قاعدة بيانات التهديد أحصنة طروادة Trojan.Kryptik.NFRE

Trojan.Kryptik.NFRE

بواسطة CagedTech في أحصنة طروادة
تاريخ النشر:
آخر تحديث:
ترجمة الى:

التهديدات بطاقة الأداء

ترتيب الشعبية: 20,414
مستوى التهديد: 80 % (عالي)
أجهزة الكمبيوتر المصابة: 4
الروية الأولى: September 24, 2026
اخر ظهور: October 4, 2026
نظام (أنظمة) متأثر: Windows

يُعدّ Trojan.Kryptik.NFRE برنامجًا خبيثًا من نوع حصان طروادة يستهدف أجهزة الكمبيوتر التي تعمل بنظام ويندوز. وكغيره من برامج عائلة Kryptik، صُمّم هذا البرنامج للتسلل إلى النظام خلسةً، دون علم المستخدم أو موافقته، ثمّ تنفيذ عمليات ضارة في الخلفية. يصنّف باحثو الأمن هذا التهديد ضمن فئة الخطر العالي، نظرًا للضرر البالغ الذي يُمكن أن يُلحقه بمجرد سيطرته على جهاز مُصاب.

ما يفعله برنامج Trojan.Kryptik.NFRE

بمجرد تفعيلها على النظام، تتصرف برمجية Trojan.Kryptik.NFRE الخبيثة بطريقة نموذجية لهجمات أحصنة طروادة المتطورة. صُممت هذه البرمجية للسيطرة على جهاز الكمبيوتر المخترق والتحكم في وظائف النظام الرئيسية. عادةً ما تحاول التهديدات من هذه الفئة تنزيل وتثبيت مكونات خبيثة إضافية، وتعديل إعدادات النظام دون إذن، والتدخل في أدوات الأمان، وفتح قناة تسمح للمهاجمين عن بُعد بإصدار أوامر للجهاز المصاب. اعتمادًا على نوع البرمجية الخبيثة وأهداف المهاجم، قد يشمل ذلك جمع بيانات الاعتماد المخزنة، وتسجيل ضغطات المفاتيح، والتقاط لقطات شاشة، أو مراقبة نشاط المستخدم على الإنترنت. ولأن هذه البرمجية الخبيثة مصممة للعمل سرًا، فإنها غالبًا ما تعمل بصمت في الخلفية، مما يجعل اكتشافها صعبًا على غير المتخصصين.

كيف يصل عادةً إلى أجهزة الكمبيوتر

تنتشر برامج التجسس الخبيثة من هذا النوع عادةً عبر أساليب خادعة بدلاً من استغلال ثغرة أمنية محددة. تشمل طرق الإصابة الشائعة مرفقات البريد الإلكتروني المُتنكرة في هيئة فواتير أو إيصالات أو سير ذاتية أو غيرها من المستندات التي تبدو شرعية، بالإضافة إلى الملفات التنفيذية المُرفقة ببرامج مقرصنة أو برامج مُخترقة أو مولدات مفاتيح. كما يمكن للإعلانات الخبيثة والمواقع الإلكترونية المخترقة وإشعارات تحديث البرامج المزيفة أن تنقل هذا النوع من البرامج الضارة. ونظرًا لتنوع امتدادات الملفات المُستخدمة - بدءًا من الملفات التنفيذية وصولًا إلى المستندات أو الصور التي تبدو غير ضارة - غالبًا ما ينخدع المستخدمون ويفتحون الملف دون أن يدركوا وجود أي مشكلة.

المخاطر التي قد يتعرض لها المستخدم

قد يُعرّض هذا النوع من الإصابات النشطة المستخدم لعواقب وخيمة. ونظرًا للإمكانيات الواسعة التي تتميز بها برامج التجسس من عائلة كريبتيك، فقد يواجه الضحايا سرقة كلمات المرور والمعلومات المالية، والوصول عن بُعد غير المصرح به إلى أجهزتهم، وتثبيت برامج ضارة أخرى، وتلف الملفات أو حذفها، وفقدان السيطرة على إعدادات النظام. ولأن هذا البرنامج الخبيث يعمل كباب خلفي، فقد يُشكّل أيضًا نقطة دخول لهجمات إضافية، بما في ذلك برامج الفدية أو برامج التجسس، مما يُفاقم الضرر بمرور الوقت.

