093919","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.8099712","MsMpEng.exe","3220","QueryStreamInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.8099857","MsMpEng.exe","3220","QueryEAFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","NO EAS ON FILE",""
"13:48:28.8101865","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.8102149","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.8102721","MsMpEng.exe","3220","RegCloseKey","HKU\.DEFAULT","SUCCESS",""
"13:48:28.8103364","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.8103460","MsMpEng.exe","3220","RegOpenKey","HKLM\SYSTEM\CurrentControlSet\Control\hivelist","REPARSE","Desired Access: Read"
"13:48:28.8103641","MsMpEng.exe","3220","RegOpenKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Desired Access: Read"
"13:48:28.8103800","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-21-4172013786-3171869251-2938521833-1000","SUCCESS","Type: REG_SZ, Length: 98, Data: \Device\HarddiskVolume4\Users\hacker\NTUSER.DAT"
"13:48:28.8104107","MsMpEng.exe","3220","RegQueryKey","HKU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.8104250","MsMpEng.exe","3220","RegOpenKey","HKCU","SUCCESS","Desired Access: Read"
"13:48:28.8104378","MsMpEng.exe","3220","RegCloseKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS",""
"13:48:28.8104455","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.8104516","MsMpEng.exe","3220","RegOpenKey","HKLM\SYSTEM\CurrentControlSet\Control\hivelist","REPARSE","Desired Access: Read"
"13:48:28.8104600","MsMpEng.exe","3220","RegOpenKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Desired Access: Read"
"13:48:28.8104688","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-21-4172013786-3171869251-2938521833-1000_Classes","BUFFER OVERFLOW","Length: 144"
"13:48:28.8104861","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-21-4172013786-3171869251-2938521833-1000_Classes","SUCCESS","Type: REG_SZ, Length: 166, Data: \Device\HarddiskVolume4\Users\hacker\AppData\Local\Microsoft\Windows\UsrClass.dat"
"13:48:28.8105021","MsMpEng.exe","3220","RegQueryKey","HKU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.8105139","MsMpEng.exe","3220","RegOpenKey","HKCU\Software\Classes","SUCCESS","Desired Access: Read"
"13:48:28.8105567","MsMpEng.exe","3220","RegCloseKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS",""
"13:48:28.8105749","MsMpEng.exe","3220","RegCloseKey","HKCU","SUCCESS",""
"13:48:28.8105819","MsMpEng.exe","3220","RegCloseKey","HKCU\Software\Classes","SUCCESS",""
"13:48:28.8105905","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.8106085","MsMpEng.exe","3220","RegOpenKey","HKLM\SYSTEM\CurrentControlSet\Control\hivelist","REPARSE","Desired Access: Read"
"13:48:28.8106175","MsMpEng.exe","3220","RegOpenKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Desired Access: Read"
"13:48:28.8106309","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-21-4172013786-3171869251-2938521833-1000","SUCCESS","Type: REG_SZ, Length: 98, Data: \Device\HarddiskVolume4\Users\hacker\NTUSER.DAT"
"13:48:28.8106762","MsMpEng.exe","3220","RegQueryKey","HKU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.8106881","MsMpEng.exe","3220","RegOpenKey","HKCU","SUCCESS","Desired Access: Read"
"13:48:28.8107139","MsMpEng.exe","3220","RegCloseKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS",""
"13:48:28.8107257","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.8107359","MsMpEng.exe","3220","RegOpenKey","HKLM\SYSTEM\CurrentControlSet\Control\hivelist","REPARSE","Desired Access: Read"
"13:48:28.8107492","MsMpEng.exe","3220","RegOpenKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Desired Access: Read"
"13:48:28.8107698","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-21-4172013786-3171869251-2938521833-1000_Classes","BUFFER OVERFLOW","Length: 144"
"13:48:28.8107846","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-21-4172013786-3171869251-2938521833-1000_Classes","SUCCESS","Type: REG_SZ, Length: 166, Data: \Device\HarddiskVolume4\Users\hacker\AppData\Local\Microsoft\Windows\UsrClass.dat"
"13:48:28.8108037","MsMpEng.exe","3220","RegQueryKey","HKU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:28.8108279","MsMpEng.exe","3220","RegOpenKey","HKCU\Software\Classes","SUCCESS","Desired Access: Read"
"13:48:28.8108455","MsMpEng.exe","3220","RegCloseKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS",""
"13:48:28.8111564","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Open For Backup, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8111955","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.8112789","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8113140","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A"
"13:48:28.8113256","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 0, Length: 512, Priority: Normal"
"13:48:28.8113406","MsMpEng.exe","3220","QueryStandardInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","AllocationSize: 380’928, EndOfFile: 378’880, NumberOfLinks: 1, DeletePending: False, Directory: False"
"13:48:28.8113617","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 0, Length: 64, Priority: Normal"
"13:48:28.8113971","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 272, Length: 28, Priority: Normal"
"13:48:28.8114268","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 0, Length: 4’096, Priority: Normal"
"13:48:28.8116240","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8116538","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.8117578","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8117819","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.8118909","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8119480","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.8119594","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.8120731","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","NOT A DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.8121503","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.8122157","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8122440","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.8122752","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS",""
"13:48:28.8126954","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8128304","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS",""
"13:48:28.8129165","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8129541","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.8129608","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS",""
"13:48:28.8130901","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8131351","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.8131571","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS",""
"13:48:28.8132837","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.8134002","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8134346","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.8134523","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS",""
"13:48:28.8136102","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8136296","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS",""
"13:48:28.8136976","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8137767","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.8138313","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS",""
"13:48:28.8139300","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8139493","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.8139669","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS",""
"13:48:28.8140431","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.8141061","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8141229","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.8141312","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:28.8141949","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8142216","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:28.8142876","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8143363","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.8143575","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:28.8144305","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8144561","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.8144667","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:28.8145504","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.8146128","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8146370","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.8146473","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:28.8147333","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8148568","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:28.8152576","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8152904","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.8155071","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:28.8163254","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8166045","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.8166945","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:28.8172233","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.8174941","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8176928","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.8178614","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:28.8185230","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8185761","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:28.8186935","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8187261","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.8187347","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:28.8188053","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8188217","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.8188319","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:28.8190292","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.8191393","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8191806","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.8191972","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:28.8196727","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8197214","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:28.8200443","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8200797","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.8200873","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:28.8201587","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8201755","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.8201934","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:28.8202615","MsMpEng.exe","3220","CreateFile","C:\Users","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.8204376","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8204730","MsMpEng.exe","3220","FileSystemControl","C:\Users","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.8204866","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:28.8206106","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8207100","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:28.8208104","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8209862","MsMpEng.exe","3220","DeviceIoControl","C:\Users","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.8210067","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:28.8214136","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8214582","MsMpEng.exe","3220","FileSystemControl","C:\Users","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.8214784","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:28.8216139","MsMpEng.exe","3220","CreateFile","C:\","SUCCESS","Desired Access: Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8216370","MsMpEng.exe","3220","QueryNameInformationFile","C:\","SUCCESS","Name: \"
"13:48:28.8216612","MsMpEng.exe","3220","QueryAttributeInformationVolume","C:\","SUCCESS","FileSystemAttributes: Case Preserved, Case Sensitive, Unicode, ACLs, Compression, Named Streams, EFS, Object IDs, Reparse Points, Sparse Files, Quotas, Transactions, 0x3c02e00, MaximumComponentNameLength: 255, FileSystemName: NTFS"
"13:48:28.8216693","MsMpEng.exe","3220","CloseFile","C:\","SUCCESS",""
"13:48:28.8217481","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8217663","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.8218673","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8218864","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.8219846","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8220007","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.8220670","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8221000","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.8221062","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.8221752","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","NOT A DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.8222788","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.8224230","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8224879","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.8225343","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS",""
"13:48:28.8226349","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8226570","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS",""
"13:48:28.8227258","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8227636","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.8227803","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS",""
"13:48:28.8228516","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8228772","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.8228882","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU","SUCCESS",""
"13:48:28.8229563","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.8230220","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8230399","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.8230486","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS",""
"13:48:28.8231350","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8231512","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS",""
"13:48:28.8232158","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8232475","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.8232548","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS",""
"13:48:28.8233216","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8233376","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\helpers","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.8233462","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers","SUCCESS",""
"13:48:28.8234088","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.8234701","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8234962","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.8235049","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:28.8235816","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8236120","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:28.8236817","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8237087","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.8237148","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:28.8238503","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8238886","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.8239029","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:28.8240090","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.8240986","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8241388","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.8241859","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:28.8243048","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8243322","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:28.8244700","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8245154","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.8245262","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:28.8246393","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8246730","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.8246882","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:28.8248014","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.8249195","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8249374","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.8249571","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:28.8250271","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8250431","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:28.8251234","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8251713","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.8251825","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:28.8252826","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8253074","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.8253201","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:28.8254578","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.8255279","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8255457","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.8255755","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:28.8256490","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8256643","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:28.8257268","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8257595","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.8257659","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:28.8258545","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\advapi32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8258624","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8258821","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.8258908","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:28.8259352","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\advapi32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.8259559","MsMpEng.exe","3220","CreateFile","C:\Users","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:28.8259661","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\advapi32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.8259780","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\advapi32.dll","SUCCESS",""
