reverse-skills-max/vendor-new/malware-analysis-claude-skills/tests/fixtures/evidence/procmon.csv

1	Time of Day	Process Name	PID	Operation	Path	Result	Detail
2	10:00:01.1	explorer.exe	1400	Process Create	C:\Users\Public\invoice_2024.exe	SUCCESS	PID: 4820, Command line: "C:\Users\Public\invoice_2024.exe" /install
3	10:00:01.2	invoice_2024.exe	4820	Process Start		SUCCESS	Parent PID: 1400, Command line: "C:\Users\Public\invoice_2024.exe" /install, Current directory: C:\Users\Public\
4	10:00:01.3	invoice_2024.exe	4820	CreateFile	C:\Users\Bob\AppData\Roaming\svc.exe	SUCCESS	Desired Access: Generic Write, Disposition: Create, OpenResult: Created
5	10:00:01.4	invoice_2024.exe	4820	WriteFile	C:\Users\Bob\AppData\Roaming\svc.exe	SUCCESS	Offset: 0, Length: 51200
6	10:00:01.5	invoice_2024.exe	4820	RegCreateKey	HKCU\Software\Microsoft\Windows\CurrentVersion\Run	SUCCESS	Desired Access: All Access
7	10:00:01.6	invoice_2024.exe	4820	RegSetValue	HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdate	SUCCESS	Type: REG_SZ, Length: 62, Data: C:\Users\Bob\AppData\Roaming\svc.exe
8	10:00:02.0	invoice_2024.exe	4820	Load Image	C:\Users\Bob\AppData\Roaming\hlp.dll	SUCCESS	Image Base: 0x10000000, Image Size: 0x14000
9	10:00:02.5	invoice_2024.exe	4820	TCP Connect	DESKTOP-TEST:49700 -> 203.0.113.5:443	SUCCESS	Length: 0, mss: 1460
10	10:00:03.0	invoice_2024.exe	4820	Process Create	C:\Windows\System32\cmd.exe	SUCCESS	PID: 5102, Command line: cmd.exe /c ping -n 3 127.0.0.1 & del "C:\Users\Public\invoice_2024.exe"
11	10:00:03.1	cmd.exe	5102	Process Start		SUCCESS	Parent PID: 4820, Command line: cmd.exe /c ping -n 3 127.0.0.1 & del "C:\Users\Public\invoice_2024.exe"
12	10:00:03.2	cmd.exe	5102	Process Create	C:\Windows\System32\PING.EXE	SUCCESS	PID: 5140, Command line: ping -n 3 127.0.0.1
13	10:00:06.0	cmd.exe	5102	SetDispositionInformationFile	C:\Users\Public\invoice_2024.exe	SUCCESS	Delete: True
14	10:00:06.2	svc.exe	5300	Process Start		SUCCESS	Parent PID: 1, Command line: C:\Users\Bob\AppData\Roaming\svc.exe
15	10:00:06.5	svc.exe	5300	TCP Connect	DESKTOP-TEST:49712 -> 203.0.113.5:443	SUCCESS	Length: 0, mss: 1460
16	10:00:10.0	chrome.exe	2100	WriteFile	C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1	SUCCESS	Offset: 0, Length: 4096
17	10:00:11.0	svchost.exe	900	RegQueryValue	HKLM\System\CurrentControlSet\Services\Tcpip\Parameters	SUCCESS	Type: REG_DWORD