علامات العدوى

صُممت برامج التجسس الخبيثة لتبقى مخفية، لكن بعض الأعراض قد تشير إلى اختراقها. ينبغي على المستخدمين مراقبة أي تباطؤ غير متوقع في أداء النظام، أو تشغيل عمليات غير مألوفة في إدارة المهام، أو تشغيل البرامج أو إغلاقها تلقائيًا، أو إجراء تغييرات على إعدادات المتصفح أو الأمان دون علم المستخدم، أو نشاط غير معتاد على الشبكة حتى في حالة الخمول، أو تعطيل برامج الحماية أو عدم القدرة على تحديثها. كما تُعدّ الأعطال المتكررة أو النوافذ المنبثقة غير المبررة علامات تحذيرية.

كيفية الحفاظ على الحماية

تبدأ الوقاية من العدوى باتباع عادات حذرة على الإنترنت. ينبغي على المستخدمين تجنب فتح مرفقات البريد الإلكتروني أو النقر على الروابط من مرسلين مجهولين أو غير متوقعين، والامتناع عن تنزيل البرامج من مصادر غير رسمية أو مقرصنة، والحرص على تحديث نظام التشغيل والتطبيقات المثبتة بأحدث التحديثات الأمنية. كما أن استخدام برنامج موثوق ومحدث لمكافحة البرامج الضارة، وإجراء فحوصات دورية للنظام، يساعد في اكتشاف وإزالة تهديدات مثل Trojan.Kryptik.NFRE قبل أن تتسبب في أضرار جسيمة. كذلك، فإن الاحتفاظ بنسخ احتياطية منتظمة للملفات المهمة يقلل من تأثير أي اختراق محتمل، ويضمن إمكانية استعادة البيانات حتى في حال إصابة النظام.

تقرير التحليل

معلومات عامة

اسم العائلة: Trojan.Kryptik.NFRE
حالة التوقيع: No Signature

عينات معروفة

MD5: f7329b5b0fc724f92c8e5d32354693dc
SHA1: c88c8c84a70f51a3a23c1ee80afce3f7f1259c69
SHA256: 0448EF245659C937AE9226E46487713D7BD2CFBD0D7E0F24017C6C90289D3E46
حجم الملف: 6.79 MB,6787839 بايت
MD5: be2fac9ea175929596dfc5fd4d96f2e0
SHA1: 401c57ce42f94f197f875040492badb0f316696f
SHA256: 188BCE62EAE6B5FB9FC3E28F8734EB1F0E1C71B2CD3126358897073204D8EDE5
حجم الملف: 622.25 KB,622250 بايت
MD5: 8b16415d153c16c6d86d8da88785d790
SHA1: 957e0ed4aeac7b7d3558734db21e2aab0f126ae1
SHA256: 715B07757808181B3B2046FE4C2F373049688EE41342C701AA99577241B252E5
حجم الملف: 6.79 MB,6787183 بايت
MD5: ec3faa430a00a0d5b48bd9c3847ffadc
SHA1: 5feb0407415743ae8caeddb81f7c596c649ff5f0
SHA256: 698BC0CEA28BC9EDAE60273A7ABCE0C5EF3DCA86087A71B95FC82949F4698A94
حجم الملف: 131.00 KB,131000 بايت
MD5: 64b250c5436c5e6792c89e38d5b30192
SHA1: 84f97b0e946678b77a9b77cbc4ad601ea3828759
SHA256: A83232C48043EC9954AC4349DDB6B89F926335545BA708E5E48095B9FA2AF085
حجم الملف: 6.79 MB,6790385 بايت
عرض المزيد
MD5: 8506089a507d926af7804fc18ba867a6
SHA1: 0986800bd023b2b4b57b307f6712d3c76c70ac46
SHA256: 70071C35DCB2B8F95145C1F252965BC7AA3A49119D0F6D9F35B13C78EF2B9AA4
حجم الملف: 6.13 MB,6134943 بايت
MD5: 7fc446210b147c71bccea7c81889b81b
SHA1: 5964a1d153abf58853f87d4d3a545465f9d44a4d
SHA256: 316BFF44736CA0A8020A3A31028559544D19EAB47C9ABE8C0D6D569AAE30CE02
حجم الملف: 6.79 MB,6787839 بايت

