← Back to Sessions

CERTPREP-WKS-112 / j.alvarez

Session GUID: df35a40d201d5bf092852b5fad4417e8

First Seen: 2026-10-18 11:36:13 Last Active: 2026-10-18 12:35:21 Reports: 98

watguard Report #1 2026-10-18 12:35:21 CONFIG VERIFIED (6f2a9c1d4b7e…)

tick 48210 ms

Anti-Debugging Flags

CLEAR IsDebuggerPresent
CLEAR CheckRemoteDebuggerPresent
CLEAR NtQueryInformationProcess (DebugPort)
CLEAR Hardware Breakpoints (Dr0-Dr3)
CLEAR PEB.BeingDebugged
CLEAR Parent Process Lineage

Memory Integrity Inspection

812 page hash(es) reported (watguard baseline)

VERIFIED — ALL PAGES MATCH BASELINE

DLL Injection Events (1)

Target Path

Caller Address

Authenticode Cert

Thread

Uploaded Binary Analysis

C:\Users\j.alvarez\AppData\Roaming\quickmacro\qm_inject.dll

0x00007FFA0F881230

unsigned

3390

5b3d8f21c4a9… (18944 bytes) 2 suspicious import(s)

▼

Running Processes (4 total, 0 flagged )

Path Max Width: 350px

Status

Process Name

Binary Path

Parent Name

Parent Path

Uptime

CLEAN

watguard.exe

C:\Program Files\WriteATest\watguard.exe

wat_bootstrapper.exe

C:\Program Files\WriteATest\wat_bootstrapper.exe

2143.8s

CLEAN

browser.exe

C:\Program Files\WriteATest\browser.exe

watguard.exe

C:\Program Files\WriteATest\watguard.exe

2098.1s

CLEAN

dwm.exe

C:\Windows\System32\dwm.exe

wininit.exe

C:\Windows\System32\wininit.exe

5920.4s

CLEAN

csrss.exe

C:\Windows\System32\csrss.exe

smss.exe

C:\Windows\System32\smss.exe

6011.2s

View Wire Frame Hex Dump & ASCII

0000  57 41 54 31 00 00 01 4a 00 00 00 03 08 96 be 8f  WAT1...J........
0010  9c 5e 12 04 22 30 2e 08 90 a1 e4 06 32 24 43 45  ..".0.......2$CE
0020  52 54 50 52 45 50 2d 57 4b 53 2d 31 31 32 3a 0c  RTPREP-WKS-112:.
0030  6a 2e 61 6c 76 61 72 65 7a 40 01 00 4a 0e 08 01  [email protected]...
0040  10 96 c1 fa 8f 06 18 8c 04 20 00 52 03 08 e8 07  ......... .R....
0050  10 00