"13:48:28.8260153","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8260313","MsMpEng.exe","3220","FileSystemControl","C:\Users","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.8260463","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:28.8260996","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8261246","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:28.8261847","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8262062","MsMpEng.exe","3220","DeviceIoControl","C:\Users","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:28.8262122","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:28.8262786","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8263037","MsMpEng.exe","3220","FileSystemControl","C:\Users","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:28.8263115","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:28.8263776","MsMpEng.exe","3220","CreateFile","C:\","SUCCESS","Desired Access: Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Free Space Query, Attributes: n/a, ShareMode: None, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8264000","MsMpEng.exe","3220","QuerySizeInformationVolume","C:\","SUCCESS","TotalAllocationUnits: 20’646’655, AvailableAllocationUnits: 5’331’773, SectorsPerAllocationUnit: 8, BytesPerSector: 512"
"13:48:28.8264152","MsMpEng.exe","3220","CloseFile","C:\","SUCCESS",""
"13:48:28.8264583","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 0, Length: 65’536, Priority: Normal"
"13:48:28.8265216","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 374’784, Length: 4’096, Priority: Normal"
"13:48:28.8265831","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 0, Length: 378’880, Priority: Normal"
"13:48:28.8275213","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\ntmarta.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8275502","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ntmarta.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:28.8275730","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ntmarta.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:28.8275840","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\ntmarta.dll","SUCCESS",""
"13:48:28.8297939","MsMpEng.exe","3220","CreateFileMapping","C:\Windows\SystemTemp\UDDA014.tmp","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_READ"
"13:48:28.8298641","MsMpEng.exe","3220","QueryStandardInformationFile","C:\Windows\SystemTemp\UDDA014.tmp","SUCCESS","AllocationSize: 2’519’040, EndOfFile: 2’518’232, NumberOfLinks: 1, DeletePending: False, Directory: False"
"13:48:28.8364461","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 299’008, Length: 4’096, Priority: Normal"
"13:48:28.8364704","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 372’736, Length: 4’096, Priority: Normal"
"13:48:28.8380345","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 1’024, Length: 185’856, Priority: Normal"
"13:48:28.8383877","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 186’880, Length: 91’136, Priority: Normal"
"13:48:28.8385765","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 278’016, Length: 12’288, Priority: Normal"
"13:48:28.8386189","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 290’304, Length: 9’216, Priority: Normal"
"13:48:28.8386520","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 300’032, Length: 75’776, Priority: Normal"
"13:48:28.8388074","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 376’832, Length: 2’048, Priority: Normal"
"13:48:28.8388743","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 303’104, Length: 4’096, Priority: Normal"
"13:48:28.8389451","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 307’200, Length: 4’096, Priority: Normal"
"13:48:28.8389747","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 308’116, Length: 9’640, Priority: Normal"
"13:48:28.8390322","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 317’756, Length: 4’264, Priority: Normal"
"13:48:28.8390889","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 319’488, Length: 4’096, Priority: Normal"
"13:48:28.8391458","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 323’584, Length: 4’096, Priority: Normal"
"13:48:28.8391870","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 326’080, Length: 48’399, Priority: Normal"
"13:48:28.8393946","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 81’920, Length: 4’096, Priority: Normal"
"13:48:28.8394219","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 4’096, Length: 4’096, Priority: Normal"
"13:48:28.8395159","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe:Zone.Identifier","NAME NOT FOUND","Desired Access: Read Data/List Directory, Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Open For Backup, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:28.8395840","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 0, Length: 2, Priority: Normal"
"13:48:28.8396117","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 0, Length: 64, Priority: Normal"
"13:48:28.8396252","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 272, Length: 28, Priority: Normal"
"13:48:28.8396432","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 0, Length: 4’096, Priority: Normal"
"13:48:28.8396847","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 0, Length: 360, Priority: Normal"
"13:48:28.8396996","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 364, Length: 76, Priority: Normal"
"13:48:28.8397389","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 448, Length: 262’144, Priority: Normal"
"13:48:28.8408915","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","Offset: 262’592, Length: 116’288, Priority: Normal"
"13:48:28.8414656","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8415061","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","CreationTime: 01.04.2024 09:26:07, LastAccessTime: 13.08.2025 20:52:27, LastWriteTime: 01.04.2024 09:26:07, ChangeTime: 12.08.2025 21:35:30, FileAttributes: D"
"13:48:28.8415153","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS",""
"13:48:28.8417103","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8417461","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","CreationTime: 01.04.2024 18:17:28, LastAccessTime: 13.10.2025 13:32:53, LastWriteTime: 12.08.2025 20:38:19, ChangeTime: 12.08.2025 20:38:19, FileAttributes: DNCI"
"13:48:28.8417587","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS",""
"13:48:28.8419630","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8421908","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2\{????????????????????????????????????}","SUCCESS","FileInformationClass: FileBothDirectoryInformation, Filter: {????????????????????????????????????}, 2: {127D0A1D-4EF2-11D1-8608-00C04FC295EE}"
"13:48:28.8423050","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:28.8425251","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8425513","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\CatRoot","SUCCESS","Information: DACL"
"13:48:28.8426092","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot","SUCCESS",""
"13:48:28.8427205","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:28.8428160","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8428546","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\catroot2","SUCCESS","Information: DACL"
"13:48:28.8428644","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:28.8431183","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2","SUCCESS","FileInformationClass: FileBothDirectoryInformation, 1: {F750E6C3-38EE-11D1-85E5-00C04FC295EE}"
"13:48:28.8432411","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:28.8433737","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8434051","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\CatRoot","SUCCESS","Information: DACL"
"13:48:28.8435171","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot","SUCCESS",""
"13:48:28.8436279","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:28.8439184","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8439499","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\catroot2","SUCCESS","Information: DACL"
"13:48:28.8439581","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:28.8457377","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2","NO MORE FILES","FileInformationClass: FileBothDirectoryInformation"
"13:48:28.8457580","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:28.8459214","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8459474","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","CreationTime: 01.04.2024 09:26:07, LastAccessTime: 13.08.2025 20:52:27, LastWriteTime: 01.04.2024 09:26:07, ChangeTime: 12.08.2025 21:35:30, FileAttributes: D"
"13:48:28.8459566","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS",""
"13:48:28.8460731","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8460888","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","CreationTime: 01.04.2024 18:17:28, LastAccessTime: 13.10.2025 13:32:53, LastWriteTime: 12.08.2025 20:38:19, ChangeTime: 12.08.2025 20:38:19, FileAttributes: DNCI"
"13:48:28.8460947","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS",""
"13:48:28.8461672","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8462122","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2\{????????????????????????????????????}","SUCCESS","FileInformationClass: FileBothDirectoryInformation, Filter: {????????????????????????????????????}, 2: {127D0A1D-4EF2-11D1-8608-00C04FC295EE}"
"13:48:28.8462993","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:28.8464220","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8464530","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\CatRoot","SUCCESS","Information: DACL"
"13:48:28.8464609","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot","SUCCESS",""
"13:48:28.8465328","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:28.8466589","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8466891","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\catroot2","SUCCESS","Information: DACL"
"13:48:28.8466978","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:28.8470210","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2","SUCCESS","FileInformationClass: FileBothDirectoryInformation, 1: {F750E6C3-38EE-11D1-85E5-00C04FC295EE}"
"13:48:28.8471403","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:28.8472171","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8472352","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\CatRoot","SUCCESS","Information: DACL"
"13:48:28.8472529","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot","SUCCESS",""
"13:48:28.8473335","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:28.8475024","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:28.8475198","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\catroot2","SUCCESS","Information: DACL"
"13:48:28.8475374","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:28.8477309","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2","NO MORE FILES","FileInformationClass: FileBothDirectoryInformation"
"13:48:28.8477477","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:28.8477961","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS","CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A"
"13:48:28.8478180","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.8478525","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe","SUCCESS",""
"13:48:28.8480475","MsMpEng.exe","3220","CreateFile","C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\4F992D724B6D33EA543475A51B3D00E9","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:28.8480966","MsMpEng.exe","3220","RegCloseKey","HKCU","SUCCESS",""
"13:48:28.8481063","MsMpEng.exe","3220","RegCloseKey","HKCU\Software\Classes","SUCCESS",""
"13:48:28.8531914","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: True, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:28.8532131","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:28.8532523","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:28.8532824","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:29.0973827","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\dllhost.exe","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Open For Backup, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.0974296","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\dllhost.exe","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:29.0974977","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\dllhost.exe","SUCCESS","Desired Access: Read Data/List Directory, Read EA, Read Attributes, Synchronize, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.0975385","MsMpEng.exe","3220","QueryEAFile","C:\Windows\System32\dllhost.exe","BUFFER OVERFLOW",""
"13:48:29.0975558","MsMpEng.exe","3220","QueryEAFile","C:\Windows\System32\dllhost.exe","SUCCESS",""
"13:48:29.0975795","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\dllhost.exe","SUCCESS","Control: FSCTL_QUERY_USN_JOURNAL"
"13:48:29.0975961","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\dllhost.exe","SUCCESS",""
"13:48:29.0976160","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\dllhost.exe","SUCCESS",""
"13:48:29.3525919","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3526166","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:29.3526242","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:29.3526313","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Win"
"13:48:29.3526362","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:29.3526515","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:29.3526615","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.3526854","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.3527586","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3527853","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Win¨"
"13:48:29.3527925","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:29.3528062","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:29.3528114","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:29.3528511","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:29.3528629","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.3528756","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.3529467","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3529725","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:29.3529792","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:29.3529859","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:29.3529910","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:29.3529974","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:29.3530044","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.3530286","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.3531009","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3531160","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:29.3531482","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.3533628","MsMpEng.exe","3220","RegQueryKey","HKU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:29.3533735","MsMpEng.exe","3220","RegOpenKey","HKU\S-1-5-18","REPARSE","Desired Access: Read"
"13:48:29.3534152","MsMpEng.exe","3220","RegOpenKey","HKU\.DEFAULT","SUCCESS","Desired Access: Read"
"13:48:29.3534365","MsMpEng.exe","3220","RegCloseKey","HKU\.DEFAULT","SUCCESS",""
"13:48:29.3534471","MsMpEng.exe","3220","RegQueryKey","HKU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:29.3534548","MsMpEng.exe","3220","RegOpenKey","HKU\S-1-5-18","REPARSE","Desired Access: Read"
"13:48:29.3534698","MsMpEng.exe","3220","RegOpenKey","HKU\.DEFAULT","SUCCESS","Desired Access: Read"
"13:48:29.3536835","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3536990","MsMpEng.exe","3220","QueryNetworkOpenInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, AllocationSize: 01.01.1601 02:00:00, EndOfFile: 01.01.1601 02:00:00, FileAttributes: A"
"13:48:29.3537158","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.3538022","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3538210","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:29.3538395","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:29.3538489","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:29.3538650","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:29.3538725","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:29.3538983","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.3539115","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.3539893","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3540147","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:29.3540227","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:29.3540318","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:29.3540371","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:29.3540441","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:29.3540517","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.3540877","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.3542076","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3542580","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:29.3542679","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:29.3542869","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:29.3542951","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:29.3543054","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:29.3543455","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.3543636","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.3544776","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3545138","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:29.3545239","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.3546574","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3546819","MsMpEng.exe","3220","QueryNetworkOpenInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, AllocationSize: 01.01.1601 02:00:00, EndOfFile: 01.01.1601 02:00:00, FileAttributes: A"
"13:48:29.3547078","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.3548991","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Open For Backup, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3549453","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:29.3550516","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3550993","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A"
"13:48:29.3551088","MsMpEng.exe","3220","QueryStandardInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","AllocationSize: 32’768, EndOfFile: 29’184, NumberOfLinks: 1, DeletePending: False, Directory: False"
