87 lines
5.3 KiB
JSON
87 lines
5.3 KiB
JSON
[
|
|
{
|
|
"Id": 1,
|
|
"TimeCreated": "2026-09-05T10:00:01",
|
|
"Message": "Process Create:\nUtcTime: 2026-09-05 10:00:01.100\nProcessId: 4820\nImage: C:\\Users\\Public\\invoice_2024.exe\nCommandLine: \"C:\\Users\\Public\\invoice_2024.exe\" /install\nHashes: SHA256=AF747150F9AFC0937A6B62755F9BD84CFB88726370F6007AC03F8F7504D38C4D,IMPHASH=DFCAEBD44FF7676285215E9D856415F3\nParentProcessId: 1400\nParentImage: C:\\Windows\\explorer.exe\nParentCommandLine: C:\\Windows\\explorer.exe"
|
|
},
|
|
{
|
|
"Id": 11,
|
|
"TimeCreated": "2026-09-05T10:00:01",
|
|
"Message": "File created:\nUtcTime: 2026-09-05 10:00:01.300\nProcessId: 4820\nImage: C:\\Users\\Public\\invoice_2024.exe\nTargetFilename: C:\\Users\\Bob\\AppData\\Roaming\\svc.exe"
|
|
},
|
|
{
|
|
"Id": 13,
|
|
"TimeCreated": "2026-09-05T10:00:01",
|
|
"Message": "Registry value set:\nEventType: SetValue\nProcessId: 4820\nImage: C:\\Users\\Public\\invoice_2024.exe\nTargetObject: HKU\\S-1-5-21-1\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WinUpdate\nDetails: C:\\Users\\Bob\\AppData\\Roaming\\svc.exe"
|
|
},
|
|
{
|
|
"Id": 7,
|
|
"TimeCreated": "2026-09-05T10:00:02",
|
|
"Message": "Image loaded:\nProcessId: 4820\nImage: C:\\Users\\Public\\invoice_2024.exe\nImageLoaded: C:\\Users\\Bob\\AppData\\Roaming\\hlp.dll\nSigned: false\nSignature: "
|
|
},
|
|
{
|
|
"Id": 8,
|
|
"TimeCreated": "2026-09-05T10:00:02",
|
|
"Message": "CreateRemoteThread detected:\nSourceProcessId: 4820\nSourceImage: C:\\Users\\Public\\invoice_2024.exe\nTargetProcessId: 1400\nTargetImage: C:\\Windows\\explorer.exe\nStartAddress: 0x000002A4C0000000"
|
|
},
|
|
{
|
|
"Id": 10,
|
|
"TimeCreated": "2026-09-05T10:00:02",
|
|
"Message": "Process accessed:\nSourceProcessId: 4820\nSourceImage: C:\\Users\\Public\\invoice_2024.exe\nTargetImage: C:\\Windows\\explorer.exe\nGrantedAccess: 0x1F0FFF"
|
|
},
|
|
{
|
|
"Id": 1,
|
|
"TimeCreated": "2026-09-05T10:00:03",
|
|
"Message": "Process Create:\nUtcTime: 2026-09-05 10:00:03.000\nProcessId: 5102\nImage: C:\\Windows\\System32\\cmd.exe\nCommandLine: cmd.exe /c ping -n 3 127.0.0.1 & del \"C:\\Users\\Public\\invoice_2024.exe\"\nParentProcessId: 4820\nParentImage: C:\\Users\\Public\\invoice_2024.exe"
|
|
},
|
|
{
|
|
"Id": 22,
|
|
"TimeCreated": "2026-09-05T10:00:02",
|
|
"Message": "DNS query:\nProcessId: 4820\nImage: C:\\Users\\Public\\invoice_2024.exe\nQueryName: update-cdn.example.test\nQueryResults: 203.0.113.5"
|
|
},
|
|
{
|
|
"Id": 1,
|
|
"TimeCreated": "2026-09-05T10:00:06",
|
|
