18 lines
2.5 KiB
CSV
18 lines
2.5 KiB
CSV
"Time of Day","Process Name","PID","Operation","Path","Result","Detail"
|
|
"10:00:01.1","explorer.exe","1400","Process Create","C:\Users\Public\invoice_2024.exe","SUCCESS","PID: 4820, Command line: ""C:\Users\Public\invoice_2024.exe"" /install"
|
|
"10:00:01.2","invoice_2024.exe","4820","Process Start","","SUCCESS","Parent PID: 1400, Command line: ""C:\Users\Public\invoice_2024.exe"" /install, Current directory: C:\Users\Public\"
|
|
"10:00:01.3","invoice_2024.exe","4820","CreateFile","C:\Users\Bob\AppData\Roaming\svc.exe","SUCCESS","Desired Access: Generic Write, Disposition: Create, OpenResult: Created"
|
|
"10:00:01.4","invoice_2024.exe","4820","WriteFile","C:\Users\Bob\AppData\Roaming\svc.exe","SUCCESS","Offset: 0, Length: 51200"
|
|
"10:00:01.5","invoice_2024.exe","4820","RegCreateKey","HKCU\Software\Microsoft\Windows\CurrentVersion\Run","SUCCESS","Desired Access: All Access"
|
|
"10:00:01.6","invoice_2024.exe","4820","RegSetValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdate","SUCCESS","Type: REG_SZ, Length: 62, Data: C:\Users\Bob\AppData\Roaming\svc.exe"
|
|
"10:00:02.0","invoice_2024.exe","4820","Load Image","C:\Users\Bob\AppData\Roaming\hlp.dll","SUCCESS","Image Base: 0x10000000, Image Size: 0x14000"
|
|
"10:00:02.5","invoice_2024.exe","4820","TCP Connect","DESKTOP-TEST:49700 -> 203.0.113.5:443","SUCCESS","Length: 0, mss: 1460"
|
|
"10:00:03.0","invoice_2024.exe","4820","Process Create","C:\Windows\System32\cmd.exe","SUCCESS","PID: 5102, Command line: cmd.exe /c ping -n 3 127.0.0.1 & del ""C:\Users\Public\invoice_2024.exe"""
|
|
"10:00:03.1","cmd.exe","5102","Process Start","","SUCCESS","Parent PID: 4820, Command line: cmd.exe /c ping -n 3 127.0.0.1 & del ""C:\Users\Public\invoice_2024.exe"""
|
|
"10:00:03.2","cmd.exe","5102","Process Create","C:\Windows\System32\PING.EXE","SUCCESS","PID: 5140, Command line: ping -n 3 127.0.0.1"
|
|
"10:00:06.0","cmd.exe","5102","SetDispositionInformationFile","C:\Users\Public\invoice_2024.exe","SUCCESS","Delete: True"
|
|
"10:00:06.2","svc.exe","5300","Process Start","","SUCCESS","Parent PID: 1, Command line: C:\Users\Bob\AppData\Roaming\svc.exe"
|
|
"10:00:06.5","svc.exe","5300","TCP Connect","DESKTOP-TEST:49712 -> 203.0.113.5:443","SUCCESS","Length: 0, mss: 1460"
|
|
"10:00:10.0","chrome.exe","2100","WriteFile","C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1","SUCCESS","Offset: 0, Length: 4096"
|
|
"10:00:11.0","svchost.exe","900","RegQueryValue","HKLM\System\CurrentControlSet\Services\Tcpip\Parameters","SUCCESS","Type: REG_DWORD"
|