سمات الملفات التنفيذية المحمولة لنظام التشغيل Windows

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have security information
  • File has TLS information
  • File is 64-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
عرض المزيد
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

أيقونات الملفات

سمات الملف

  • 2+ executable sections
  • big overlay
  • HighEntropy
  • No Version Info
  • upx
  • x64

معلومات عن الكتلة

إجمالي الكتل: 70
الكتل التي يحتمل أن تكون ضارة: 7
الكتل المسموح بها: 61
كتل غير معروفة: 2

خريطة مرئية

0 0 0 0 0 0 0 ? x x x x x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ?
0 - كتلة آمنة محتملة
? - كتلة غير معروفة
x - حظر يحتمل أن يكون خبيثًا

عائلات متشابهة

  • Kryptik.KPG
  • Kryptik.NFRE

تم تعديل الملفات

ملف صفات
c:\users\user\appdata\local\microsoft\windows\update Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\0986800bd023b2b4b57b307f6712d3c76c70ac46_0006134943 Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\84f97b0e946678b77a9b77cbc4ad601ea3828759_0006790385 Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\957e0ed4aeac7b7d3558734db21e2aab0f126ae1_0006787183 Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\build.json Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\build.json Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839 Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\config.dat Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\config.dat Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\config.json Generic Write,Read Attributes
عرض المزيد
c:\users\user\appdata\local\microsoft\windows\update\config.json Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdateworker.exe Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdateworker.exe Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\runtime_donate_phase.json Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\runtime_donate_phase.json Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\taskmgr_hook.dll Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\taskmgr_hook.dll Synchronize,Write Attributes
c:\users\user\appdata\local\temp\wininetcache\dd.exe Generic Write,Read Attributes
c:\users\user\appdata\local\temp\wininetcache\dd.exe Synchronize,Write Attributes
c:\users\user\appdata\local\temp\wininetcache\ddd.exe Generic Write,Read Attributes
c:\users\user\appdata\local\temp\wininetcache\ddd.exe Synchronize,Write Attributes
c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\windowsupdate.vbs Generic Write,Read Attributes
c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\windowsupdate.vbs Synchronize,Write Attributes

تعديلات السجل

المفتاح::القيمة بيانات اسم واجهة برمجة التطبيقات
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839 RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839 RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839 RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\extensions::exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\extensions::.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\features::tamperprotection RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\features::tamperprotection RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe RegNtPreCreateKey
عرض المزيد
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839 RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839 RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\extensions::exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\extensions::.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839 RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::xmrig.exe RegNtPreCreateKey

لم يتم عرض 1926 تعديلًا إضافيًا في سجل النظام أعلاه.

