evilele-EDR-Introspection/docs/LoadLibrary-Tests/CMD-LoadLibrary-ProcMonLog.CSV at master

admin/evilele-EDR-Introspection

Fork 0

mirror of https://github.com/evilele/EDR-Introspection synced 2026-06-09 08:11:09 +00:00

Files

T

cailllev 85314ffa31 move files

2025-10-20 19:09:19 +02:00

9.3 KiB

Raw Permalink Blame History

1	Time of Day	Process Name	PID	Operation	Path	Result	Detail
2	14:01:36.8584126	cmd.exe	5948	Thread Create		SUCCESS	Thread ID: 8164
3	14:01:36.8591775	cmd.exe	5948	CreateFile	C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll	SUCCESS	Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened
4	14:01:36.8591999	cmd.exe	5948	QueryBasicInformationFile	C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll	SUCCESS	CreationTime: 10.10.2025 15:34:53, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:45:59, ChangeTime: 13.10.2025 11:45:59, FileAttributes: A
5	14:01:36.8592073	cmd.exe	5948	CloseFile	C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll	SUCCESS
6	14:01:36.8593113	cmd.exe	5948	CreateFile	C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll	SUCCESS	Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened
7	14:01:36.8593775	cmd.exe	5948	QueryEAFile	C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll	SUCCESS
8	14:01:36.8596226	cmd.exe	5948	CreateFileMapping	C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll	FILE LOCKED WITH ONLY READERS	SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE\|PAGE_NOCACHE
9	14:01:36.8597146	cmd.exe	5948	CreateFileMapping	C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll	SUCCESS	SyncType: SyncTypeOther
10	14:01:36.8598060	cmd.exe	5948	Load Image	C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll	SUCCESS	Image Base: 0x7ff8d84d0000, Image Size: 0x41000
11	14:01:36.8598747	cmd.exe	5948	RegOpenKey	HKLM\Software\Policies\Microsoft\MUI\Settings	NAME NOT FOUND	Desired Access: Read
12	14:01:36.8598971	cmd.exe	5948	RegOpenKey	HKCU	SUCCESS	Desired Access: Maximum Allowed, Granted Access: All Access
13	14:01:36.8599207	cmd.exe	5948	RegOpenKey	HKCU\Software\Policies\Microsoft\Control Panel\Desktop	NAME NOT FOUND	Desired Access: Read
14	14:01:36.8599326	cmd.exe	5948	RegOpenKey	HKCU\Control Panel\Desktop	SUCCESS	Desired Access: Read
15	14:01:36.8599426	cmd.exe	5948	RegQueryValue	HKCU\Control Panel\Desktop\PreferredUILanguages	BUFFER OVERFLOW	Length: 12
16	14:01:36.8599556	cmd.exe	5948	RegQueryValue	HKCU\Control Panel\Desktop\PreferredUILanguages	SUCCESS	Type: REG_MULTI_SZ, Length: 14, Data: en-GB
17	14:01:36.8599718	cmd.exe	5948	RegCloseKey	HKCU\Control Panel\Desktop	SUCCESS
18	14:01:36.8599790	cmd.exe	5948	RegCloseKey	HKCU	SUCCESS
19	14:01:36.8599885	cmd.exe	5948	RegOpenKey	HKLM\Software\Policies\Microsoft\MUI\Settings	NAME NOT FOUND	Desired Access: Read
20	14:01:36.8600008	cmd.exe	5948	RegOpenKey	HKCU	SUCCESS	Desired Access: Maximum Allowed, Granted Access: All Access
21	14:01:36.8600100	cmd.exe	5948	RegOpenKey	HKCU\Software\Policies\Microsoft\Control Panel\Desktop	NAME NOT FOUND	Desired Access: Read
22	14:01:36.8600171	cmd.exe	5948	RegOpenKey	HKCU\Control Panel\Desktop\LanguageConfiguration	SUCCESS	Desired Access: Read
23	14:01:36.8600323	cmd.exe	5948	RegEnumValue	HKCU\Control Panel\Desktop\LanguageConfiguration	SUCCESS	Index: 0, Name: de-DE, Type: REG_MULTI_SZ, Length: 14, Data: en-US
24	14:01:36.8600484	cmd.exe	5948	RegEnumValue	HKCU\Control Panel\Desktop\LanguageConfiguration	SUCCESS	Index: 1, Name: en-GB, Type: REG_MULTI_SZ, Length: 14, Data: en-US
25	14:01:36.8600555	cmd.exe	5948	RegEnumValue	HKCU\Control Panel\Desktop\LanguageConfiguration	NO MORE ENTRIES	Index: 2, Length: 512
26	14:01:36.8600610	cmd.exe	5948	RegCloseKey	HKCU\Control Panel\Desktop\LanguageConfiguration	SUCCESS
27	14:01:36.8600661	cmd.exe	5948	RegCloseKey	HKCU	SUCCESS
28	14:01:36.8601175	cmd.exe	5948	RegOpenKey	HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide	SUCCESS	Desired Access: Read
29	14:01:36.8601332	cmd.exe	5948	RegQueryValue	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest	NAME NOT FOUND	Length: 20
30	14:01:36.8601403	cmd.exe	5948	RegCloseKey	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide	SUCCESS