"13:48:29.3553602","MsMpEng.exe","3220","CreateFile","C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\998F15D801113A42F317A677646B63B6","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:29.3553889","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 0, Length: 4’096, Priority: Normal"
"13:48:29.3556064","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 24’576, Length: 4’608, Priority: Normal"
"13:48:29.3601209","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 20’480, Length: 4’096, Priority: Normal"
"13:48:29.3601864","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 8’192, Length: 8’192, Priority: Normal"
"13:48:29.3619318","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 16’384, Length: 8’192, Priority: Normal"
"13:48:29.3634192","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 4’096, Length: 4’096, Priority: Normal"
"13:48:29.3788111","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ"
"13:48:29.3788219","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:29, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:29.3788564","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:29.3789426","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:29.3789760","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 721’056, Length: 4’096"
"13:48:29.3790295","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:29.3792572","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3795397","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3795575","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","CreationTime: 01.04.2024 09:26:07, LastAccessTime: 13.08.2025 20:52:27, LastWriteTime: 01.04.2024 09:26:07, ChangeTime: 12.08.2025 21:35:30, FileAttributes: D"
"13:48:29.3795803","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS",""
"13:48:29.3797052","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3797231","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","CreationTime: 01.04.2024 18:17:28, LastAccessTime: 13.10.2025 13:32:53, LastWriteTime: 12.08.2025 20:38:19, ChangeTime: 12.08.2025 20:38:19, FileAttributes: DNCI"
"13:48:29.3797307","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS",""
"13:48:29.3798061","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3798591","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2\{????????????????????????????????????}","SUCCESS","FileInformationClass: FileBothDirectoryInformation, Filter: {????????????????????????????????????}, 2: {127D0A1D-4EF2-11D1-8608-00C04FC295EE}"
"13:48:29.3799501","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:29.3800198","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3800643","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\CatRoot","SUCCESS","Information: DACL"
"13:48:29.3800746","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot","SUCCESS",""
"13:48:29.3801625","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:29.3803571","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3803780","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\catroot2","SUCCESS","Information: DACL"
"13:48:29.3803861","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:29.3806830","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2","SUCCESS","FileInformationClass: FileBothDirectoryInformation, 1: {F750E6C3-38EE-11D1-85E5-00C04FC295EE}"
"13:48:29.3807788","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:29.3808553","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3808769","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\CatRoot","SUCCESS","Information: DACL"
"13:48:29.3808929","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot","SUCCESS",""
"13:48:29.3809637","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:29.3811099","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3811302","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\catroot2","SUCCESS","Information: DACL"
"13:48:29.3811385","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:29.3897514","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2","NO MORE FILES","FileInformationClass: FileBothDirectoryInformation"
"13:48:29.3897727","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:29.3899420","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3899616","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","CreationTime: 01.04.2024 09:26:07, LastAccessTime: 13.08.2025 20:52:27, LastWriteTime: 01.04.2024 09:26:07, ChangeTime: 12.08.2025 21:35:30, FileAttributes: D"
"13:48:29.3899880","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS",""
"13:48:29.3901491","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3901883","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","CreationTime: 01.04.2024 18:17:28, LastAccessTime: 13.10.2025 13:32:53, LastWriteTime: 12.08.2025 20:38:19, ChangeTime: 12.08.2025 20:38:19, FileAttributes: DNCI"
"13:48:29.3901975","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS",""
"13:48:29.3902893","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3903196","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2\{????????????????????????????????????}","SUCCESS","FileInformationClass: FileBothDirectoryInformation, Filter: {????????????????????????????????????}, 2: {127D0A1D-4EF2-11D1-8608-00C04FC295EE}"
"13:48:29.3904165","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:29.3904975","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3905261","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\CatRoot","SUCCESS","Information: DACL"
"13:48:29.3905383","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot","SUCCESS",""
"13:48:29.3906454","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:29.3907841","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3908161","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\catroot2","SUCCESS","Information: DACL"
"13:48:29.3908259","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:29.3910394","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2","SUCCESS","FileInformationClass: FileBothDirectoryInformation, 1: {F750E6C3-38EE-11D1-85E5-00C04FC295EE}"
"13:48:29.3911481","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:29.3912293","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3912559","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\CatRoot","SUCCESS","Information: DACL"
"13:48:29.3912778","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot","SUCCESS",""
"13:48:29.3913648","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:29.3914423","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3914752","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\catroot2","SUCCESS","Information: DACL"
"13:48:29.3914916","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:29.3929255","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2","NO MORE FILES","FileInformationClass: FileBothDirectoryInformation"
"13:48:29.3929531","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:29.3929993","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.3930897","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:29.3931107","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:29.3931421","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:29.3931525","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:29.3931623","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:29.3931684","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: True, Offset: 120, Length: 1, Fail Immediately: True"
"13:48:29.3932303","MsMpEng.exe","3220","WriteFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 873’472, Length: 24"
"13:48:29.3932562","MsMpEng.exe","3220","WriteFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 873’496, Length: 4’096"
"13:48:29.3932787","MsMpEng.exe","3220","WriteFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 877’592, Length: 24"
"13:48:29.3932859","MsMpEng.exe","3220","WriteFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 877’616, Length: 4’096"
"13:48:29.3933039","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 120, Length: 1"
"13:48:29.3933131","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:29.3935393","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3935834","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.3940743","MsMpEng.exe","3220","QueryStreamInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.3940885","MsMpEng.exe","3220","QueryEAFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","NO EAS ON FILE",""
"13:48:29.3942617","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.3942831","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.3943330","MsMpEng.exe","3220","RegCloseKey","HKU\.DEFAULT","SUCCESS",""
"13:48:29.3945156","MsMpEng.exe","3220","CreateFile","C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Open For Backup, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3945694","MsMpEng.exe","3220","FileSystemControl","C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:29.3946488","MsMpEng.exe","3220","CreateFile","C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3946765","MsMpEng.exe","3220","QueryInformationVolume","C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winწ"
"13:48:29.3947024","MsMpEng.exe","3220","QueryAllInformationFile","C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe","BUFFER OVERFLOW","CreationTime: 18.09.2025 14:18:18, LastAccessTime: 13.10.2025 13:48:27, LastWriteTime: 18.09.2025 14:18:13, ChangeTime: 11.10.2025 16:01:28, FileAttributes: ANCI, AllocationSize: 163’840, EndOfFile: 282’480"
"13:48:29.3947118","MsMpEng.exe","3220","FileSystemControl","C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:29.3947665","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: True, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:29.3947750","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:29.3947813","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:29.3947904","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:29.3948248","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe","SUCCESS","Offset: 0, Length: 65’536, Priority: Normal"
"13:48:29.3950293","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe","SUCCESS","Offset: 65’536, Length: 65’536, Priority: Normal"
"13:48:29.3952414","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe","SUCCESS","Offset: 131’072, Length: 65’536, Priority: Normal"
"13:48:29.3954416","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe","SUCCESS","Offset: 196’608, Length: 65’536, Priority: Normal"
"13:48:29.3956473","MsMpEng.exe","3220","ReadFile","C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe","SUCCESS","Offset: 262’144, Length: 20’336, Priority: Normal"
"13:48:29.3957298","MsMpEng.exe","3220","CloseFile","C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe","SUCCESS",""
"13:48:29.3957425","MsMpEng.exe","3220","CloseFile","C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe","SUCCESS",""
"13:48:29.3957875","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:29.3958130","MsMpEng.exe","3220","RegOpenKey","HKLM\SYSTEM\CurrentControlSet\Control\hivelist","REPARSE","Desired Access: Read"
"13:48:29.3958300","MsMpEng.exe","3220","RegOpenKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Desired Access: Read"
"13:48:29.3958444","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-21-4172013786-3171869251-2938521833-1000","SUCCESS","Type: REG_SZ, Length: 98, Data: \Device\HarddiskVolume4\Users\hacker\NTUSER.DAT"
"13:48:29.3958741","MsMpEng.exe","3220","RegQueryKey","HKU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:29.3958822","MsMpEng.exe","3220","RegOpenKey","HKCU","SUCCESS","Desired Access: Read"
"13:48:29.3958939","MsMpEng.exe","3220","RegCloseKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS",""
"13:48:29.3959039","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:29.3959100","MsMpEng.exe","3220","RegOpenKey","HKLM\SYSTEM\CurrentControlSet\Control\hivelist","REPARSE","Desired Access: Read"
"13:48:29.3959181","MsMpEng.exe","3220","RegOpenKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Desired Access: Read"
"13:48:29.3959366","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-21-4172013786-3171869251-2938521833-1000_Classes","BUFFER OVERFLOW","Length: 144"
"13:48:29.3959466","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-21-4172013786-3171869251-2938521833-1000_Classes","SUCCESS","Type: REG_SZ, Length: 166, Data: \Device\HarddiskVolume4\Users\hacker\AppData\Local\Microsoft\Windows\UsrClass.dat"
"13:48:29.3959646","MsMpEng.exe","3220","RegQueryKey","HKU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:29.3959716","MsMpEng.exe","3220","RegOpenKey","HKCU\Software\Classes","SUCCESS","Desired Access: Read"
"13:48:29.3959893","MsMpEng.exe","3220","RegCloseKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS",""
"13:48:29.3959996","MsMpEng.exe","3220","RegCloseKey","HKCU","SUCCESS",""
"13:48:29.3960058","MsMpEng.exe","3220","RegCloseKey","HKCU\Software\Classes","SUCCESS",""
"13:48:29.3960136","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:29.3960199","MsMpEng.exe","3220","RegOpenKey","HKLM\SYSTEM\CurrentControlSet\Control\hivelist","REPARSE","Desired Access: Read"
"13:48:29.3960687","MsMpEng.exe","3220","RegOpenKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Desired Access: Read"
"13:48:29.3961053","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-21-4172013786-3171869251-2938521833-1000","SUCCESS","Type: REG_SZ, Length: 98, Data: \Device\HarddiskVolume4\Users\hacker\NTUSER.DAT"
"13:48:29.3961386","MsMpEng.exe","3220","RegQueryKey","HKU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:29.3961510","MsMpEng.exe","3220","RegOpenKey","HKCU","SUCCESS","Desired Access: Read"
"13:48:29.3961665","MsMpEng.exe","3220","RegCloseKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS",""
"13:48:29.3961832","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:29.3961978","MsMpEng.exe","3220","RegOpenKey","HKLM\SYSTEM\CurrentControlSet\Control\hivelist","REPARSE","Desired Access: Read"
"13:48:29.3962098","MsMpEng.exe","3220","RegOpenKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Desired Access: Read"
"13:48:29.3962211","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-21-4172013786-3171869251-2938521833-1000_Classes","BUFFER OVERFLOW","Length: 144"
"13:48:29.3962324","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-21-4172013786-3171869251-2938521833-1000_Classes","SUCCESS","Type: REG_SZ, Length: 166, Data: \Device\HarddiskVolume4\Users\hacker\AppData\Local\Microsoft\Windows\UsrClass.dat"
"13:48:29.3962563","MsMpEng.exe","3220","RegQueryKey","HKU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:29.3962669","MsMpEng.exe","3220","RegOpenKey","HKCU\Software\Classes","SUCCESS","Desired Access: Read"
"13:48:29.3962795","MsMpEng.exe","3220","RegCloseKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS",""
"13:48:29.3965952","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Open For Backup, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3966370","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:29.3967185","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3967598","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:29, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A"
"13:48:29.3967718","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 0, Length: 512, Priority: Normal"
"13:48:29.3968226","MsMpEng.exe","3220","QueryStandardInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","AllocationSize: 32’768, EndOfFile: 29’184, NumberOfLinks: 1, DeletePending: False, Directory: False"
"13:48:29.3968601","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 0, Length: 64, Priority: Normal"
"13:48:29.3968781","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 240, Length: 28, Priority: Normal"
"13:48:29.3968961","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 0, Length: 4’096, Priority: Normal"
"13:48:29.3970133","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3970454","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.3971212","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3971377","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.3972155","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3972521","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.3972587","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.3973404","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","NOT A DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.3974109","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.3974722","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3974909","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.3975001","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS",""
"13:48:29.3975852","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3976075","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS",""
"13:48:29.3976764","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3977107","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.3977178","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS",""
"13:48:29.3977875","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3978041","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.3978125","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS",""
"13:48:29.3979066","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.3979733","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3979902","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.3980249","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS",""
"13:48:29.3981041","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3981302","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS",""
"13:48:29.3982057","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3982283","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection\x64","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.3982347","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS",""
"13:48:29.3983885","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3984145","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.3984233","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS",""
