Troiano.Cryptik.NFRE

Trojan.Kryptik.NFRE è un trojan che prende di mira i computer con sistema operativo Windows. Come altri membri della famiglia Kryptik, è progettato per infiltrarsi silenziosamente in un sistema, all'insaputa e senza il consenso dell'utente, e per eseguire azioni dannose in background. I ricercatori nel campo della sicurezza classificano questa minaccia con un livello di pericolosità elevato, a testimonianza dei danni significativi che può causare una volta infettato un computer.

Cosa fa Trojan.Kryptik.NFRE

Una volta attivo su un sistema, Trojan.Kryptik.NFRE si comporta in modo tipico delle infezioni Trojan più sofisticate. È progettato per infiltrarsi nel computer compromesso e assumere il controllo delle funzioni chiave del sistema. Le minacce di questa categoria tentano comunemente di scaricare e installare componenti dannosi aggiuntivi, modificare le impostazioni di sistema senza autorizzazione, interferire con gli strumenti di sicurezza e aprire un canale che consenta agli aggressori remoti di impartire comandi alla macchina infetta. A seconda della variante e degli obiettivi dell'aggressore, ciò può includere la raccolta di credenziali memorizzate, la registrazione delle sequenze di tasti, l'acquisizione di screenshot o il monitoraggio dell'attività online dell'utente. Poiché il malware è progettato per operare in modo furtivo, spesso viene eseguito silenziosamente in background, rendendo difficile il rilevamento per un occhio non esperto.

Come solitamente si installa sui computer

I trojan come questo si diffondono in genere tramite metodi ingannevoli piuttosto che sfruttando una singola vulnerabilità specifica. I percorsi di infezione più comuni includono allegati e-mail camuffati da fatture, ricevute, curriculum vitae o altri documenti apparentemente legittimi, nonché file eseguibili inclusi in software pirata, programmi crackati o generatori di chiavi. Anche annunci pubblicitari dannosi, siti web compromessi e falsi avvisi di aggiornamento software possono veicolare questo tipo di payload. Poiché le estensioni dei file coinvolti possono variare notevolmente, da file eseguibili a documenti o immagini apparentemente innocui, gli utenti vengono spesso indotti ad aprire il file senza sospettare nulla di anomalo.

Rischi per l’utente

Un'infezione attiva di questo tipo può esporre l'utente a gravi conseguenze. Date le ampie capacità tipicamente associate ai Trojan della famiglia Kryptik, le vittime potrebbero subire il furto di password e informazioni finanziarie, l'accesso remoto non autorizzato al proprio computer, l'installazione di ulteriore malware, la corruzione o la cancellazione di file e una generale perdita di controllo sulle impostazioni di sistema. Poiché il Trojan può funzionare come backdoor, può anche fungere da punto di ingresso per ulteriori attacchi, tra cui ransomware o spyware, aggravando i danni nel tempo.

Segni di infezione

I trojan sono progettati per rimanere nascosti, ma alcuni sintomi possono indicare un'infezione. Gli utenti dovrebbero prestare attenzione a rallentamenti inaspettati delle prestazioni del sistema, processi sconosciuti in esecuzione in Gestione attività, programmi che si avviano o si chiudono da soli, modifiche alle impostazioni del browser o di sicurezza non effettuate dall'utente, attività di rete insolite anche in stato di inattività e software di sicurezza disabilitato o non aggiornabile. Anche arresti anomali frequenti o finestre pop-up inspiegabili possono essere segnali di allarme.

Come rimanere protetti

Prevenire le infezioni inizia con abitudini online prudenti. Gli utenti dovrebbero evitare di aprire allegati di posta elettronica o di cliccare su link provenienti da mittenti sconosciuti o inaspettati, astenersi dal scaricare software da fonti non ufficiali o pirata e mantenere aggiornati il sistema operativo e le applicazioni installate con le patch di sicurezza più recenti. L'utilizzo di una soluzione antimalware affidabile e aggiornata e l'esecuzione di scansioni di sistema regolari possono aiutare a rilevare e rimuovere minacce come Trojan.Kryptik.NFRE prima che causino danni seri. Mantenere backup regolari dei file importanti riduce inoltre l'impatto di qualsiasi potenziale compromissione, garantendo che i dati possano essere recuperati anche se un sistema viene infettato.

