Technical Information
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq cheatengine*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq processhacker*" /IM * /F /T
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- nul
- %WINDIR%\temp\tar6ddb.tmp
- %WINDIR%\temp\cab6dda.tmp
- %WINDIR%\temp\tar5808.tmp
- %WINDIR%\temp\cab5807.tmp
- %WINDIR%\temp\tar573b.tmp
- %WINDIR%\temp\cab573a.tmp
- %WINDIR%\temp\tar412a.tmp
- %WINDIR%\temp\cab4129.tmp
- %WINDIR%\temp\tar40bb.tmp
- %WINDIR%\temp\cab40ba.tmp
- %WINDIR%\temp\tar2af7.tmp
- %WINDIR%\temp\cab2af6.tmp
- %WINDIR%\temp\tar2a98.tmp
- %WINDIR%\temp\cabb45d.tmp
- %WINDIR%\temp\cab2a97.tmp
- %WINDIR%\temp\cab1512.tmp
- %WINDIR%\temp\tar14b3.tmp
- %WINDIR%\temp\cab14b2.tmp
- %WINDIR%\temp\tar1473.tmp
- %WINDIR%\temp\cab1472.tmp
- %WINDIR%\temp\tar13a6.tmp
- %WINDIR%\temp\cab1395.tmp
- %WINDIR%\temp\tarfdd3.tmp
- %WINDIR%\temp\cabfdd2.tmp
- %WINDIR%\temp\tarfd93.tmp
- %WINDIR%\temp\cabfd92.tmp
- %WINDIR%\temp\tare6b7.tmp
- %WINDIR%\temp\cabe6b6.tmp
- %WINDIR%\temp\tar1513.tmp
- %WINDIR%\temp\tarb45e.tmp
- %WINDIR%\temp\cabe6b6.tmp
- %WINDIR%\temp\tar6ddb.tmp
- %WINDIR%\temp\cab6dda.tmp
- %WINDIR%\temp\tar5808.tmp
- %WINDIR%\temp\cab5807.tmp
- %WINDIR%\temp\tar573b.tmp
- %WINDIR%\temp\cab573a.tmp
- %WINDIR%\temp\tar412a.tmp
- %WINDIR%\temp\cab4129.tmp
- %WINDIR%\temp\tar40bb.tmp
- %WINDIR%\temp\cab40ba.tmp
- %WINDIR%\temp\tar2af7.tmp
- %WINDIR%\temp\cab2af6.tmp
- %WINDIR%\temp\tar2a98.tmp
- %WINDIR%\temp\cab2a97.tmp
- %WINDIR%\temp\tar1513.tmp
- %WINDIR%\temp\cab1512.tmp
- %WINDIR%\temp\tar14b3.tmp
- %WINDIR%\temp\cab14b2.tmp
- %WINDIR%\temp\tar1473.tmp
- %WINDIR%\temp\cab1472.tmp
- %WINDIR%\temp\tar13a6.tmp
- %WINDIR%\temp\cab1395.tmp
- %WINDIR%\temp\tarfdd3.tmp
- %WINDIR%\temp\cabfdd2.tmp
- %WINDIR%\temp\tarfd93.tmp
- %WINDIR%\temp\cabfd92.tmp
- %WINDIR%\temp\tare6b7.tmp
- %WINDIR%\temp\cabb45d.tmp
- %WINDIR%\temp\tarb45e.tmp
- 'localhost':49182
- 'localhost':49184
- 'ke##uth.win':443
- 'x1.#.lencr.org':80
- 'x2.#.lencr.org':80
- http://x1.#.lencr.org/
- http://x2.#.lencr.org/
- 'localhost':49182
- 'localhost':49184
- 'localhost':49185
- 'ke##uth.win':443
- DNS ASK ke##uth.win
- DNS ASK x1.#.lencr.org
- DNS ASK x2.#.lencr.org
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '' WindowName: 'OllyDbg'
- ClassName: '' WindowName: 'Everything'
- ClassName: '' WindowName: 'Detect It Easy v3.01'
- ClassName: '' WindowName: 'Scylla x64 v0.9.5'
- ClassName: '' WindowName: 'Scylla x86 v0.9.5'
- ClassName: '' WindowName: 'Scylla x64 v0.9.5a'
- ClassName: '' WindowName: 'Scylla x86 v0.9.5a'
- ClassName: '' WindowName: 'Scylla x64 v0.9.8'
- ClassName: '' WindowName: 'Scylla x86 v0.9.8'
- ClassName: '' WindowName: 'FiddlerCore'
- ClassName: '' WindowName: 'FiddlerCap'
- ClassName: '' WindowName: 'Fiddler Jam'
- ClassName: '' WindowName: 'Fiddler Classic'
- ClassName: '' WindowName: 'HxD'
- ClassName: '' WindowName: 'Fiddler Everywhere'
- ClassName: '' WindowName: 'x64DBG'
- ClassName: '' WindowName: 'x32DBG'
- ClassName: '' WindowName: 'Process List'
- ClassName: '' WindowName: 'Cheat Engine 7.0'
- ClassName: '' WindowName: 'Cheat Engine 7.1'
- ClassName: '' WindowName: 'Cheat Engine 7.2'
- ClassName: '' WindowName: 'Cheat Engine 7.3'
- ClassName: '' WindowName: 'Cheat Engine 7.4'
- ClassName: '' WindowName: 'Cheat Engine'
- ClassName: '' WindowName: 'Memory Viewer'
- ClassName: '' WindowName: 'IDA: Quick start'
- ClassName: '' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: '' WindowName: 'KsDumper'
- ClassName: '' WindowName: 'Snowman'
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c certutil -hashfile "<Full path to file>" MD5 | find /i /v "md5" | find /i /v "certutil"
- '<SYSTEM32>\certutil.exe' -hashfile "<Full path to file>" MD5
- '<SYSTEM32>\find.exe' /i /v "md5"
- '<SYSTEM32>\find.exe' /i /v "certutil"
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c start cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
- '<SYSTEM32>\cmd.exe' /C "color b && title Error && echo SSL connect error && timeout /t 5"
- '<SYSTEM32>\timeout.exe' /t 5