"13:48:29.3985227","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.3985960","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3986218","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.3986326","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:29.3987496","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3987839","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:29.3988681","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3989075","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.3989153","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:29.3989935","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3990238","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.3990343","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:29.3991124","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.3991803","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3992105","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.3992195","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:29.3992910","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3993182","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:29.3994121","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3994391","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.3994454","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:29.3995464","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3995793","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.3995964","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:29.3996826","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.3997762","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3998000","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.3998107","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:29.3999223","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.3999464","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:29.4000361","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4000644","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.4000817","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:29.4001589","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4001774","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4001859","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:29.4002494","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.4003063","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4003308","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4003398","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:29.4004167","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4004504","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:29.4007179","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4007512","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.4007591","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:29.4008510","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4008714","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4008810","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:29.4009645","MsMpEng.exe","3220","CreateFile","C:\Users","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.4010372","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4010572","MsMpEng.exe","3220","FileSystemControl","C:\Users","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4010686","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:29.4011487","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4011693","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:29.4012418","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4012776","MsMpEng.exe","3220","DeviceIoControl","C:\Users","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.4012858","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:29.4013931","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4014136","MsMpEng.exe","3220","FileSystemControl","C:\Users","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4014224","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:29.4015155","MsMpEng.exe","3220","CreateFile","C:\","SUCCESS","Desired Access: Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4015381","MsMpEng.exe","3220","QueryNameInformationFile","C:\","SUCCESS","Name: \"
"13:48:29.4015500","MsMpEng.exe","3220","QueryAttributeInformationVolume","C:\","SUCCESS","FileSystemAttributes: Case Preserved, Case Sensitive, Unicode, ACLs, Compression, Named Streams, EFS, Object IDs, Reparse Points, Sparse Files, Quotas, Transactions, 0x3c02e00, MaximumComponentNameLength: 255, FileSystemName: NTFS"
"13:48:29.4015767","MsMpEng.exe","3220","CloseFile","C:\","SUCCESS",""
"13:48:29.4016682","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4017000","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4017927","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4018230","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4019001","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4019171","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4020102","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4020352","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.4020424","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4021313","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","NOT A DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.4022515","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.4023288","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4023615","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4023744","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS",""
"13:48:29.4024515","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4024815","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS",""
"13:48:29.4025761","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4026172","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.4026252","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS",""
"13:48:29.4027145","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4027397","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4027495","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS",""
"13:48:29.4028364","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.4029164","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4029360","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4029450","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS",""
"13:48:29.4030341","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4030551","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS",""
"13:48:29.4031328","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4031730","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection\x64","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.4031803","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS",""
"13:48:29.4032678","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4032980","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4033201","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS",""
"13:48:29.4033920","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.4034508","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4034674","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4034751","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:29.4035348","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4035493","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:29.4036420","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4036638","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.4036699","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:29.4037322","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4037583","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4037659","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:29.4038270","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.4038830","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4038978","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4039050","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:29.4039625","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4039765","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:29.4040355","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4040647","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.4040703","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:29.4041321","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4041463","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4041533","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:29.4042153","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.4042730","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4042968","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4043053","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:29.4043646","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4043797","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:29.4044404","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4044854","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.4044912","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:29.4045562","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4045837","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4045988","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:29.4046606","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.4047180","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4047354","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4047431","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:29.4048051","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4048189","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:29.4048780","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4049068","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.4049134","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:29.4049817","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4049961","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4050034","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:29.4050619","MsMpEng.exe","3220","CreateFile","C:\Users","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.4051251","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4051497","MsMpEng.exe","3220","FileSystemControl","C:\Users","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4051597","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:29.4052761","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4053070","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:29.4053828","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4054068","MsMpEng.exe","3220","DeviceIoControl","C:\Users","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.4054254","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:29.4055018","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4055201","MsMpEng.exe","3220","FileSystemControl","C:\Users","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4055298","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:29.4056385","MsMpEng.exe","3220","CreateFile","C:\","SUCCESS","Desired Access: Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Free Space Query, Attributes: n/a, ShareMode: None, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4056578","MsMpEng.exe","3220","QuerySizeInformationVolume","C:\","SUCCESS","TotalAllocationUnits: 20’646’655, AvailableAllocationUnits: 5’331’773, SectorsPerAllocationUnit: 8, BytesPerSector: 512"
"13:48:29.4056656","MsMpEng.exe","3220","CloseFile","C:\","SUCCESS",""
"13:48:29.4057031","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4057208","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4057872","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:29.4057984","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:29.4059381","MsMpEng.exe","3220","CreateFile","C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\998F15D801113A42F317A677646B63B6","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:29.4059755","MsMpEng.exe","3220","RegCloseKey","HKCU","SUCCESS",""
"13:48:29.4059838","MsMpEng.exe","3220","RegCloseKey","HKCU\Software\Classes","SUCCESS",""
"13:48:29.4062203","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4062460","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:29.4062544","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:29, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:29.4062620","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:29.4062670","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:29, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:29.4062748","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:29.4062832","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4063114","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4063867","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4064016","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winწ"
"13:48:29.4064081","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:29, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:29.4064143","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:29.4064262","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:29, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:29.4064351","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:29.4064422","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4064525","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4065351","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4065708","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:29.4065796","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:29, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:29.4065865","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:29.4065913","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:29, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:29.4065978","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:29.4066119","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4066235","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4066941","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4067104","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:29.4067474","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4069179","MsMpEng.exe","3220","RegQueryKey","HKU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:29.4069304","MsMpEng.exe","3220","RegOpenKey","HKU\S-1-5-18","REPARSE","Desired Access: Read"
"13:48:29.4069421","MsMpEng.exe","3220","RegOpenKey","HKU\.DEFAULT","SUCCESS","Desired Access: Read"
"13:48:29.4069694","MsMpEng.exe","3220","RegCloseKey","HKU\.DEFAULT","SUCCESS",""
"13:48:29.4069804","MsMpEng.exe","3220","RegQueryKey","HKU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:29.4069886","MsMpEng.exe","3220","RegOpenKey","HKU\S-1-5-18","REPARSE","Desired Access: Read"
"13:48:29.4069982","MsMpEng.exe","3220","RegOpenKey","HKU\.DEFAULT","SUCCESS","Desired Access: Read"
"13:48:29.4072234","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4072409","MsMpEng.exe","3220","QueryNetworkOpenInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:29, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, AllocationSize: 01.01.1601 02:00:00, EndOfFile: 01.01.1601 02:00:00, FileAttributes: A"
"13:48:29.4072484","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4073505","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4073707","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winწ"
"13:48:29.4073915","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:29, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:29.4074014","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:29.4074081","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:29, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:29.4074172","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:29.4074270","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4074514","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4075382","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4075721","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:29.4075833","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:29, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:29.4075926","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:29.4075989","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:29, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:29.4076075","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:29.4076166","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4076402","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4077249","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4077544","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:29.4077641","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:29, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:29.4077731","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:29.4077794","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:29, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:29.4077880","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:29.4077969","MsMpEng.exe","3220","QueryIdInformation","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4078192","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4079036","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4079219","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:29.4079437","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4080776","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4080926","MsMpEng.exe","3220","QueryNetworkOpenInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:29, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, AllocationSize: 01.01.1601 02:00:00, EndOfFile: 01.01.1601 02:00:00, FileAttributes: A"
"13:48:29.4080998","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4082603","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Open For Backup, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4082864","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:29.4083658","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4083920","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:29, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A"
"13:48:29.4083994","MsMpEng.exe","3220","QueryStandardInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","AllocationSize: 32’768, EndOfFile: 29’184, NumberOfLinks: 1, DeletePending: False, Directory: False"
"13:48:29.4086275","MsMpEng.exe","3220","CreateFile","C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\998F15D801113A42F317A677646B63B6","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:29.4086716","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 0, Length: 4’096, Priority: Normal"
"13:48:29.4088486","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 24’576, Length: 4’608, Priority: Normal"
"13:48:29.4131604","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 20’480, Length: 4’096, Priority: Normal"