Rapporto di analisi

Informazione Generale

Cognome:	Trojan.Kryptik.NFRE
Stato della firma:	No Signature

Campioni noti

i

Campioni noti

Questa sezione elenca altri campioni di file che si ritiene siano associati a questa famiglia.

MD5: f7329b5b0fc724f92c8e5d32354693dc SHA1: c88c8c84a70f51a3a23c1ee80afce3f7f1259c69 SHA256: 0448EF245659C937AE9226E46487713D7BD2CFBD0D7E0F24017C6C90289D3E46 Dimensione del file: 6.79 MB.6787839 byte

MD5: be2fac9ea175929596dfc5fd4d96f2e0 SHA1: 401c57ce42f94f197f875040492badb0f316696f SHA256: 188BCE62EAE6B5FB9FC3E28F8734EB1F0E1C71B2CD3126358897073204D8EDE5 Dimensione del file: 622.25 KB.622250 byte

MD5: 8b16415d153c16c6d86d8da88785d790 SHA1: 957e0ed4aeac7b7d3558734db21e2aab0f126ae1 SHA256: 715B07757808181B3B2046FE4C2F373049688EE41342C701AA99577241B252E5 Dimensione del file: 6.79 MB.6787183 byte

MD5: ec3faa430a00a0d5b48bd9c3847ffadc SHA1: 5feb0407415743ae8caeddb81f7c596c649ff5f0 SHA256: 698BC0CEA28BC9EDAE60273A7ABCE0C5EF3DCA86087A71B95FC82949F4698A94 Dimensione del file: 131.00 KB.131000 byte

MD5: 64b250c5436c5e6792c89e38d5b30192 SHA1: 84f97b0e946678b77a9b77cbc4ad601ea3828759 SHA256: A83232C48043EC9954AC4349DDB6B89F926335545BA708E5E48095B9FA2AF085 Dimensione del file: 6.79 MB.6790385 byte

Mostra altro

MD5: 8506089a507d926af7804fc18ba867a6 SHA1: 0986800bd023b2b4b57b307f6712d3c76c70ac46 SHA256: 70071C35DCB2B8F95145C1F252965BC7AA3A49119D0F6D9F35B13C78EF2B9AA4 Dimensione del file: 6.13 MB.6134943 byte

MD5: 7fc446210b147c71bccea7c81889b81b SHA1: 5964a1d153abf58853f87d4d3a545465f9d44a4d SHA256: 316BFF44736CA0A8020A3A31028559544D19EAB47C9ABE8C0D6D569AAE30CE02 Dimensione del file: 6.79 MB.6787839 byte

Attributi di Windows Portable Executable

i

Attributi di Windows Portable Executable

Questa sezione elenca gli attributi dei file trovati all'interno dei campioni della famiglia. Questi attributi vengono estratti dalle specifiche Windows PE (Portable Executable) dei file e da vari flag di sistema. Gli attributi Portable Executable forniscono ai ricercatori di malware informazioni sulla funzionalità di un file, sui dettagli dell'eseguibile, sulla piattaforma e sull'ambiente di runtime.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have security information
• File has TLS information
• File is 64-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed

Mostra altro

• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

Icone dei file

i

Icone dei file

Questa sezione mostra le risorse delle icone trovate all'interno dei campioni della famiglia. Il malware spesso replica le icone comunemente associate ai software legittimi per indurre gli utenti a credere che il malware sia sicuro.

Caratteristiche dei file

• 2+ executable sections
• big overlay
• HighEntropy
• No Version Info
• upx
• x64

Informazioni sul blocco

i

Informazioni sul blocco

Durante l'analisi, EnigmaSoft suddivide i campioni di file in blocchi logici per la classificazione e il confronto con altri campioni. I blocchi possono essere utilizzati per generare regole di rilevamento del malware e per raggruppare i campioni di file in famiglie in base al codice sorgente condiviso, alla funzionalità e ad altri attributi e caratteristiche distintive. Questa sezione elenca un riepilogo dei dati dei blocchi, nonché la loro classificazione da parte di EnigmaSoft. Viene inoltre visualizzata una rappresentazione grafica dei dati dei blocchi, ove disponibile.

