Note any new processes created or attempts to inject code into legitimate Windows processes.
Highlight suspicious strings such as IP addresses, URLs, or API calls (e.g., CreateProcess , InternetOpen ).
Specific IP addresses or domains the malware contacts.