"13:48:29.4132309","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 8’192, Length: 8’192, Priority: Normal"
"13:48:29.4147152","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 16’384, Length: 8’192, Priority: Normal"
"13:48:29.4165019","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 4’096, Length: 4’096, Priority: Normal"
"13:48:29.4314285","MsMpEng.exe","3220","QueryInformationVolume","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ"
"13:48:29.4314414","MsMpEng.exe","3220","QueryAllInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","BUFFER OVERFLOW","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:29, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184"
"13:48:29.4314627","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:29.4317210","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4321093","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4321449","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","CreationTime: 01.04.2024 09:26:07, LastAccessTime: 13.08.2025 20:52:27, LastWriteTime: 01.04.2024 09:26:07, ChangeTime: 12.08.2025 21:35:30, FileAttributes: D"
"13:48:29.4321533","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS",""
"13:48:29.4322787","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4322941","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","CreationTime: 01.04.2024 18:17:28, LastAccessTime: 13.10.2025 13:32:53, LastWriteTime: 12.08.2025 20:38:19, ChangeTime: 12.08.2025 20:38:19, FileAttributes: DNCI"
"13:48:29.4323093","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS",""
"13:48:29.4323872","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4324131","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2\{????????????????????????????????????}","SUCCESS","FileInformationClass: FileBothDirectoryInformation, Filter: {????????????????????????????????????}, 2: {127D0A1D-4EF2-11D1-8608-00C04FC295EE}"
"13:48:29.4325080","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:29.4325994","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4326257","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\CatRoot","SUCCESS","Information: DACL"
"13:48:29.4326341","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot","SUCCESS",""
"13:48:29.4327079","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:29.4327713","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4327949","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\catroot2","SUCCESS","Information: DACL"
"13:48:29.4328044","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:29.4330658","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2","SUCCESS","FileInformationClass: FileBothDirectoryInformation, 1: {F750E6C3-38EE-11D1-85E5-00C04FC295EE}"
"13:48:29.4332351","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:29.4333486","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4333728","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\CatRoot","SUCCESS","Information: DACL"
"13:48:29.4333944","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot","SUCCESS",""
"13:48:29.4334851","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:29.4335792","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4336015","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\catroot2","SUCCESS","Information: DACL"
"13:48:29.4336102","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:29.4338299","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2","NO MORE FILES","FileInformationClass: FileBothDirectoryInformation"
"13:48:29.4338488","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:29.4340233","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4340426","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","CreationTime: 01.04.2024 09:26:07, LastAccessTime: 13.08.2025 20:52:27, LastWriteTime: 01.04.2024 09:26:07, ChangeTime: 12.08.2025 21:35:30, FileAttributes: D"
"13:48:29.4340622","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS",""
"13:48:29.4342041","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4342216","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","CreationTime: 01.04.2024 18:17:28, LastAccessTime: 13.10.2025 13:32:53, LastWriteTime: 12.08.2025 20:38:19, ChangeTime: 12.08.2025 20:38:19, FileAttributes: DNCI"
"13:48:29.4342383","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS",""
"13:48:29.4343268","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4343639","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2\{????????????????????????????????????}","SUCCESS","FileInformationClass: FileBothDirectoryInformation, Filter: {????????????????????????????????????}, 2: {127D0A1D-4EF2-11D1-8608-00C04FC295EE}"
"13:48:29.4344821","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:29.4345460","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4345784","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\CatRoot","SUCCESS","Information: DACL"
"13:48:29.4345868","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot","SUCCESS",""
"13:48:29.4347366","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:29.4349193","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4349566","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\catroot2","SUCCESS","Information: DACL"
"13:48:29.4349669","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:29.4351931","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2","SUCCESS","FileInformationClass: FileBothDirectoryInformation, 1: {F750E6C3-38EE-11D1-85E5-00C04FC295EE}"
"13:48:29.4353656","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:29.4356250","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4356666","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\CatRoot","SUCCESS","Information: DACL"
"13:48:29.4356904","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot","SUCCESS",""
"13:48:29.4359034","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:29.4359956","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4360348","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\catroot2","SUCCESS","Information: DACL"
"13:48:29.4360441","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:29.4362319","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2","NO MORE FILES","FileInformationClass: FileBothDirectoryInformation"
"13:48:29.4362609","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:29.4363004","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4364179","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:29.4364684","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:29.4365165","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:29.4365330","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:29.4365458","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:29.4365727","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: True, Offset: 120, Length: 1, Fail Immediately: True"
"13:48:29.4366495","MsMpEng.exe","3220","WriteFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 881’712, Length: 24"
"13:48:29.4366779","MsMpEng.exe","3220","WriteFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 881’736, Length: 4’096"
"13:48:29.4367089","MsMpEng.exe","3220","WriteFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 885’832, Length: 24"
"13:48:29.4367178","MsMpEng.exe","3220","WriteFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal","SUCCESS","Offset: 885’856, Length: 4’096"
"13:48:29.4367389","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 120, Length: 1"
"13:48:29.4367508","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:29.4369947","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4370211","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4375974","MsMpEng.exe","3220","QueryStreamInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4376234","MsMpEng.exe","3220","QueryEAFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","NO EAS ON FILE",""
"13:48:29.4377792","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4378173","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4378827","MsMpEng.exe","3220","RegCloseKey","HKU\.DEFAULT","SUCCESS",""
"13:48:29.4379453","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:29.4379581","MsMpEng.exe","3220","RegOpenKey","HKLM\SYSTEM\CurrentControlSet\Control\hivelist","REPARSE","Desired Access: Read"
"13:48:29.4379707","MsMpEng.exe","3220","RegOpenKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Desired Access: Read"
"13:48:29.4379874","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-21-4172013786-3171869251-2938521833-1000","SUCCESS","Type: REG_SZ, Length: 98, Data: \Device\HarddiskVolume4\Users\hacker\NTUSER.DAT"
"13:48:29.4380222","MsMpEng.exe","3220","RegQueryKey","HKU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:29.4380309","MsMpEng.exe","3220","RegOpenKey","HKCU","SUCCESS","Desired Access: Read"
"13:48:29.4380463","MsMpEng.exe","3220","RegCloseKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS",""
"13:48:29.4380623","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:29.4380958","MsMpEng.exe","3220","RegOpenKey","HKLM\SYSTEM\CurrentControlSet\Control\hivelist","REPARSE","Desired Access: Read"
"13:48:29.4381102","MsMpEng.exe","3220","RegOpenKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Desired Access: Read"
"13:48:29.4381346","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-21-4172013786-3171869251-2938521833-1000_Classes","BUFFER OVERFLOW","Length: 144"
"13:48:29.4381469","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-21-4172013786-3171869251-2938521833-1000_Classes","SUCCESS","Type: REG_SZ, Length: 166, Data: \Device\HarddiskVolume4\Users\hacker\AppData\Local\Microsoft\Windows\UsrClass.dat"
"13:48:29.4381741","MsMpEng.exe","3220","RegQueryKey","HKU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:29.4381919","MsMpEng.exe","3220","RegOpenKey","HKCU\Software\Classes","SUCCESS","Desired Access: Read"
"13:48:29.4382069","MsMpEng.exe","3220","RegCloseKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS",""
"13:48:29.4382166","MsMpEng.exe","3220","RegCloseKey","HKCU","SUCCESS",""
"13:48:29.4382257","MsMpEng.exe","3220","RegCloseKey","HKCU\Software\Classes","SUCCESS",""
"13:48:29.4382347","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:29.4382503","MsMpEng.exe","3220","RegOpenKey","HKLM\SYSTEM\CurrentControlSet\Control\hivelist","REPARSE","Desired Access: Read"
"13:48:29.4382596","MsMpEng.exe","3220","RegOpenKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Desired Access: Read"
"13:48:29.4382695","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-21-4172013786-3171869251-2938521833-1000","SUCCESS","Type: REG_SZ, Length: 98, Data: \Device\HarddiskVolume4\Users\hacker\NTUSER.DAT"
"13:48:29.4382872","MsMpEng.exe","3220","RegQueryKey","HKU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:29.4382945","MsMpEng.exe","3220","RegOpenKey","HKCU","SUCCESS","Desired Access: Read"
"13:48:29.4383198","MsMpEng.exe","3220","RegCloseKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS",""
"13:48:29.4383277","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:29.4383346","MsMpEng.exe","3220","RegOpenKey","HKLM\SYSTEM\CurrentControlSet\Control\hivelist","REPARSE","Desired Access: Read"
"13:48:29.4383447","MsMpEng.exe","3220","RegOpenKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS","Desired Access: Read"
"13:48:29.4383548","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-21-4172013786-3171869251-2938521833-1000_Classes","BUFFER OVERFLOW","Length: 144"
"13:48:29.4383752","MsMpEng.exe","3220","RegQueryValue","HKLM\System\CurrentControlSet\Control\hivelist\\REGISTRY\USER\S-1-5-21-4172013786-3171869251-2938521833-1000_Classes","SUCCESS","Type: REG_SZ, Length: 166, Data: \Device\HarddiskVolume4\Users\hacker\AppData\Local\Microsoft\Windows\UsrClass.dat"
"13:48:29.4383890","MsMpEng.exe","3220","RegQueryKey","HKU","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:29.4383971","MsMpEng.exe","3220","RegOpenKey","HKCU\Software\Classes","SUCCESS","Desired Access: Read"
"13:48:29.4384109","MsMpEng.exe","3220","RegCloseKey","HKLM\System\CurrentControlSet\Control\hivelist","SUCCESS",""
"13:48:29.4386914","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Open For Backup, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4387221","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:29.4388105","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4388383","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:29, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A"
"13:48:29.4388588","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 0, Length: 512, Priority: Normal"
"13:48:29.4388785","MsMpEng.exe","3220","QueryStandardInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","AllocationSize: 32’768, EndOfFile: 29’184, NumberOfLinks: 1, DeletePending: False, Directory: False"
"13:48:29.4388981","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 0, Length: 64, Priority: Normal"
"13:48:29.4389226","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 240, Length: 28, Priority: Normal"
"13:48:29.4389593","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 0, Length: 4’096, Priority: Normal"
"13:48:29.4391100","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4391363","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4392149","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4392459","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4393245","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4393624","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.4393707","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4394808","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","NOT A DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.4395580","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.4396404","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4396714","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4396818","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS",""
"13:48:29.4397540","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4397797","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS",""
"13:48:29.4398544","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4398806","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.4398880","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS",""
"13:48:29.4399695","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4399910","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4400003","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS",""
"13:48:29.4400858","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.4401564","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4401759","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4401852","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS",""
"13:48:29.4402553","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4402829","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS",""
"13:48:29.4403549","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4403779","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection\x64","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.4403944","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS",""
"13:48:29.4404705","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4404886","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4404980","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS",""
"13:48:29.4405911","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.4406625","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4407075","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4407170","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:29.4407913","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4408082","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:29.4408925","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4409181","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.4409251","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:29.4410074","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4410277","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4410369","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:29.4411078","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.4411734","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4412040","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4412133","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:29.4412818","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4413262","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:29.4414493","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4414900","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.4414985","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:29.4416395","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4416702","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4416816","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:29.4417666","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.4418488","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4418712","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4418815","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:29.4419572","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4419874","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:29.4420656","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4421027","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.4421105","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:29.4421916","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4422210","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4422309","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:29.4423462","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.4424217","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4424409","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4424597","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:29.4425385","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4425584","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:29.4426561","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4426833","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.4426902","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:29.4427782","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4427976","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4428074","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:29.4428972","MsMpEng.exe","3220","CreateFile","C:\Users","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.4429704","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4429902","MsMpEng.exe","3220","FileSystemControl","C:\Users","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4430117","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:29.4430900","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4431092","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:29.4431892","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4432175","MsMpEng.exe","3220","DeviceIoControl","C:\Users","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.4432247","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:29.4433011","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4433316","MsMpEng.exe","3220","FileSystemControl","C:\Users","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4433417","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:29.4434672","MsMpEng.exe","3220","CreateFile","C:\","SUCCESS","Desired Access: Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4435016","MsMpEng.exe","3220","QueryNameInformationFile","C:\","SUCCESS","Name: \"
