Yeah, I noticed quite a bit of hooks inside ntdll

Module32First/Module32Next are hooked and return correct data. As for Process32First/Process32Next - agree, they return this .tmp file name, but there are specifics to make it hooked and changed. I will add it into todo list, let see if it would be possible to develop. Thanks! For reference, here i...

To elaborate a bit: I am calling Process32First / Process32Next from inside the box, so I expected this to be fixed up by the hooks placed from virtualbox. A workaround would be to detect the process name starting with 'evb' and ending with '.tmp', and then calling Module32First, because this will r...

Process32First / Process32Next return the 'temp' filename for processes that are started from inside the box.
e.g. the process name will be `evb4760.tmp` instead of what is expected.