Blocchi totali:	70
Blocchi potenzialmente dannosi:	7
Blocchi consentiti:	61
Blocchi sconosciuti:	2

Mappa visiva

0 0 0 0 0 0 0 ? x x x x x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ?

0 - Probabile blocco di sicurezza
? - Blocco sconosciuto
x - Blocco potenzialmente dannoso

Famiglie simili

i

Famiglie simili

Questa sezione elenca altre famiglie che presentano similitudini con questa famiglia, sulla base dell'analisi di EnigmaSoft. Molte famiglie di malware sono create a partire dagli stessi toolkit e utilizzano le stesse tecniche di compressione e crittografia, ma ne estendono le funzionalità in modo univoco. Famiglie simili possono anche condividere codice sorgente, attributi, icone, sottocomponenti, firme digitali compromesse e/o non valide e caratteristiche di rete. I ricercatori sfruttano queste somiglianze per analizzare rapidamente ed efficacemente i campioni di file ed estendere le regole di rilevamento del malware.

• Kryptik.KPG
• Kryptik.NFRE

File modificati

i

File modificati

Questa sezione elenca i file creati, modificati, spostati e/o eliminati dai campioni di questa famiglia. L'attività del file system può fornire preziose informazioni sul funzionamento del malware sul sistema operativo.

File	Attributi
c:\users\user\appdata\local\microsoft\windows\update	Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\0986800bd023b2b4b57b307f6712d3c76c70ac46_0006134943	Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\84f97b0e946678b77a9b77cbc4ad601ea3828759_0006790385	Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\957e0ed4aeac7b7d3558734db21e2aab0f126ae1_0006787183	Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\build.json	Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\build.json	Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839	Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\config.dat	Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\config.dat	Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\config.json	Generic Write,Read Attributes

Mostra altro

c:\users\user\appdata\local\microsoft\windows\update\config.json	Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdateworker.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdateworker.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\runtime_donate_phase.json	Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\runtime_donate_phase.json	Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\taskmgr_hook.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\taskmgr_hook.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\wininetcache\dd.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\wininetcache\dd.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\wininetcache\ddd.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\wininetcache\ddd.exe	Synchronize,Write Attributes
c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\windowsupdate.vbs	Generic Write,Read Attributes
c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\windowsupdate.vbs	Synchronize,Write Attributes

Modifiche al registro

i

Modifiche al registro

Questa sezione elenca le chiavi e i valori del registro di sistema creati, modificati e/o eliminati dai campioni di questa famiglia. L'attività del Registro di sistema di Windows può fornire preziose informazioni sulla funzionalità del malware. Inoltre, il malware spesso crea valori nel registro di sistema per potersi avviare automaticamente e persistere indefinitamente dopo che un'infezione iniziale ha compromesso il sistema.

Chiave::Valore	Dati	Nome API
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\extensions::exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\extensions::.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\features::tamperprotection		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\features::tamperprotection		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe		RegNtPreCreateKey

Mostra altro

HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\extensions::exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\extensions::.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\xmrig.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\checker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\watchdog.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\settingssync.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateworker.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\miner.exe		RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::xmrig.exe		RegNtPreCreateKey

Sopra non vengono visualizzate le 1926 modifiche aggiuntive al registro di sistema.

Utilizzo delle API di Windows

i

Utilizzo delle API di Windows

Questa sezione elenca le chiamate API di Windows utilizzate dagli esempi di questa famiglia. L'analisi dell'utilizzo delle API di Windows è uno strumento prezioso che può aiutare a identificare attività dannose, come keylogging, escalation dei privilegi di sicurezza, crittografia dei dati, esfiltrazione di dati, interferenza con software antivirus e manipolazione delle richieste di rete.