"13:48:29.4435155","MsMpEng.exe","3220","QueryAttributeInformationVolume","C:\","SUCCESS","FileSystemAttributes: Case Preserved, Case Sensitive, Unicode, ACLs, Compression, Named Streams, EFS, Object IDs, Reparse Points, Sparse Files, Quotas, Transactions, 0x3c02e00, MaximumComponentNameLength: 255, FileSystemName: NTFS"
"13:48:29.4435238","MsMpEng.exe","3220","CloseFile","C:\","SUCCESS",""
"13:48:29.4436358","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4436556","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4437816","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4438142","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4439194","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4439374","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4440023","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4440340","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.4440409","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4441070","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","NOT A DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.4441649","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.4442194","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4442364","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4442442","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS",""
"13:48:29.4443027","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4443169","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS",""
"13:48:29.4443747","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4444101","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.4444162","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS",""
"13:48:29.4444785","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4444933","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4445005","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release","SUCCESS",""
"13:48:29.4445751","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.4446350","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4446533","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4446672","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS",""
"13:48:29.4447597","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4447857","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS",""
"13:48:29.4448509","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4448723","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection\x64","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.4448794","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS",""
"13:48:29.4449446","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4449703","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection\x64","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4449782","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64","SUCCESS",""
"13:48:29.4450798","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.4451434","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4451630","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4451714","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:29.4452350","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4452512","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:29.4453232","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4453476","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos\EDR-Introspection","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.4453535","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:29.4454176","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4454336","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos\EDR-Introspection","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4454502","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection","SUCCESS",""
"13:48:29.4455115","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.4455746","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4455930","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4456006","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:29.4456639","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4456791","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:29.4457418","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4457723","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source\repos","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.4457780","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:29.4458405","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4458564","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source\repos","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4458637","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos","SUCCESS",""
"13:48:29.4459357","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.4459958","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4460134","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4460209","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:29.4460878","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4461029","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:29.4461656","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4461963","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker\source","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.4462021","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:29.4462660","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4462829","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker\source","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4462908","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source","SUCCESS",""
"13:48:29.4463617","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.4464116","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4464570","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4464685","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:29.4465355","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4465714","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:29.4466367","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4466673","MsMpEng.exe","3220","DeviceIoControl","C:\Users\hacker","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.4466749","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:29.4467907","MsMpEng.exe","3220","CreateFile","C:\Users\hacker","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4468170","MsMpEng.exe","3220","FileSystemControl","C:\Users\hacker","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4468294","MsMpEng.exe","3220","CloseFile","C:\Users\hacker","SUCCESS",""
"13:48:29.4469257","MsMpEng.exe","3220","CreateFile","C:\Users","IS DIRECTORY","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a"
"13:48:29.4469910","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4470073","MsMpEng.exe","3220","FileSystemControl","C:\Users","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4470162","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:29.4470762","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4471002","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:29.4471616","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4471889","MsMpEng.exe","3220","DeviceIoControl","C:\Users","INVALID PARAMETER","Control: IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
"13:48:29.4471994","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:29.4473051","MsMpEng.exe","3220","CreateFile","C:\Users","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Disallow Exclusive, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4473225","MsMpEng.exe","3220","FileSystemControl","C:\Users","NOT REPARSE POINT","Control: FSCTL_GET_REPARSE_POINT"
"13:48:29.4473380","MsMpEng.exe","3220","CloseFile","C:\Users","SUCCESS",""
"13:48:29.4474035","MsMpEng.exe","3220","CreateFile","C:\","SUCCESS","Desired Access: Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Free Space Query, Attributes: n/a, ShareMode: None, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4474219","MsMpEng.exe","3220","QuerySizeInformationVolume","C:\","SUCCESS","TotalAllocationUnits: 20’646’655, AvailableAllocationUnits: 5’331’773, SectorsPerAllocationUnit: 8, BytesPerSector: 512"
"13:48:29.4474305","MsMpEng.exe","3220","CloseFile","C:\","SUCCESS",""
"13:48:29.4474715","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 0, Length: 29’184, Priority: Normal"
"13:48:29.4475075","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 25’088, Length: 4’096, Priority: Normal"
"13:48:29.4475411","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 0, Length: 29’184, Priority: Normal"
"13:48:29.4482383","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 24’576, Length: 4’096, Priority: Normal"
"13:48:29.4483058","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 1’024, Length: 14’336, Priority: Normal"
"13:48:29.4483436","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 15’360, Length: 10’752, Priority: Normal"
"13:48:29.4483876","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 28’672, Length: 512, Priority: Normal"
"13:48:29.4484475","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 8’192, Length: 4’096, Priority: Normal"
"13:48:29.4484648","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 4’096, Length: 4’096, Priority: Normal"
"13:48:29.4485488","MsMpEng.exe","3220","CreateFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe:Zone.Identifier","NAME NOT FOUND","Desired Access: Read Data/List Directory, Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Open For Backup, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:29.4486033","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 0, Length: 2, Priority: Normal"
"13:48:29.4486223","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 0, Length: 64, Priority: Normal"
"13:48:29.4486371","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 240, Length: 28, Priority: Normal"
"13:48:29.4486642","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 0, Length: 4’096, Priority: Normal"
"13:48:29.4487008","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 0, Length: 328, Priority: Normal"
"13:48:29.4487358","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 332, Length: 76, Priority: Normal"
"13:48:29.4487532","MsMpEng.exe","3220","ReadFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","Offset: 416, Length: 28’768, Priority: Normal"
"13:48:29.4490482","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4490700","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","CreationTime: 01.04.2024 09:26:07, LastAccessTime: 13.08.2025 20:52:27, LastWriteTime: 01.04.2024 09:26:07, ChangeTime: 12.08.2025 21:35:30, FileAttributes: D"
"13:48:29.4490780","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS",""
"13:48:29.4492289","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4492475","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","CreationTime: 01.04.2024 18:17:28, LastAccessTime: 13.10.2025 13:32:53, LastWriteTime: 12.08.2025 20:38:19, ChangeTime: 12.08.2025 20:38:19, FileAttributes: DNCI"
"13:48:29.4492556","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS",""
"13:48:29.4493469","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4493762","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2\{????????????????????????????????????}","SUCCESS","FileInformationClass: FileBothDirectoryInformation, Filter: {????????????????????????????????????}, 2: {127D0A1D-4EF2-11D1-8608-00C04FC295EE}"
"13:48:29.4495205","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:29.4497401","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4497692","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\CatRoot","SUCCESS","Information: DACL"
"13:48:29.4497777","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot","SUCCESS",""
"13:48:29.4499175","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:29.4500875","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4501106","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\catroot2","SUCCESS","Information: DACL"
"13:48:29.4501184","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:29.4502898","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2","SUCCESS","FileInformationClass: FileBothDirectoryInformation, 1: {F750E6C3-38EE-11D1-85E5-00C04FC295EE}"
"13:48:29.4503771","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:29.4504535","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4504736","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\CatRoot","SUCCESS","Information: DACL"
"13:48:29.4504810","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot","SUCCESS",""
"13:48:29.4505523","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:29.4506625","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4506801","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\catroot2","SUCCESS","Information: DACL"
"13:48:29.4506949","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:29.4508520","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2","NO MORE FILES","FileInformationClass: FileBothDirectoryInformation"
"13:48:29.4508675","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:29.4510084","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4510256","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","CreationTime: 01.04.2024 09:26:07, LastAccessTime: 13.08.2025 20:52:27, LastWriteTime: 01.04.2024 09:26:07, ChangeTime: 12.08.2025 21:35:30, FileAttributes: D"
"13:48:29.4510329","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS",""
"13:48:29.4511483","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4511842","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS","CreationTime: 01.04.2024 18:17:28, LastAccessTime: 13.10.2025 13:32:53, LastWriteTime: 12.08.2025 20:38:19, ChangeTime: 12.08.2025 20:38:19, FileAttributes: DNCI"
"13:48:29.4511991","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","SUCCESS",""
"13:48:29.4513072","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4513516","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2\{????????????????????????????????????}","SUCCESS","FileInformationClass: FileBothDirectoryInformation, Filter: {????????????????????????????????????}, 2: {127D0A1D-4EF2-11D1-8608-00C04FC295EE}"
"13:48:29.4515210","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:29.4516133","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4516322","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\CatRoot","SUCCESS","Information: DACL"
"13:48:29.4516396","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot","SUCCESS",""
"13:48:29.4517085","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:29.4518843","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4519027","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\catroot2","SUCCESS","Information: DACL"
"13:48:29.4519192","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:29.4520714","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2","SUCCESS","FileInformationClass: FileBothDirectoryInformation, 1: {F750E6C3-38EE-11D1-85E5-00C04FC295EE}"
"13:48:29.4521761","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:29.4522443","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\CatRoot","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4522603","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\CatRoot","SUCCESS","Information: DACL"
"13:48:29.4522679","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\CatRoot","SUCCESS",""
"13:48:29.4523699","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"13:48:29.4525379","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\catroot2","SUCCESS","Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:29.4525557","MsMpEng.exe","3220","QuerySecurityFile","C:\Windows\System32\catroot2","SUCCESS","Information: DACL"
"13:48:29.4525754","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:29.4527343","MsMpEng.exe","3220","QueryDirectory","C:\Windows\System32\catroot2","NO MORE FILES","FileInformationClass: FileBothDirectoryInformation"
"13:48:29.4527500","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\catroot2","SUCCESS",""
"13:48:29.4527908","MsMpEng.exe","3220","QueryBasicInformationFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS","CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:29, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A"
"13:48:29.4528084","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4528349","MsMpEng.exe","3220","CloseFile","C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe","SUCCESS",""
"13:48:29.4530007","MsMpEng.exe","3220","CreateFile","C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\998F15D801113A42F317A677646B63B6","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:29.4530448","MsMpEng.exe","3220","RegCloseKey","HKCU","SUCCESS",""
"13:48:29.4530555","MsMpEng.exe","3220","RegCloseKey","HKCU\Software\Classes","SUCCESS",""
"13:48:30.7986656","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: True, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:30.7986864","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:30.7987084","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:30.7987327","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:30.8104999","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\wldp.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.8105702","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\wldp.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.8105953","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\wldp.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.8106101","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\wldp.dll","SUCCESS",""
