Technical Information
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'PROCEXPL', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'TCPViewClass', WindowName: ''
- ClassName: 'Autoruns', WindowName: ''
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'TIdaWindow', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
detect programs and games:
- ClassName: 'gdkWindowToplevel', WindowName: ''
Network activity
TCP
- 'po##.#inexmr.com':80
UDP
- DNS ASK po##.#inexmr.com
Miscellaneous
Searches for the following windows
- ClassName: 'PortmonClass' WindowName: ''
- ClassName: 'ProcessHacker' WindowName: ''
- ClassName: 'AnVirMainFrame' WindowName: ''
- ClassName: '' WindowName: 'OllyDbg'
- ClassName: 'pe--diy' WindowName: ''
- ClassName: '1212121' WindowName: ''
- ClassName: 'WinDbgFrameClass' WindowName: ''
- ClassName: 'dbgviewClass' WindowName: ''
- ClassName: '' WindowName: 'WSExplorer'
- ClassName: '18467-41' WindowName: ''
- ClassName: 'SandboxieControlWndClass' WindowName: ''
- ClassName: '' WindowName: 'Sandboxie Control'
