mirror of
https://github.com/evilele/EDR-Introspection
synced 2026-06-09 08:11:09 +00:00
cailllev
18 KiB
18 KiB
| 1 | Time of Day | Process Name | PID | Operation | Path | Result | Detail |
|---|---|---|---|---|---|---|---|
| 2 | 13:48:28.7132480 | MsMpEng.exe | 3220 | Thread Create | SUCCESS | Thread ID: 7424 | |
| 3 | 13:48:28.7136831 | MsMpEng.exe | 3220 | CreateFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll | SUCCESS | Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4 | 13:48:28.7137169 | MsMpEng.exe | 3220 | QueryBasicInformationFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll | SUCCESS | CreationTime: 10.10.2025 15:34:53, LastAccessTime: 13.10.2025 13:27:12, LastWriteTime: 13.10.2025 11:45:59, ChangeTime: 13.10.2025 11:45:59, FileAttributes: A |
| 5 | 13:48:28.7137235 | MsMpEng.exe | 3220 | CloseFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll | SUCCESS | |
| 6 | 13:48:28.7137960 | MsMpEng.exe | 3220 | CreateFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll | SUCCESS | Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened |
| 7 | 13:48:28.7138149 | MsMpEng.exe | 3220 | CreateFileMapping | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll | FILE LOCKED WITH ONLY READERS | SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE|PAGE_NOCACHE |
| 8 | 13:48:28.7139295 | MsMpEng.exe | 3220 | QueryEAFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll | SUCCESS | |
| 9 | 13:48:28.7139676 | MsMpEng.exe | 3220 | ReadFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll | SUCCESS | Offset: 46’080, Length: 12’288, I/O Flags: Non-cached, Paging I/O, Priority: Normal |
| 10 | 13:48:28.7140155 | MsMpEng.exe | 3220 | ReadFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll | SUCCESS | Offset: 153’088, Length: 45’056, I/O Flags: Non-cached, Paging I/O, Priority: Normal |
| 11 | 13:48:28.7146151 | MsMpEng.exe | 3220 | CreateFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | SUCCESS | Desired Access: Read Attributes, Disposition: Open, Options: Open For Backup, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 12 | 13:48:28.7146334 | MsMpEng.exe | 3220 | QueryBasicInformationFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | SUCCESS | CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A |
| 13 | 13:48:28.7146598 | MsMpEng.exe | 3220 | CloseFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | SUCCESS | |
| 14 | 13:48:28.7149542 | MsMpEng.exe | 3220 | CreateFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | SUCCESS | Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 15 | 13:48:28.7149905 | MsMpEng.exe | 3220 | QueryInformationVolume | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | BUFFER OVERFLOW | VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ |
| 16 | 13:48:28.7149994 | MsMpEng.exe | 3220 | QueryAllInformationFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | BUFFER OVERFLOW | CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184 |
| 17 | 13:48:28.7150074 | MsMpEng.exe | 3220 | QueryInformationVolume | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | BUFFER OVERFLOW | VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ |
| 18 | 13:48:28.7150132 | MsMpEng.exe | 3220 | QueryAllInformationFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | BUFFER OVERFLOW | CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184 |
| 19 | 13:48:28.7150305 | MsMpEng.exe | 3220 | FileSystemControl | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | SUCCESS | Control: FSCTL_READ_FILE_USN_DATA |
| 20 | 13:48:28.7150408 | MsMpEng.exe | 3220 | QueryIdInformation | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | SUCCESS | |
| 21 | 13:48:28.7150544 | MsMpEng.exe | 3220 | CloseFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | SUCCESS | |
| 22 | 13:48:28.7151310 | MsMpEng.exe | 3220 | CreateFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | SUCCESS | Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 23 | 13:48:28.7151659 | MsMpEng.exe | 3220 | QueryInformationVolume | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | BUFFER OVERFLOW | VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ |
| 24 | 13:48:28.7151768 | MsMpEng.exe | 3220 | QueryAllInformationFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | BUFFER OVERFLOW | CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184 |
| 25 | 13:48:28.7151861 | MsMpEng.exe | 3220 | QueryInformationVolume | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | BUFFER OVERFLOW | VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ |
| 26 | 13:48:28.7151914 | MsMpEng.exe | 3220 | QueryAllInformationFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | BUFFER OVERFLOW | CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184 |
| 27 | 13:48:28.7151998 | MsMpEng.exe | 3220 | FileSystemControl | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | SUCCESS | Control: FSCTL_READ_FILE_USN_DATA |