"13:48:30.8364951","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:30.8365181","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: True, Offset: 120, Length: 1, Fail Immediately: True"
"13:48:30.8365778","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 120, Length: 1"
"13:48:30.8365877","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:30.8366776","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:30.8366992","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:30.8369774","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:30.8370024","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:30.8391910","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:30.8392049","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: True, Offset: 120, Length: 1, Fail Immediately: True"
"13:48:30.8392298","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 120, Length: 1"
"13:48:30.8392358","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:30.8393632","MsMpEng.exe","3220","CreateFileMapping","C:\Windows\security\logs\scecomp.log","FILE LOCKED WITH ONLY READERS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE_READ"
"13:48:30.8393798","MsMpEng.exe","3220","QueryStandardInformationFile","C:\Windows\security\logs\scecomp.log","SUCCESS","AllocationSize: 240, EndOfFile: 236, NumberOfLinks: 1, DeletePending: False, Directory: False"
"13:48:30.8531755","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:30.8532743","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:30.8672188","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\scecli.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.8672668","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\scecli.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.8672772","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\scecli.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.8673189","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\scecli.dll","SUCCESS",""
"13:48:30.8715156","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:30.8715738","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
"13:48:30.8717361","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\scecli.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.8717791","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\scecli.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winჹ"
"13:48:30.8717881","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\scecli.dll","BUFFER OVERFLOW","CreationTime: 12.08.2025 20:16:23, LastAccessTime: 13.10.2025 13:48:30, LastWriteTime: 12.08.2025 20:16:23, ChangeTime: 30.09.2025 17:02:32, FileAttributes: A, AllocationSize: 184’320, EndOfFile: 364’544"
"13:48:30.8717990","MsMpEng.exe","3220","QueryInformationVolume","C:\Windows\System32\scecli.dll","BUFFER OVERFLOW","VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winჹ"
"13:48:30.8718043","MsMpEng.exe","3220","QueryAllInformationFile","C:\Windows\System32\scecli.dll","BUFFER OVERFLOW","CreationTime: 12.08.2025 20:16:23, LastAccessTime: 13.10.2025 13:48:30, LastWriteTime: 12.08.2025 20:16:23, ChangeTime: 30.09.2025 17:02:32, FileAttributes: A, AllocationSize: 184’320, EndOfFile: 364’544"
"13:48:30.8718241","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\scecli.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"13:48:30.8718338","MsMpEng.exe","3220","QueryIdInformation","C:\Windows\System32\scecli.dll","SUCCESS",""
"13:48:30.8718528","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\scecli.dll","SUCCESS",""
"13:48:30.9122873","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\grpconv","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:30.9124214","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\grpconv -o","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:30.9126245","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\grpconv","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:30.9127426","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\grpconv -o","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:30.9129335","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\grpconv","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:30.9132831","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\grpconv -o","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:30.9136280","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\grpconv","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:30.9152909","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\grpconv -o","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
"13:48:30.9187134","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\ntdll.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9187745","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ntdll.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9188134","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ntdll.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9188403","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\ntdll.dll","SUCCESS",""
"13:48:30.9189774","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\runonce.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9190202","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\runonce.exe","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9190308","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\runonce.exe","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9190395","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\runonce.exe","SUCCESS",""
"13:48:30.9214070","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\kernel32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9214644","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9214772","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9214860","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\kernel32.dll","SUCCESS",""
"13:48:30.9216683","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\KernelBase.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9216915","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\KernelBase.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9216993","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\KernelBase.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9217159","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\KernelBase.dll","SUCCESS",""
"13:48:30.9218138","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\advapi32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9218517","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\advapi32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9218601","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\advapi32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9218668","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\advapi32.dll","SUCCESS",""
"13:48:30.9230457","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\gdi32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9231075","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\gdi32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9231171","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\gdi32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9231256","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\gdi32.dll","SUCCESS",""
"13:48:30.9233180","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\msvcrt.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9233643","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcrt.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9233750","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcrt.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9233843","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\msvcrt.dll","SUCCESS",""
"13:48:30.9235187","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\win32u.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9235778","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\win32u.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9235899","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\win32u.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9236050","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\win32u.dll","SUCCESS",""
"13:48:30.9237107","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\sechost.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9237469","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\sechost.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9237553","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\sechost.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9237623","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\sechost.dll","SUCCESS",""
"13:48:30.9238637","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\ucrtbase.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9238888","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ucrtbase.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9238966","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ucrtbase.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9239129","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\ucrtbase.dll","SUCCESS",""
"13:48:30.9243044","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\rpcrt4.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9244790","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\rpcrt4.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9245040","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\rpcrt4.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9245221","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\rpcrt4.dll","SUCCESS",""
"13:48:30.9249078","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\shell32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9249660","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\shell32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9249795","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\shell32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9249880","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\shell32.dll","SUCCESS",""
"13:48:30.9252550","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\WinTypes.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9252866","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\WinTypes.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9252947","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\WinTypes.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9253022","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\WinTypes.dll","SUCCESS",""
"13:48:30.9255559","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\combase.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9256002","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\combase.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9256153","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\combase.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9256250","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\combase.dll","SUCCESS",""
"13:48:30.9257158","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\gdi32full.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9257437","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\gdi32full.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9257524","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\gdi32full.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9257592","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\gdi32full.dll","SUCCESS",""
"13:48:30.9258429","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\ole32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9258782","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ole32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9258870","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ole32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9258935","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\ole32.dll","SUCCESS",""
"13:48:30.9260707","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\msvcp_win.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9261238","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcp_win.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9261327","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcp_win.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9261395","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\msvcp_win.dll","SUCCESS",""
"13:48:30.9262770","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\shlwapi.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9263138","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\shlwapi.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9263218","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\shlwapi.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9263296","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\shlwapi.dll","SUCCESS",""
"13:48:30.9295898","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\user32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9296506","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\user32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9296639","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\user32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9296740","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\user32.dll","SUCCESS",""
"13:48:30.9298719","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\SHCore.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9299131","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\SHCore.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9299219","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\SHCore.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9299292","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\SHCore.dll","SUCCESS",""
"13:48:30.9300912","MsMpEng.exe","3220","CreateFile","C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6725_none_3e085828e334708b\comctl32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9301307","MsMpEng.exe","3220","FileSystemControl","C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6725_none_3e085828e334708b\comctl32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9301390","MsMpEng.exe","3220","FileSystemControl","C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6725_none_3e085828e334708b\comctl32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9301470","MsMpEng.exe","3220","CloseFile","C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6725_none_3e085828e334708b\comctl32.dll","SUCCESS",""
"13:48:30.9304456","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\imm32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9304790","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\imm32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9304999","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\imm32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9305080","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\imm32.dll","SUCCESS",""
"13:48:30.9344746","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\windows.storage.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9344992","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\windows.storage.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9345084","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\windows.storage.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9345232","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\windows.storage.dll","SUCCESS",""
"13:48:30.9459680","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\kernel.appcore.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9460075","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel.appcore.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9460230","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel.appcore.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9460340","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\kernel.appcore.dll","SUCCESS",""
"13:48:30.9515084","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\bcryptprimitives.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9515390","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\bcryptprimitives.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9515575","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\bcryptprimitives.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9515991","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\bcryptprimitives.dll","SUCCESS",""
"13:48:30.9527489","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\uxtheme.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9527930","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\uxtheme.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9528052","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\uxtheme.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9528149","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\uxtheme.dll","SUCCESS",""
"13:48:30.9568145","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\oleaut32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9568765","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\oleaut32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9568955","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\oleaut32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9569051","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\oleaut32.dll","SUCCESS",""
"13:48:30.9598735","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\cfgmgr32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9599440","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\cfgmgr32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9599552","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\cfgmgr32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9599639","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\cfgmgr32.dll","SUCCESS",""
"13:48:30.9625887","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\propsys.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9626290","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\propsys.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9626381","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\propsys.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9626463","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\propsys.dll","SUCCESS",""