استخدام واجهة برمجة تطبيقات ويندوز

فئة واجهة برمجة التطبيقات (API)
Syscall Use
  • ntdll.dll!NtAlertThreadByThreadId
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtAssociateWaitCompletionPacket
  • ntdll.dll!NtCancelWaitCompletionPacket
  • ntdll.dll!NtClearEvent
  • ntdll.dll!NtClose
  • ntdll.dll!NtConnectPort
  • ntdll.dll!NtCreateEvent
  • ntdll.dll!NtCreateFile
عرض المزيد
  • ntdll.dll!NtCreateKey
  • ntdll.dll!NtCreateMutant
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtCreateSemaphore
  • ntdll.dll!NtDeleteValueKey
  • ntdll.dll!NtDeviceIoControlFile
  • ntdll.dll!NtDuplicateObject
  • ntdll.dll!NtEnumerateValueKey
  • ntdll.dll!NtFlushBuffersFile
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtNotifyChangeKey
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenSemaphore
  • ntdll.dll!NtPowerInformation
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDirectoryFileEx
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQuerySecurityObject
  • ntdll.dll!NtQuerySystemInformation
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtReadRequestData
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtRequestWaitReplyPort
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationKey
  • ntdll.dll!NtSetInformationObject
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationThread
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtSetTimer2
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtWaitForAlertByThreadId
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWaitLowEventPair
  • ntdll.dll!NtWorkerFactoryWorkerReady
  • ntdll.dll!NtWriteFile
  • UNKNOWN
Process Manipulation Evasion
  • NtUnmapViewOfSection
Process Shell Execute
  • CreateProcess
Network Winsock2
  • WSAGetOverlappedResult
  • WSARecvFrom
  • WSASendTo
  • WSASocket
  • WSAStartup
  • WSAttemptAutodialName
User Data Access
  • GetComputerName
  • GetComputerNameEx
  • GetUserObjectInformation
Encryption Used
  • BCryptOpenAlgorithmProvider
Network Winsock
  • bind
  • closesocket
  • freeaddrinfo
  • getaddrinfo
  • getsockname
  • setsockopt
  • socket
Network Info Queried
  • GetAdaptersAddresses
Network Winhttp
  • WinHttpConnect
  • WinHttpOpen
  • WinHttpOpenRequest
  • WinHttpReceiveResponse
  • WinHttpSendRequest
Anti Debug
  • IsDebuggerPresent
Process Terminate
  • TerminateProcess

تنفيذ أوامر شل

C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839 (NULL)
C:\Users\Yvztibwz\AppData\Local\Temp\WinInetCache\dd.exe "C:\Users\Yvztibwz\AppData\Local\Temp\WinInetCache\dd.exe"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL LIMITED /TR "C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Delete /F /TN WindowsUpdateBoot
"C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe"
عرض المزيد
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL LIMITED /TR "C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Delete /F /TN WindowsUpdateBoot
"C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe"
"C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL LIMITED /TR "C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Delete /F /TN WindowsUpdateBoot
C:\Users\Slxzpdlz\AppData\Local\Microsoft\Windows\Update\957e0ed4aeac7b7d3558734db21e2aab0f126ae1_0006787183 (NULL)
C:\Users\Slxzpdlz\AppData\Local\Temp\WinInetCache\dd.exe "C:\Users\Slxzpdlz\AppData\Local\Temp\WinInetCache\dd.exe"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL HIGHEST /TR "\"C:\Users\Slxzpdlz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-task"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdateBoot /SC ONSTART /RU SYSTEM /RL HIGHEST /TR "\"C:\Users\Slxzpdlz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-excl"
"C:\Users\Slxzpdlz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe"
"C:\Users\Slxzpdlz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe"
C:\Users\Copboylc\AppData\Local\Microsoft\Windows\Update\84f97b0e946678b77a9b77cbc4ad601ea3828759_0006790385 (NULL)
C:\Users\Copboylc\AppData\Local\Temp\WinInetCache\dd.exe "C:\Users\Copboylc\AppData\Local\Temp\WinInetCache\dd.exe"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL HIGHEST /TR "\"C:\Users\Copboylc\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-task"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdateBoot /SC ONSTART /RU SYSTEM /RL HIGHEST /TR "\"C:\Users\Copboylc\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-excl"
"C:\Users\Copboylc\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe"
"C:\Users\Copboylc\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe"
C:\Users\Akicetwi\AppData\Local\Microsoft\Windows\Update\0986800bd023b2b4b57b307f6712d3c76c70ac46_0006134943 (NULL)
C:\Users\Akicetwi\AppData\Local\Temp\WinInetCache\ddd.exe "C:\Users\Akicetwi\AppData\Local\Temp\WinInetCache\ddd.exe"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL HIGHEST /TR "\"C:\Users\Akicetwi\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-task"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdateBoot /SC ONSTART /RU SYSTEM /RL HIGHEST /TR "\"C:\Users\Akicetwi\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-excl"