mirror of
https://github.com/evilele/EDR-Introspection
synced 2026-06-09 08:11:09 +00:00
cailllev
2796 lines
230 KiB
Plaintext
2796 lines
230 KiB
Plaintext
[*] Listening to {72248411-7166-4feb-a386-34d8f35bb637}... Press Ctrl+C to exit
|
|
PID: 3012 : HookTask
|
|
message: Hooked NtOpenFile
|
|
timestamp: 2025-12-10 12:28:24.424673500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: Hooked NtOpenProcess
|
|
timestamp: 2025-12-10 12:28:24.424707400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: Hooked NtWriteVirtualMemory
|
|
timestamp: 2025-12-10 12:28:24.424721700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: Hooked NtSuspendProcess
|
|
timestamp: 2025-12-10 12:28:24.424735100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: Hooked NtResumeProcess
|
|
timestamp: 2025-12-10 12:28:24.424748400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: Hooked NtClose
|
|
timestamp: 2025-12-10 12:28:24.424761100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: Hooked NtTerminateProcess
|
|
timestamp: 2025-12-10 12:28:24.424774000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: ++ NTDLL-HOOKER STARTED ++
|
|
timestamp: 2025-12-10 12:28:24.461159000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:24.739395900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\Cyvera\LocalSystem\OsPersistence\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:24.739464600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:24.739551700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\Cyvera\LocalSystem\OsPersistence\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:24.739595300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:25.175663700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\Cyvera\LocalSystem\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:25.175742000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:25.175832400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\Cyvera\LocalSystem\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:25.175876600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\Cyvera\LocalSystem\Ecl\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:25.220509800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Windows\system32\OnDemandConnRouteHelper.dll with DesiredAccess=0x100021:FILE_READ_DATA|FILE_EXECUTE|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:25.309606400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Windows\system32\OnDemandConnRouteHelper.dll with DesiredAccess=0x100021:FILE_READ_DATA|FILE_EXECUTE|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:25.316937900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Windows\system32\OnDemandConnRouteHelper.dll with DesiredAccess=0x100021:FILE_READ_DATA|FILE_EXECUTE|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:25.321115100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:32.690708000Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:32.690763700Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\notepad.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:32.692643400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3 with DesiredAccess=0x100000:SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.692740400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.692785400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.692789300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.692860100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.692923600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\notepad.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:32.693012100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:32.693608900Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:32.693630100Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.693782500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.693788300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.693850600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.693898400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\notepad.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:32.693962600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\notepad.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:32.695779400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3 with DesiredAccess=0x100000:SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.695828400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.695866200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.695869900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.695922200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.695968300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\notepad.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:32.696028600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.696100200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.696144300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.696189200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\AppData\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.696235400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\AppData\Local\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.696277400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.696327600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.696366600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.696404100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\AppData\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.696442300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\AppData\Local\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.696479600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x80000000:
|
|
timestamp: 2025-12-10 12:28:32.696625400Z
|
|
targetpid: 6408
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:32.696641900Z
|
|
targetpid: 6408
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x1000:PROCESS_QUERY_LIMITED_INFORMATION
|
|
timestamp: 2025-12-10 12:28:32.755777600Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:32.755824300Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Windows with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.755886300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files\ with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.756036000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files (x86)\ with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.756104000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\ with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.756180100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.756252200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.756310000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.756361800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files (x86) with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.756412800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.756464900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files\Common Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.756516100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files (x86)\Common Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.756578200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files\Common Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.756634500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Users with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.756687900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3 with DesiredAccess=0x100000:SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.758366800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\9b9cdc69c1c24e2b.automaticDestinations-ms with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:32.758438800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x1000:PROCESS_QUERY_LIMITED_INFORMATION
|
|
timestamp: 2025-12-10 12:28:32.759115700Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:32.759152200Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Windows with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.759293400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files\ with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.759487400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files (x86)\ with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.759565100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\ with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.759629100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.760241100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.760317000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.760374100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files (x86) with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.760436400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.760495200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files\Common Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.760552600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files (x86)\Common Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.760608300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files\Common Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.760664300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Users with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.760720100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3 with DesiredAccess=0x100000:SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.762754500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:32.762825200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x1000:PROCESS_QUERY_LIMITED_INFORMATION
|
|
timestamp: 2025-12-10 12:28:32.809561300Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:32.809615000Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Windows with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.809680600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files\ with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.809805300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files (x86)\ with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.809871800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\ with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.809935200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.809996800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.810050800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.810103300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files (x86) with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.810154200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.810206400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files\Common Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.810257200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files (x86)\Common Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.810311800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files\Common Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.810366400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Users with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.810419600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3 with DesiredAccess=0x100000:SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.812046900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:32.812129900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:32.827014700Z