Categoria	API
Syscall Use	ntdll.dll!NtAlertThreadByThreadId ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtAssociateWaitCompletionPacket ntdll.dll!NtCancelWaitCompletionPacket ntdll.dll!NtClearEvent ntdll.dll!NtClose ntdll.dll!NtConnectPort ntdll.dll!NtCreateEvent ntdll.dll!NtCreateFile Mostra altro ntdll.dll!NtCreateKey ntdll.dll!NtCreateMutant ntdll.dll!NtCreateSection ntdll.dll!NtCreateSemaphore ntdll.dll!NtDeleteValueKey ntdll.dll!NtDeviceIoControlFile ntdll.dll!NtDuplicateObject ntdll.dll!NtEnumerateValueKey ntdll.dll!NtFlushBuffersFile ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtNotifyChangeKey ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenSection ntdll.dll!NtOpenSemaphore ntdll.dll!NtPowerInformation ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryDirectoryFileEx ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQuerySecurityObject ntdll.dll!NtQuerySystemInformation ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtReadRequestData ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtRequestWaitReplyPort ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationKey ntdll.dll!NtSetInformationObject ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationThread ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSetTimer2 ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtWaitForAlertByThreadId ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWorkerFactoryWorkerReady ntdll.dll!NtWriteFile UNKNOWN
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	CreateProcess
Network Winsock2	WSAGetOverlappedResult WSARecvFrom WSASendTo WSASocket WSAStartup WSAttemptAutodialName
User Data Access	GetComputerName GetComputerNameEx GetUserObjectInformation
Encryption Used	BCryptOpenAlgorithmProvider
Network Winsock	bind closesocket freeaddrinfo getaddrinfo getsockname setsockopt socket
Network Info Queried	GetAdaptersAddresses
Network Winhttp	WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpReceiveResponse WinHttpSendRequest
Anti Debug	IsDebuggerPresent
Process Terminate	TerminateProcess

Esecuzione di comandi shell

i

Esecuzione di comandi shell

Questa sezione elenca i comandi della shell di Windows eseguiti dai campioni di questa famiglia. I comandi della shell di Windows vengono spesso sfruttati dai malware per scopi illeciti e possono essere utilizzati per elevare i privilegi di sicurezza, scaricare e avviare altri malware, sfruttare le vulnerabilità, raccogliere ed esfiltrare dati e nascondere attività dannose.

C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839 (NULL)

C:\Users\Yvztibwz\AppData\Local\Temp\WinInetCache\dd.exe "C:\Users\Yvztibwz\AppData\Local\Temp\WinInetCache\dd.exe"

C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL LIMITED /TR "C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"

C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Delete /F /TN WindowsUpdateBoot

"C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe"

Mostra altro

C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL LIMITED /TR "C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"

C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Delete /F /TN WindowsUpdateBoot

"C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe"

"C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe"

C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL LIMITED /TR "C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"

C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Delete /F /TN WindowsUpdateBoot

C:\Users\Slxzpdlz\AppData\Local\Microsoft\Windows\Update\957e0ed4aeac7b7d3558734db21e2aab0f126ae1_0006787183 (NULL)

C:\Users\Slxzpdlz\AppData\Local\Temp\WinInetCache\dd.exe "C:\Users\Slxzpdlz\AppData\Local\Temp\WinInetCache\dd.exe"

C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL HIGHEST /TR "\"C:\Users\Slxzpdlz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-task"

C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdateBoot /SC ONSTART /RU SYSTEM /RL HIGHEST /TR "\"C:\Users\Slxzpdlz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-excl"

"C:\Users\Slxzpdlz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe"

"C:\Users\Slxzpdlz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe"

C:\Users\Copboylc\AppData\Local\Microsoft\Windows\Update\84f97b0e946678b77a9b77cbc4ad601ea3828759_0006790385 (NULL)

C:\Users\Copboylc\AppData\Local\Temp\WinInetCache\dd.exe "C:\Users\Copboylc\AppData\Local\Temp\WinInetCache\dd.exe"

C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL HIGHEST /TR "\"C:\Users\Copboylc\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-task"

C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdateBoot /SC ONSTART /RU SYSTEM /RL HIGHEST /TR "\"C:\Users\Copboylc\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-excl"

"C:\Users\Copboylc\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe"

"C:\Users\Copboylc\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe"

C:\Users\Akicetwi\AppData\Local\Microsoft\Windows\Update\0986800bd023b2b4b57b307f6712d3c76c70ac46_0006134943 (NULL)

C:\Users\Akicetwi\AppData\Local\Temp\WinInetCache\ddd.exe "C:\Users\Akicetwi\AppData\Local\Temp\WinInetCache\ddd.exe"

C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL HIGHEST /TR "\"C:\Users\Akicetwi\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-task"

C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdateBoot /SC ONSTART /RU SYSTEM /RL HIGHEST /TR "\"C:\Users\Akicetwi\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-excl"