| 28 | 13:48:28.7152173 | MsMpEng.exe | 3220 | QueryIdInformation | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | SUCCESS | |
| 29 | 13:48:28.7152292 | MsMpEng.exe | 3220 | CloseFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | SUCCESS | |
| 30 | 13:48:28.7153061 | MsMpEng.exe | 3220 | CreateFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | SUCCESS | Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 31 | 13:48:28.7153490 | MsMpEng.exe | 3220 | QueryInformationVolume | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | BUFFER OVERFLOW | VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ |
| 32 | 13:48:28.7153616 | MsMpEng.exe | 3220 | QueryAllInformationFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | BUFFER OVERFLOW | CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184 |
| 33 | 13:48:28.7153696 | MsMpEng.exe | 3220 | QueryInformationVolume | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | BUFFER OVERFLOW | VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winწ |
| 34 | 13:48:28.7153752 | MsMpEng.exe | 3220 | QueryAllInformationFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | BUFFER OVERFLOW | CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184 |
| 35 | 13:48:28.7153961 | MsMpEng.exe | 3220 | FileSystemControl | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | SUCCESS | Control: FSCTL_READ_FILE_USN_DATA |
| 36 | 13:48:28.7154069 | MsMpEng.exe | 3220 | QueryIdInformation | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | SUCCESS | |
| 37 | 13:48:28.7154236 | MsMpEng.exe | 3220 | CloseFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | SUCCESS | |
| 38 | 13:48:28.7155815 | MsMpEng.exe | 3220 | CreateFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | SUCCESS | Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 39 | 13:48:28.7156119 | MsMpEng.exe | 3220 | FileSystemControl | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | SUCCESS | Control: FSCTL_READ_FILE_USN_DATA |
| 40 | 13:48:28.7156222 | MsMpEng.exe | 3220 | CloseFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | SUCCESS | |
| 41 | 13:48:28.7156390 | MsMpEng.exe | 3220 | QueryStandardInformationFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll | SUCCESS | AllocationSize: 241’664, EndOfFile: 240’128, NumberOfLinks: 1, DeletePending: False, Directory: False |
| 42 | 13:48:28.7156578 | MsMpEng.exe | 3220 | FileSystemControl | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll | INVALID DEVICE REQUEST | Control: 0x90390 (Device:0x9 Function:228 Method: 0) |
| 43 | 13:48:28.7156678 | MsMpEng.exe | 3220 | QueryAttributeInformationVolume | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll | SUCCESS | FileSystemAttributes: Case Preserved, Case Sensitive, Unicode, ACLs, Compression, Named Streams, EFS, Object IDs, Reparse Points, Sparse Files, Quotas, Transactions, 0x3c02e00, MaximumComponentNameLength: 255, FileSystemName: NTFS |
| 44 | 13:48:28.7161664 | MsMpEng.exe | 3220 | QueryEAFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll | SUCCESS | |
| 45 | 13:48:28.7163940 | MsMpEng.exe | 3220 | CreateFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | SUCCESS | Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open For Backup, Open No Recall, Disallow Exclusive, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 46 | 13:48:28.7164226 | MsMpEng.exe | 3220 | QueryInformationVolume | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | BUFFER OVERFLOW | VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄶ |
| 47 | 13:48:28.7164830 | MsMpEng.exe | 3220 | QueryAllInformationFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | BUFFER OVERFLOW | CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184 |
| 48 | 13:48:28.7165135 | MsMpEng.exe | 3220 | QueryInformationVolume | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | BUFFER OVERFLOW | VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ |
| 49 | 13:48:28.7165240 | MsMpEng.exe | 3220 | QueryAllInformationFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | BUFFER OVERFLOW | CreationTime: 12.10.2025 21:49:19, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 13.10.2025 11:46:00, ChangeTime: 13.10.2025 11:46:00, FileAttributes: A, AllocationSize: 32’768, EndOfFile: 29’184 |
| 50 | 13:48:28.7165336 | MsMpEng.exe | 3220 | FileSystemControl | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | SUCCESS | Control: FSCTL_READ_FILE_USN_DATA |
| 51 | 13:48:28.7165420 | MsMpEng.exe | 3220 | QueryIdInformation | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | SUCCESS | |
| 52 | 13:48:28.7166074 | MsMpEng.exe | 3220 | CloseFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\HookTester.exe | SUCCESS | |
| 53 | 13:48:28.7193027 | MsMpEng.exe | 3220 | QueryInformationVolume | C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe | BUFFER OVERFLOW | VolumeCreationTime: 12.08.2025 21:28:21, VolumeSerialNumber: 9C44-06ED, SupportsObjects: True, VolumeLabel: Winᄩ |