|
|
targetpid: 6408
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:32.827043600Z
|
|
targetpid: 6408
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.827096100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.827101700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.827176600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.827231600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\oleacc.dll with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:32.827307800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x1000:PROCESS_QUERY_LIMITED_INFORMATION
|
|
timestamp: 2025-12-10 12:28:32.942562500Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:32.943197600Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Windows with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.943267800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files\ with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.943396000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files (x86)\ with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.943465600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\ with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.943529200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.943590100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.943643200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.943755000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files (x86) with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.943819700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.943872400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files\Common Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.943942000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files (x86)\Common Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.944071000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files\Common Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.944199400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Users with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.944288700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3 with DesiredAccess=0x100000:SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.946270200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:32.946335600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:32.985328600Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:32.985355100Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.985466300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.985473500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.985539900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.985593400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\tquery.dll with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:32.985670100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:32.996986700Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:32.997014000Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.997117400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.997123700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.997188300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:32.997240900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\cryptdll.dll with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:32.997322800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:33.040593900Z
|
|
targetpid: 4644
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:33.040624200Z
|
|
targetpid: 4644
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:33.040843500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:33.040850800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:33.040925500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\SearchProtocolHost.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:33.040981300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\SearchProtocolHost.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:33.042977000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3 with DesiredAccess=0x100000:SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:33.043049400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:33.043086400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:33.043090400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:33.043150800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\SearchProtocolHost.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:33.043203100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:33.043312100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:33.043358500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:33.043411200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:33.043452000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x80000000:
|
|
timestamp: 2025-12-10 12:28:33.043623100Z
|
|
targetpid: 4080
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:33.043643800Z
|
|
targetpid: 4080
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:33.083181700Z
|
|
targetpid: 4080
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:33.083210900Z
|
|
targetpid: 4080
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:33.083367100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:33.083374500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:33.083450100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:33.083503600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\tquery.dll with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:33.083580100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:33.088473800Z
|
|
targetpid: 4080
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:33.088501800Z
|
|
targetpid: 4080
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:33.088610100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:33.088616400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:33.088680200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:33.088732500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\cryptdll.dll with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:33.088834200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:33.123143600Z
|
|
targetpid: 4080
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:33.123169200Z
|
|
targetpid: 4080
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:33.123289800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:33.123296300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:33.123363200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:33.123414300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\mssph.dll with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:33.123488900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:35.773061400Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:35.773094000Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:35.773154000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:35.773160800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:35.773250700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:35.773306100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\twext.dll with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:35.773380100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:35.798593400Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:35.798620300Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:35.798730800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:35.798737300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:35.798800800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:35.798855200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\shacct.dll with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:35.798925100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:35.810667800Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:35.810696800Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:35.810768900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:35.810775400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Program Files\Palo Alto Networks\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:35.810832800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Program Files\Palo Alto Networks\Traps\cxshell-8.7.0.7735.dll with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:35.810893000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:35.820433300Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:35.820460000Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:35.820555800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:35.820561700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Program Files\Palo Alto Networks\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:35.820600900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Program Files\Palo Alto Networks\Traps\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:35.820654500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Program Files\Palo Alto Networks\Traps\winutils.dll with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:35.820705700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:35.930748900Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:35.930776500Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:35.930834400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:35.930840900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:35.930929200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:35.930987900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\zipfldr.dll with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:35.931064100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:35.964292100Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:35.964319600Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:35.964388700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:35.964395500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:35.964477600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:35.964534000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\sendmail.dll with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:35.964604800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:35.993377300Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:35.993404000Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:35.993481000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:35.993487700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:35.993571000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:35.993625700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\mydocs.dll with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:35.993691100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:36.045393300Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:36.045424400Z
