Highlight suspicious strings such as IP addresses, URLs, or API calls (e.g., CreateProcess , InternetOpen ).

(e.g., Trojan, Ransomware, or Spyware) Risk Level: High/Critical

Identify any Command and Control (C2) server communications, including DNS queries and HTTP requests. 4. Indicators of Compromise (IOCs)

Note any new processes created or attempts to inject code into legitimate Windows processes.

Specific IP addresses or domains the malware contacts.

Provide steps to remove the threat and prevent future infections. Malware Analysis - CISA