ERAAgent.exe periodic wake cycles with transient memory changes (SLEEPWALKER)

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•0

Detects periodic execution cycles of ERAAgent.exe that involve memory protection changes, characteristic of the SLEEPWALKER malware's XOR-decrypt-execute-reencrypt loop scheduled by a cron-like mechanism.