Procedure examples

PowerDuke has a command to get text of the current foreground window.

PAKLOG has used `GetForegroundWindow` to access the foreground window. PAKLOG has also captured text from the foreground windows.

TONESHELL has used `GetForegroundWindow` to detect virtualization or sandboxes by calling the API twice and comparing each window handle.

NETWIRE can discover and close windows on controlled systems.

Aria-body has the ability to identify the titles of running windows on a compromised host.

DUSTTRAP can enumerate running application windows.

Machete saves the window names.

InvisiMole can enumerate windows and child windows on a compromised host.

WINERACK can enumerate active windows.

Kazuar gathers information about opened windows.

Flagpro can check the name of the window displayed on the system.

ROKRAT can use the `GetForegroundWindow` and `GetWindowText` APIs to discover where the user is typing.

DarkWatchman reports window names along with keylogger information to provide application context.

DarkGate will search for cryptocurrency wallets by examining application window names for specific strings. DarkGate extracts information collected via NirSoft tools from the hosting process's memory by first identifying the window through the FindWindow API function.

Metamorfo can enumerate all windows on the victim’s machine.

Trojan.Karagany can monitor the titles of open windows to identify specific keywords.

Catchamas obtains application windows titles and then determines which windows to perform Screen Capture on.

Attor can obtain application window titles and then determines which windows to perform Screen Capture on.

NightClub can use `GetForegroundWindow` to enumerate the active window.

Grandoreiro can identify installed security tools based on window names.

SOUNDBITE is capable of enumerating application windows.

Cadelspy has the ability to identify open windows on the compromised host.

HotCroissant has the ability to list the names of all open windows on the infected host.

PoisonIvy captures window titles.

PLEAD has the ability to list open windows on the compromised host.

FunnyDream has the ability to discover application windows via execution of `EnumWindows`.

NetTraveler reports window names along with keylogger information to provide application context.

njRAT gathers information about opened windows during the initial infection.

Remexi has a command to capture active windows on the machine and retrieve window titles.

QakBot has the ability to enumerate windows on a compromised host.

SILENTTRINITY can enumerate the active Window during keylogging through execution of `GetActiveWindowTitle`.

Remcos can list all windows on victim systems.

APT-C-36 used a customized version of QuasarRAT to monitor browser windows for strings relating to specific Colombian financial institutions.

The discovery modules used with Duqu can collect information on open windows.