"13:48:30.9635167","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\clbcatq.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9635548","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\clbcatq.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9635773","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\clbcatq.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9635920","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\clbcatq.dll","SUCCESS",""
"13:48:30.9734589","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\profapi.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:30.9735224","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\profapi.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:30.9735371","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\profapi.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:30.9735467","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\profapi.dll","SUCCESS",""
"13:48:31.0005170","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\Windows.StateRepositoryPS.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0005526","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\Windows.StateRepositoryPS.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0005761","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\Windows.StateRepositoryPS.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0005863","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\Windows.StateRepositoryPS.dll","SUCCESS",""
"13:48:31.0150668","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\edputil.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0151125","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\edputil.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0151382","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\edputil.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0151492","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\edputil.dll","SUCCESS",""
"13:48:31.0161480","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\urlmon.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0161966","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\urlmon.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0162073","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\urlmon.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0162260","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\urlmon.dll","SUCCESS",""
"13:48:31.0167079","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\iertutil.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0167943","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\iertutil.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0168092","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\iertutil.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0168187","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\iertutil.dll","SUCCESS",""
"13:48:31.0176848","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\srvcli.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0177147","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\srvcli.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0177612","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\srvcli.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0177710","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\srvcli.dll","SUCCESS",""
"13:48:31.0180016","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\netutils.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0180339","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\netutils.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0180512","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\netutils.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0180606","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\netutils.dll","SUCCESS",""
"13:48:31.0258140","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\sspicli.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0258499","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\sspicli.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0258604","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\sspicli.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0258785","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\sspicli.dll","SUCCESS",""
"13:48:31.0324640","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\virtdisk.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0324934","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\virtdisk.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0325025","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\virtdisk.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0325204","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\virtdisk.dll","SUCCESS",""
"13:48:31.0356275","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\wldp.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0356568","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\wldp.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0356750","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\wldp.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0356905","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\wldp.dll","SUCCESS",""
"13:48:31.0468194","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\grpconv.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0469131","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\grpconv.exe","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0469345","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\grpconv.exe","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0469449","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\grpconv.exe","SUCCESS",""
"13:48:31.0471220","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\ntdll.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0471638","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ntdll.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0471769","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ntdll.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0472014","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\ntdll.dll","SUCCESS",""
"13:48:31.0479763","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\kernel32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0480070","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0480273","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0480358","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\kernel32.dll","SUCCESS",""
"13:48:31.0481301","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\KernelBase.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0481611","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\KernelBase.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0481691","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\KernelBase.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0481846","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\KernelBase.dll","SUCCESS",""
"13:48:31.0492913","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\advapi32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0493275","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\advapi32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0493484","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\advapi32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0493596","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\advapi32.dll","SUCCESS",""
"13:48:31.0494995","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\msvcrt.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0495432","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcrt.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0495535","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcrt.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0495754","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\msvcrt.dll","SUCCESS",""
"13:48:31.0497236","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\sechost.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0497616","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\sechost.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0497738","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\sechost.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0497818","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\sechost.dll","SUCCESS",""
"13:48:31.0499723","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\rpcrt4.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0500066","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\rpcrt4.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0500155","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\rpcrt4.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0500232","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\rpcrt4.dll","SUCCESS",""
"13:48:31.0503096","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\user32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0503512","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\user32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0503634","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\user32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0503714","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\user32.dll","SUCCESS",""
"13:48:31.0505378","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\win32u.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0506304","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\win32u.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0506530","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\win32u.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0506667","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\win32u.dll","SUCCESS",""
"13:48:31.0508242","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\gdi32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0509204","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\gdi32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0509350","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\gdi32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0509436","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\gdi32.dll","SUCCESS",""
"13:48:31.0515799","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\gdi32full.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0516930","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\gdi32full.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0517046","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\gdi32full.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0517132","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\gdi32full.dll","SUCCESS",""
"13:48:31.0524939","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\msvcp_win.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0529073","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcp_win.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0529444","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\msvcp_win.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0529566","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\msvcp_win.dll","SUCCESS",""
"13:48:31.0532928","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\ucrtbase.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0533323","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ucrtbase.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0533408","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ucrtbase.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0533478","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\ucrtbase.dll","SUCCESS",""
"13:48:31.0538887","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\shell32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0539255","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\shell32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0539344","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\shell32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0539414","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\shell32.dll","SUCCESS",""
"13:48:31.0541248","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\WinTypes.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0541645","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\WinTypes.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0541767","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\WinTypes.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0541849","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\WinTypes.dll","SUCCESS",""
"13:48:31.0543637","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\imm32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0543925","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\imm32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0544105","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\imm32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0544201","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\imm32.dll","SUCCESS",""
"13:48:31.0545098","MsMpEng.exe","3220","CreateFile","C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6725_none_3e085828e334708b\comctl32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0545478","MsMpEng.exe","3220","FileSystemControl","C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6725_none_3e085828e334708b\comctl32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0545560","MsMpEng.exe","3220","FileSystemControl","C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6725_none_3e085828e334708b\comctl32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0545737","MsMpEng.exe","3220","CloseFile","C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.6725_none_3e085828e334708b\comctl32.dll","SUCCESS",""
"13:48:31.0547423","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\combase.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0547810","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\combase.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0547903","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\combase.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0547974","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\combase.dll","SUCCESS",""
"13:48:31.0549277","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\shlwapi.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0549654","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\shlwapi.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0549738","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\shlwapi.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0549864","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\shlwapi.dll","SUCCESS",""
"13:48:31.0592625","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\kernel.appcore.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0592922","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel.appcore.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0593032","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\kernel.appcore.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0593243","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\kernel.appcore.dll","SUCCESS",""
"13:48:31.0595797","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\bcryptprimitives.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0596176","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\bcryptprimitives.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0596331","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\bcryptprimitives.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0596423","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\bcryptprimitives.dll","SUCCESS",""
"13:48:31.0605226","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\uxtheme.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0605497","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\uxtheme.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0605593","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\uxtheme.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0605818","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\uxtheme.dll","SUCCESS",""
"13:48:31.0624362","MsMpEng.exe","3220","CreateFile","C:\Windows\System32\ole32.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Non-Directory File, Open For Backup, Open Reparse Point, Open Requiring Oplock, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"13:48:31.0624710","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ole32.dll","OPLOCK HANDLE CLOSED","Control: FSCTL_REQUEST_OPLOCK"
"13:48:31.0624886","MsMpEng.exe","3220","FileSystemControl","C:\Windows\System32\ole32.dll","SUCCESS","Control: 0x902eb (Device:0x9 Function:186 Method: 3)"
"13:48:31.0624999","MsMpEng.exe","3220","CloseFile","C:\Windows\System32\ole32.dll","SUCCESS",""
"13:48:31.4224387","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:31.4226146","MsMpEng.exe","3220","RegOpenKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels","NAME NOT FOUND","Desired Access: Query Value"
"13:48:31.4277326","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:31.4279063","MsMpEng.exe","3220","RegOpenKey","HKLM\SOFTWARE\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction","SUCCESS","Desired Access: Read/Write"
"13:48:31.4280570","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:31.4281314","MsMpEng.exe","3220","RegOpenKey","HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction","NAME NOT FOUND","Desired Access: Read"
"13:48:31.4282197","MsMpEng.exe","3220","RegEnumValue","HKLM\SOFTWARE\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction","NO MORE ENTRIES","Index: 0, Length: 220"
"13:48:31.4282891","MsMpEng.exe","3220","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction","SUCCESS",""
"13:48:31.4432988","MsMpEng.exe","3220","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"13:48:31.4433787","MsMpEng.exe","3220","RegOpenKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels","NAME NOT FOUND","Desired Access: Query Value"
"13:48:31.5405742","MsMpEng.exe","3220","LockFile","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True"
"13:48:31.5406424","MsMpEng.exe","3220","UnlockFileSingle","C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm","SUCCESS","Offset: 124, Length: 1"
Reference in New Issue View Git Blame Copy Permalink