|
|
targetpid: 6712
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:36.045486700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:36.045493000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:36.045579800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\PlayToDevice.dll with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:36.045638400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:52.308359200Z
|
|
targetpid: 8860
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:52.308396700Z
|
|
targetpid: 8860
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\helpers\KDU\kdu.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:52.308549500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3 with DesiredAccess=0x100000:SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.308645500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.308701700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.308707200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.308793300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.308860500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.308925300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\helpers\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.308991900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\helpers\KDU\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.309056000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\helpers\KDU\kdu.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:52.309119100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:52.309997600Z
|
|
targetpid: 8860
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:52.310027700Z
|
|
targetpid: 8860
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.310227800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.310234900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.310318200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.310382000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.310443500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\helpers\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.310508700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\helpers\KDU\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.310569800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\helpers\KDU\kdu.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:52.310629700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\helpers\KDU\kdu.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:52.313393400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3 with DesiredAccess=0x100000:SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.313476300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.313522600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.313527600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.313602800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.313663300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.313725500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\helpers\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.313787600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\helpers\KDU\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.313846900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\helpers\KDU\kdu.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:52.313908000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.314007000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.314071100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.314128200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\AppData\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.314185000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\AppData\Local\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.314245000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.314319500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.314376700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.314433400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\AppData\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.314489400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\AppData\Local\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.314546000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x80000000:
|
|
timestamp: 2025-12-10 12:28:52.314770900Z
|
|
targetpid: 9200
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:52.314792500Z
|
|
targetpid: 9200
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:52.364358100Z
|
|
targetpid: 9200
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:52.364386500Z
|
|
targetpid: 9200
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.364432700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.364438000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.364503800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.364551700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\msdelta.dll with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:52.364617200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:52.433696000Z
|
|
targetpid: 9200
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:52.433730300Z
|
|
targetpid: 9200
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.433787600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.433793200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.433866200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.433910600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.433951200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\helpers\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.433994200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\helpers\KDU\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.434035000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\helpers\KDU\drv64.dll with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:52.434076700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x1000:PROCESS_QUERY_LIMITED_INFORMATION
|
|
timestamp: 2025-12-10 12:28:52.515812800Z
|
|
targetpid: 9200
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:52.515967500Z
|
|
targetpid: 9200
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Windows with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.516037200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files\ with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.516186000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files (x86)\ with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.516276500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\ with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.516343300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.516408100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.516461500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.516549400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files (x86) with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.516607600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.516661100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files\Common Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.516712500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files (x86)\Common Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.516767500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files\Common Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.516823000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Users with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.516876500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3 with DesiredAccess=0x100000:SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.518487700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\NeacSafe64.sys with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:52.518545600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x1000:PROCESS_QUERY_LIMITED_INFORMATION
|
|
timestamp: 2025-12-10 12:28:52.647552000Z
|
|
targetpid: 9200
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:52.647584700Z
|
|
targetpid: 9200
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Windows with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.647642000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files\ with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.647765700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files (x86)\ with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.647835000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\ with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.647921300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.647996600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.648059700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.648124800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files (x86) with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.648183900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.648243400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files\Common Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.648299600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files (x86)\Common Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.648358600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Program Files\Common Files with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.648421100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Users with DesiredAccess=0x120000:READ_CONTROL|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.648477900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3 with DesiredAccess=0x100000:SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.650148800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\drivers\NeacSafe64.sys with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:52.650217600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:52.651249100Z
|
|
targetpid: 9200
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:52.651271500Z
|
|
targetpid: 9200
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\runonce.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:52.651313900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3 with DesiredAccess=0x100000:SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.651372000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.651404700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.651408100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.651460700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.651503300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\runonce.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:52.651803100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:52.652498900Z