| 54 | 13:48:28.7193162 | MsMpEng.exe | 3220 | QueryAllInformationFile | C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe | BUFFER OVERFLOW | CreationTime: 01.10.2025 20:10:03, LastAccessTime: 13.10.2025 13:48:28, LastWriteTime: 05.10.2025 15:57:40, ChangeTime: 05.10.2025 15:57:40, FileAttributes: A, AllocationSize: 380’928, EndOfFile: 378’880 |
| 55 | 13:48:28.7193270 | MsMpEng.exe | 3220 | FileSystemControl | C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe | SUCCESS | Control: FSCTL_READ_FILE_USN_DATA |
| 56 | 13:48:28.7194074 | MsMpEng.exe | 3220 | LockFile | C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm | SUCCESS | Exclusive: False, Offset: 124, Length: 1, Fail Immediately: True |
| 57 | 13:48:28.7194339 | MsMpEng.exe | 3220 | ReadFile | C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal | SUCCESS | Offset: 222’536, Length: 4’096 |
| 58 | 13:48:28.7194587 | MsMpEng.exe | 3220 | ReadFile | C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal | SUCCESS | Offset: 86’576, Length: 4’096 |
| 59 | 13:48:28.7194836 | MsMpEng.exe | 3220 | ReadFile | C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-wal | SUCCESS | Offset: 700’456, Length: 4’096 |
| 60 | 13:48:28.7195263 | MsMpEng.exe | 3220 | UnlockFileSingle | C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db-shm | SUCCESS | Offset: 124, Length: 1 |
| 61 | 13:48:28.7196113 | MsMpEng.exe | 3220 | ReadFile | C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe | SUCCESS | Offset: 28’672, Length: 350’208, Priority: Normal |
| 62 | 13:48:28.7196377 | MsMpEng.exe | 3220 | ReadFile | C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe | SUCCESS | Offset: 28’672, Length: 344’064, I/O Flags: Non-cached, Paging I/O, Priority: Normal |
| 63 | 13:48:28.7205235 | MsMpEng.exe | 3220 | RegOpenKey | HKLM\Software\Microsoft\Windows\CurrentVersion\Setup | SUCCESS | Desired Access: Read |
| 64 | 13:48:28.7205392 | MsMpEng.exe | 3220 | RegQueryValue | HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\MinimizeFootprint | NAME NOT FOUND | Length: 20 |
| 65 | 13:48:28.7205696 | MsMpEng.exe | 3220 | RegCloseKey | HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup | SUCCESS | |
| 66 | 13:48:28.7205905 | MsMpEng.exe | 3220 | FileSystemControl | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll | INVALID DEVICE REQUEST | Control: 0x90390 (Device:0x9 Function:228 Method: 0) |
| 67 | 13:48:28.7206014 | MsMpEng.exe | 3220 | QueryAttributeInformationVolume | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll | SUCCESS | FileSystemAttributes: Case Preserved, Case Sensitive, Unicode, ACLs, Compression, Named Streams, EFS, Object IDs, Reparse Points, Sparse Files, Quotas, Transactions, 0x3c02e00, MaximumComponentNameLength: 255, FileSystemName: NTFS |
| 68 | 13:48:28.7212630 | MsMpEng.exe | 3220 | QueryStandardInformationFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll | SUCCESS | AllocationSize: 241’664, EndOfFile: 240’128, NumberOfLinks: 1, DeletePending: False, Directory: False |
| 69 | 13:48:28.7213481 | MsMpEng.exe | 3220 | FileSystemControl | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll | INVALID DEVICE REQUEST | Control: 0x90390 (Device:0x9 Function:228 Method: 0) |
| 70 | 13:48:28.7213990 | MsMpEng.exe | 3220 | QueryAttributeInformationVolume | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll | SUCCESS | FileSystemAttributes: Case Preserved, Case Sensitive, Unicode, ACLs, Compression, Named Streams, EFS, Object IDs, Reparse Points, Sparse Files, Quotas, Transactions, 0x3c02e00, MaximumComponentNameLength: 255, FileSystemName: NTFS |
| 71 | 13:48:28.7218911 | MsMpEng.exe | 3220 | CreateFile | C:\Users\hacker\source\repos\EDR-Introspection\helpers\KDU\kdu.exe | SUCCESS | Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 72 | 13:48:28.7218980 | MsMpEng.exe | 3220 | QueryEAFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll | SUCCESS | |
| 73 | 13:48:28.7230054 | MsMpEng.exe | 3220 | FileSystemControl | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll | INVALID DEVICE REQUEST | Control: 0x90390 (Device:0x9 Function:228 Method: 0) |
| 74 | 13:48:28.7230162 | MsMpEng.exe | 3220 | QueryAttributeInformationVolume | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll | SUCCESS | FileSystemAttributes: Case Preserved, Case Sensitive, Unicode, ACLs, Compression, Named Streams, EFS, Object IDs, Reparse Points, Sparse Files, Quotas, Transactions, 0x3c02e00, MaximumComponentNameLength: 255, FileSystemName: NTFS |
| 75 | 13:48:28.7238717 | MsMpEng.exe | 3220 | CloseFile | C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\EDRHooker.dll | SUCCESS | |
| 76 | 13:48:28.7239752 | MsMpEng.exe | 3220 | Thread Exit | SUCCESS | Thread ID: 7424, User Time: 0.0000000, Kernel Time: 0.0000000 |