For malware to get a list of the running processes, the following steps are required:
- Create a snapshot of all of the processes running at that moment. This snapshot contains information about all running processes, their names, process IDs, and other important information. It can be acquired using the CreateToolhelp32Snapshot API. Usually, it is executed when TH32CS_SNAPPROCESS is given as an argument (to take a snapshot of the running processes, not threads or loaded libraries).
- Get the first process in this list using the Process32First API. This API gets the first process in the snapshot and starts the iteration over the list of processes.
- Loop on the Process32Next API to get each process in the list, one by one, with its name and process ID, as shown in the following screenshot:
Figure 4: Process searching using CreateToolhelp32Snapshot
Once the desired process has been found, the malware then goes to the next phase by executing the OpenProcess...