|
|
targetpid: 9200
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:52.652519400Z
|
|
targetpid: 9200
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.652633100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.652638000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.652694400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.652737600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\runonce.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:52.652862400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\runonce.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:52.654973900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3 with DesiredAccess=0x100000:SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.655018100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.655045700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.655048800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.655093700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.655132900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\runonce.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:52.655183900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.655245600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.655285000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.655323600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\AppData\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.655362100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\AppData\Local\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.655398800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.655446500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.655494500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.655531500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\AppData\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.655634300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\AppData\Local\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.655765100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x80000000:
|
|
timestamp: 2025-12-10 12:28:52.656019800Z
|
|
targetpid: 4032
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:52.656035800Z
|
|
targetpid: 4032
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.791731700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\Cyvera\LocalSystem\OsPersistence\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.791797500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.791880100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\Cyvera\LocalSystem\OsPersistence\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.791932300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.798774400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\Cyvera\LocalSystem\OsPersistence\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.798832100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.798904100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\Cyvera\LocalSystem\OsPersistence\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:52.798940800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:53.243943400Z
|
|
targetpid: 4032
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:53.243971800Z
|
|
targetpid: 4032
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\grpconv.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:53.244026400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3 with DesiredAccess=0x100000:SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.244114100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.244162600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.244167800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.244241600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.244295900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\grpconv.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:53.244353500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:53.244935000Z
|
|
targetpid: 4032
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:53.244960000Z
|
|
targetpid: 4032
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.245110800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.245116200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.245181100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.245228600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\grpconv.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:53.245287900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\grpconv.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:53.247022800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3 with DesiredAccess=0x100000:SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.247089700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.247124000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.247127600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.247186400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.247231900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\grpconv.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:53.247277100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.247351400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.247399200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.247441700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\AppData\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.247481600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\AppData\Local\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.247519500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.247566100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.247601200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.247634900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\AppData\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.247673900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\AppData\Local\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.247715900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x80000000:
|
|
timestamp: 2025-12-10 12:28:53.247860200Z
|
|
targetpid: 9344
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:53.247874800Z
|
|
targetpid: 9344
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.302727600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\Cyvera\LocalSystem\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.302798600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.302889600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\Cyvera\LocalSystem\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.302933500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.435372400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\Cyvera\LocalSystem\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.435447100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.435555000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\Cyvera\LocalSystem\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.435597800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\Cyvera\LocalSystem\Ecl\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.486844900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\ProgramData\Cyvera\LocalSystem\Ecl\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.582092800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Windows\system32\OnDemandConnRouteHelper.dll with DesiredAccess=0x100021:FILE_READ_DATA|FILE_EXECUTE|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.619090400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Windows\system32\DRIVERS\NeacSafe64.sys with DesiredAccess=0x100080:FILE_READ_ATTRIBUTES|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.708164800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Windows\system32\DRIVERS\NeacSafe64.sys with DesiredAccess=0x100080:FILE_READ_ATTRIBUTES|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.708367500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Windows\system32\DRIVERS\NeacSafe64.sys with DesiredAccess=0x100080:FILE_READ_ATTRIBUTES|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.708405400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Windows\system32\DRIVERS with DesiredAccess=0x100080:FILE_READ_ATTRIBUTES|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.708471000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Windows\system32\DRIVERS with DesiredAccess=0x100080:FILE_READ_ATTRIBUTES|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.708528000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Windows\system32\DRIVERS with DesiredAccess=0x100080:FILE_READ_ATTRIBUTES|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.708555800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Windows\system32 with DesiredAccess=0x100080:FILE_READ_ATTRIBUTES|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.708619100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Windows\system32 with DesiredAccess=0x100080:FILE_READ_ATTRIBUTES|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.708681000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Windows\system32 with DesiredAccess=0x100080:FILE_READ_ATTRIBUTES|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.708709100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Windows with DesiredAccess=0x100080:FILE_READ_ATTRIBUTES|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.708775100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Windows with DesiredAccess=0x100080:FILE_READ_ATTRIBUTES|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.708823800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Windows with DesiredAccess=0x100080:FILE_READ_ATTRIBUTES|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.708849800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C: with DesiredAccess=0x100080:FILE_READ_ATTRIBUTES|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.708921400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C: with DesiredAccess=0x100080:FILE_READ_ATTRIBUTES|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.709031200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.823063600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.823074200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.823131100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.823195600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\dllhost.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:53.823267600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\dllhost.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:53.825195700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3 with DesiredAccess=0x100000:SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.825245300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.825279200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.825283600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.825337900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.825389000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\dllhost.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:53.825454400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.825533900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.825584200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.825634300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\AppData\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.825685000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\AppData\Local\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.825734200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.825791800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.825837900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.825882500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\AppData\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.825931600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\AppData\Local\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.825975600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x80000000:
|
|
timestamp: 2025-12-10 12:28:53.826140300Z
|
|
targetpid: 5772
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:53.826158500Z
|
|
targetpid: 5772
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Windows\system32\OnDemandConnRouteHelper.dll with DesiredAccess=0x100021:FILE_READ_DATA|FILE_EXECUTE|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.898132800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:53.993079500Z
|
|
targetpid: 9200
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:53.993111600Z
|
|
targetpid: 9200
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\x64\Release\EDRi.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:53.993158700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3 with DesiredAccess=0x100000:SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.993221200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.993257800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.993261800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.993321800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.993365000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.993406400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\x64\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.993451600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\x64\Release\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.993491900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\x64\Release\EDRi.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:53.993533200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:53.994170500Z
|
|
targetpid: 9200
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:53.994195800Z
|
|
targetpid: 9200
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.994345800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.994352100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.994427700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.994477300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.994522800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\x64\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.994573000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\x64\Release\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.994617400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\x64\Release\EDRi.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:53.994662600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\x64\Release\EDRi.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:53.996566000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3 with DesiredAccess=0x100000:SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.996624600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.996660400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.996664100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.996721800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.996766100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.996809100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\x64\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.996857100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\x64\Release\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.996909200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Users\admin\Desktop\EDR-Introspection\x64\Release\EDRi.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:53.996956700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.997032100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.997080200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.997127600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\AppData\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.997170000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\AppData\Local\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.997215200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.997272300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.997318700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.997361700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\AppData\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.997402100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Users\admin\AppData\Local\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:53.997441200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x80000000:
|
|
timestamp: 2025-12-10 12:28:53.997602500Z
|
|
targetpid: 3784
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:53.997620000Z
|
|
targetpid: 3784
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.012408800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.012420900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.012485900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.012535600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\svchost.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:54.012604100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\svchost.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:54.014606100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3 with DesiredAccess=0x100000:SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.014649500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.014679500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.014682900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.014737800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.014791400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\svchost.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:54.014860500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.014936500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.014977500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.015023500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile C:\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.015058800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x80000000:
|
|
timestamp: 2025-12-10 12:28:54.015204300Z
|
|
targetpid: 9752
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:54.015220500Z
|
|
targetpid: 9752
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \??\C:\Windows\system32\OnDemandConnRouteHelper.dll with DesiredAccess=0x100021:FILE_READ_DATA|FILE_EXECUTE|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.017696000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:54.059133900Z
|
|
targetpid: 5772
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:54.059162400Z
|
|
targetpid: 5772
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.059217100Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.059222600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.059296900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\thumbcache.dll with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:54.059350200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:54.071982400Z
|
|
targetpid: 9752
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:54.072008800Z
|
|
targetpid: 9752
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.072108300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.072114900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.072179500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\ntnativeapi.dll with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:54.072231700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:54.084273200Z
|
|
targetpid: 9752
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:54.084305700Z
|
|
targetpid: 9752
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.084404200Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.084410600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.084474900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.084527800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\cyvera.dll with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:54.084596300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:54.089109600Z
|
|
targetpid: 9752
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:54.089138300Z
|
|
targetpid: 9752
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.089226900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.089232000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.089323800Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.089371900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\cyvrtrap.dll with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:54.089433600Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:54.139046600Z
|
|
targetpid: 9752
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:54.139077900Z
|
|
targetpid: 9752
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\WerFaultSecure.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:54.139114900Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3 with DesiredAccess=0x100000:SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.139186300Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.139225400Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.139229500Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\ with DesiredAccess=0x100001:FILE_READ_DATA|SYNCHRONIZE
|
|
timestamp: 2025-12-10 12:28:54.139297000Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenFile \Device\HarddiskVolume3\Windows\System32\WerFaultSecure.exe with DesiredAccess=0x80:FILE_READ_ATTRIBUTES
|
|
timestamp: 2025-12-10 12:28:54.139351700Z
|
|
targetpid: 3012
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtOpenProcess with 0x400:PROCESS_QUERY_INFORMATION
|
|
timestamp: 2025-12-10 12:28:54.139678200Z
|
|
targetpid: 9752
|
|
--------------------------
|
|
PID: 3012 : HookTask
|
|
message: NtClose process
|
|
timestamp: 2025-12-10 12:28:54.139701700Z
|
|
targetpid: 9752
|