"Message": "Process Create:\nUtcTime: 2026-09-05 10:00:06.200\nProcessId: 5300\nImage: C:\\Users\\Bob\\AppData\\Roaming\\svc.exe\nCommandLine: C:\\Users\\Bob\\AppData\\Roaming\\svc.exe\nHashes: SHA256=1111111111111111111111111111111111111111111111111111111111111111\nParentProcessId: 700\nParentImage: C:\\Windows\\System32\\services.exe\nParentCommandLine: C:\\Windows\\System32\\services.exe"
|
|
},
|
|
{
|
|
"Id": 17,
|
|
"TimeCreated": "2026-09-05T10:00:02",
|
|
"Message": "Pipe Created:\nProcessId: 4820\nImage: C:\\Users\\Public\\invoice_2024.exe\nPipeName: \\testfixture"
|
|
},
|
|
{
|
|
"Id": 3,
|
|
"TimeCreated": "2026-09-05T10:00:06",
|
|
"Message": "Network connection detected:\nUtcTime: 2026-09-05 10:00:06.000\nProcessId: 5300\nImage: C:\\Users\\Bob\\AppData\\Roaming\\svc.exe\nProtocol: tcp\nSourceIp: 10.0.0.15\nDestinationIp: 203.0.113.5\nDestinationPort: 443\nDestinationHostname: update-cdn.example.test"
|
|
},
|
|
{
|
|
"Id": 3,
|
|
"TimeCreated": "2026-09-05T10:01:06",
|
|
"Message": "Network connection detected:\nUtcTime: 2026-09-05 10:01:06.000\nProcessId: 5300\nImage: C:\\Users\\Bob\\AppData\\Roaming\\svc.exe\nProtocol: tcp\nSourceIp: 10.0.0.15\nDestinationIp: 203.0.113.5\nDestinationPort: 443\nDestinationHostname: update-cdn.example.test"
|
|
},
|
|
{
|
|
"Id": 3,
|
|
"TimeCreated": "2026-09-05T10:02:06",
|
|
"Message": "Network connection detected:\nUtcTime: 2026-09-05 10:02:06.000\nProcessId: 5300\nImage: C:\\Users\\Bob\\AppData\\Roaming\\svc.exe\nProtocol: tcp\nSourceIp: 10.0.0.15\nDestinationIp: 203.0.113.5\nDestinationPort: 443\nDestinationHostname: update-cdn.example.test"
|
|
},
|
|
{
|
|
"Id": 3,
|
|
"TimeCreated": "2026-09-05T10:03:06",
|
|
"Message": "Network connection detected:\nUtcTime: 2026-09-05 10:03:06.000\nProcessId: 5300\nImage: C:\\Users\\Bob\\AppData\\Roaming\\svc.exe\nProtocol: tcp\nSourceIp: 10.0.0.15\nDestinationIp: 203.0.113.5\nDestinationPort: 443\nDestinationHostname: update-cdn.example.test"
|
|
},
|
|
{
|
|
"Id": 3,
|
|
"TimeCreated": "2026-09-05T10:04:06",
|
|
"Message": "Network connection detected:\nUtcTime: 2026-09-05 10:04:06.000\nProcessId: 5300\nImage: C:\\Users\\Bob\\AppData\\Roaming\\svc.exe\nProtocol: tcp\nSourceIp: 10.0.0.15\nDestinationIp: 203.0.113.5\nDestinationPort: 443\nDestinationHostname: update-cdn.example.test"
|
|
},
|
|
{
|
|
"Id": 3,
|
|
"TimeCreated": "2026-09-05T10:05:06",
|
|
"Message": "Network connection detected:\nUtcTime: 2026-09-05 10:05:06.000\nProcessId: 5300\nImage: C:\\Users\\Bob\\AppData\\Roaming\\svc.exe\nProtocol: tcp\nSourceIp: 10.0.0.15\nDestinationIp: 203.0.113.5\nDestinationPort: 443\nDestinationHostname: update-cdn.example.test"
|
|
},
|
|
{
|
|
"Id": 22,
|
|
"TimeCreated": "2026-09-05T10:00:10",
|
|
"Message": "DNS query:\nProcessId: 2100\nImage: C:\\Program Files\\Google\\Chrome\\chrome.exe\nQueryName: clients2.google.com\nQueryResults: 142.250.0.1"
|
|
}
|
|
] |