31	14:01:36.8602383	cmd.exe	5948	CreateFile	C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll	SUCCESS	Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened
32	14:01:36.8608169	cmd.exe	5948	CloseFile	C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll	SUCCESS
33	14:01:36.8609820	cmd.exe	5948	Load Image	C:\Windows\System32\advapi32.dll	SUCCESS	Image Base: 0x7ff913b00000, Image Size: 0xb4000
34	14:01:36.8611571	cmd.exe	5948	Load Image	C:\Windows\System32\sechost.dll	SUCCESS	Image Base: 0x7ff9140d0000, Image Size: 0xa6000
35	14:01:36.8612881	cmd.exe	5948	Thread Create		SUCCESS	Thread ID: 8992
36	14:01:36.8613720	cmd.exe	5948	CloseFile	C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll	SUCCESS
37	14:01:36.8614218	cmd.exe	5948	Thread Create		SUCCESS	Thread ID: 6280
38	14:01:36.8620152	cmd.exe	5948	Thread Create		SUCCESS	Thread ID: 6044
39	14:01:36.8622151	cmd.exe	5948	Thread Exit		SUCCESS	Thread ID: 8164, User Time: 0.0000000, Kernel Time: 0.0000000
40	14:01:36.8622158	cmd.exe	5948	RegQueryValue	HKLM\System\CurrentControlSet\Control\WMI\Security\72248411-7166-4feb-a386-34d8f35bb637	NAME NOT FOUND	Length: 528
41	14:01:36.8624363	cmd.exe	5948	CreateFile	C:\Users\Public\Downloads\out.txt	SUCCESS	Desired Access: Generic Write, Read Attributes, Disposition: OverwriteIf, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, AllocationSize: 0, OpenResult: Overwritten
42	14:01:36.8627985	cmd.exe	5948	WriteFile	C:\Users\Public\Downloads\out.txt	SUCCESS	Offset: 0, Length: 1, Priority: Normal
43	14:01:36.8629338	cmd.exe	5948	CloseFile	C:\Users\Public\Downloads\out.txt	SUCCESS
44	14:01:36.8631062	cmd.exe	5948	CreateFile	C:\Users\Public\Downloads\out.txt	SUCCESS	Desired Access: Generic Write, Read Attributes, Disposition: OverwriteIf, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, AllocationSize: 0, OpenResult: Overwritten
45	14:01:36.8632208	cmd.exe	5948	WriteFile	C:\Users\Public\Downloads\out.txt	SUCCESS	Offset: 0, Length: 1, Priority: Normal
46	14:01:36.8632532	cmd.exe	5948	CloseFile	C:\Users\Public\Downloads\out.txt	SUCCESS
47	14:01:36.8634383	cmd.exe	5948	CreateFile	C:\Users\Public\Downloads\out.txt	SUCCESS	Desired Access: Generic Write, Read Attributes, Disposition: OverwriteIf, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, AllocationSize: 0, OpenResult: Overwritten
48	14:01:36.8635575	cmd.exe	5948	WriteFile	C:\Users\Public\Downloads\out.txt	SUCCESS	Offset: 0, Length: 1, Priority: Normal
49	14:01:36.8636036	cmd.exe	5948	CloseFile	C:\Users\Public\Downloads\out.txt	SUCCESS
50	14:01:36.8765826	cmd.exe	5948	QueryNameInformationFile	C:\Windows\System32\ntdll.dll	SUCCESS	Name: \Windows\System32\ntdll.dll
51	14:01:36.8766081	cmd.exe	5948	QueryNameInformationFile	C:\Windows\System32\ntdll.dll	SUCCESS	Name: \Windows\System32\ntdll.dll
52	14:01:36.8886912	cmd.exe	5948	QueryNameInformationFile	C:\Windows\System32\ntdll.dll	SUCCESS	Name: \Windows\System32\ntdll.dll
53	14:01:36.8887109	cmd.exe	5948	QueryNameInformationFile	C:\Windows\System32\ntdll.dll	SUCCESS	Name: \Windows\System32\ntdll.dll
54	14:01:36.9034564	cmd.exe	5948	QueryNameInformationFile	C:\Windows\System32\ntdll.dll	SUCCESS	Name: \Windows\System32\ntdll.dll
55	14:01:36.9034780	cmd.exe	5948	QueryNameInformationFile	C:\Windows\System32\ntdll.dll	SUCCESS	Name: \Windows\System32\ntdll.dll
56	14:01:36.9147710	cmd.exe	5948	QueryNameInformationFile	C:\Windows\System32\ntdll.dll	SUCCESS	Name: \Windows\System32\ntdll.dll
57	14:01:36.9148015	cmd.exe	5948	QueryNameInformationFile	C:\Windows\System32\ntdll.dll	SUCCESS	Name: \Windows\System32\ntdll.dll
58	14:01:36.9151351	cmd.exe	5948	CreateFile	C:\Users\Public\Downloads\out.txt	SUCCESS	Desired Access: Generic Write, Read Attributes, Disposition: OverwriteIf, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, AllocationSize: 0, OpenResult: Overwritten
59	14:01:36.9153092	cmd.exe	5948	WriteFile	C:\Users\Public\Downloads\out.txt	SUCCESS	Offset: 0, Length: 1, Priority: Normal
60	14:01:36.9153676	cmd.exe	5948	CloseFile	C:\Users\Public\Downloads\out.txt	SUCCESS
61	14:01:36.9157019	cmd.exe	5948	Thread Exit		SUCCESS	Thread ID: 6044, User Time: 0.0000000, Kernel Time: 0.0312500

9.3 KiB Raw Permalink Blame History

9.3 KiB

Raw Permalink Blame History