Banco de Dados de Ameaças Troianos Trojan.Kryptik.NFRE

Trojan.Kryptik.NFRE

Por CagedTech em Troianos
Publicado em:
Última atualização:
Traduzir Para:

Cartão de pontuação de ameaças

Classificação de popularidade: 20,414
Nível da Ameaça: 80 % (Alto)
Computadores infectados: 4
Visto pela Primeira Vez: September 24, 2026
Visto pela Última Vez: October 4, 2026
SO (s) Afetados: Windows

Trojan.Kryptik.NFRE é uma ameaça do tipo cavalo de Troia que tem como alvo computadores com Windows. Assim como outros membros da família Kryptik, ele foi projetado para se infiltrar silenciosamente em um sistema, sem o conhecimento ou consentimento do usuário, e então executar ações maliciosas em segundo plano. Pesquisadores de segurança classificam essa ameaça com um alto nível de perigo, refletindo os danos significativos que ela pode causar ao se apoderar de uma máquina infectada.

O que faz o Trojan.Kryptik.NFRE

Uma vez ativo em um sistema, o Trojan.Kryptik.NFRE se comporta de maneira típica de infecções sofisticadas por Trojans. Ele é projetado para obter acesso ao computador comprometido e estabelecer controle sobre funções essenciais do sistema. Ameaças dessa categoria geralmente tentam baixar e instalar componentes maliciosos adicionais, modificar configurações do sistema sem autorização, interferir em ferramentas de segurança e abrir um canal que permite que invasores remotos enviem comandos para a máquina infectada. Dependendo da variante e dos objetivos do invasor, isso pode incluir coletar credenciais armazenadas, registrar as teclas digitadas, capturar telas ou monitorar a atividade online do usuário. Como o malware é projetado para operar de forma oculta, ele geralmente é executado silenciosamente em segundo plano, dificultando a detecção por um usuário sem treinamento.

Como geralmente chega aos computadores

Trojans como este geralmente se espalham por meio de métodos enganosos, em vez de explorar uma única vulnerabilidade específica. Os caminhos de infecção comuns incluem anexos de e-mail disfarçados de faturas, recibos, currículos ou outros documentos aparentemente legítimos, bem como arquivos executáveis agrupados com softwares piratas, programas crackeados ou geradores de chaves. Anúncios maliciosos, sites comprometidos e avisos falsos de atualização de software também podem distribuir esse tipo de carga maliciosa. Como as extensões de arquivo envolvidas podem variar bastante — desde executáveis até documentos ou imagens aparentemente inofensivos — os usuários são frequentemente enganados e abrem o arquivo sem suspeitar de nada.

Riscos para o usuário

Uma infecção ativa desse tipo pode expor o usuário a sérias consequências. Devido às amplas capacidades normalmente associadas aos Trojans da família Kryptik, as vítimas podem sofrer roubo de senhas e informações financeiras, acesso remoto não autorizado ao computador, instalação de outros malwares, arquivos corrompidos ou apagados e uma perda geral de controle sobre as configurações do sistema. Como o Trojan pode funcionar como uma porta dos fundos, ele também pode servir como ponto de entrada para outros ataques, incluindo ransomware ou spyware, agravando os danos ao longo do tempo.

Sinais de infecção

Os trojans são projetados para permanecerem ocultos, mas certos sintomas podem indicar uma infecção. Os usuários devem ficar atentos a lentidão inesperada no desempenho do sistema, processos desconhecidos em execução no Gerenciador de Tarefas, programas que iniciam ou fecham sozinhos, alterações nas configurações do navegador ou de segurança que não foram feitas pelo usuário, atividade de rede incomum mesmo quando o sistema está ocioso e software de segurança desativado ou impossível de atualizar. Travamentos frequentes ou pop-ups inexplicáveis também podem ser sinais de alerta.

Como se manter protegido

A prevenção de infecções começa com hábitos online cautelosos. Os usuários devem evitar abrir anexos de e-mail ou clicar em links de remetentes desconhecidos ou inesperados, abster-se de baixar softwares de fontes não oficiais ou piratas e manter o sistema operacional e os aplicativos instalados atualizados com os patches de segurança mais recentes. Utilizar uma solução antimalware confiável e atualizada, além de realizar verificações regulares do sistema, pode ajudar a detectar e remover ameaças como o Trojan.Kryptik.NFRE antes que causem danos graves. Manter backups regulares de arquivos importantes também reduz o impacto de qualquer possível comprometimento, garantindo que os dados possam ser recuperados mesmo se o sistema for afetado.

Relatório de análise

Informação geral

Nome de família: Trojan.Kryptik.NFRE
Status da assinatura: No Signature

Amostras conhecidas

MD5: f7329b5b0fc724f92c8e5d32354693dc
SHA1: c88c8c84a70f51a3a23c1ee80afce3f7f1259c69
SHA256: 0448EF245659C937AE9226E46487713D7BD2CFBD0D7E0F24017C6C90289D3E46
Tamanho do Arquivo: 6.79 MB.6787839 bytes
MD5: be2fac9ea175929596dfc5fd4d96f2e0
SHA1: 401c57ce42f94f197f875040492badb0f316696f
SHA256: 188BCE62EAE6B5FB9FC3E28F8734EB1F0E1C71B2CD3126358897073204D8EDE5
Tamanho do Arquivo: 622.25 KB.622250 bytes
MD5: 8b16415d153c16c6d86d8da88785d790
SHA1: 957e0ed4aeac7b7d3558734db21e2aab0f126ae1
SHA256: 715B07757808181B3B2046FE4C2F373049688EE41342C701AA99577241B252E5
Tamanho do Arquivo: 6.79 MB.6787183 bytes
MD5: ec3faa430a00a0d5b48bd9c3847ffadc
SHA1: 5feb0407415743ae8caeddb81f7c596c649ff5f0
SHA256: 698BC0CEA28BC9EDAE60273A7ABCE0C5EF3DCA86087A71B95FC82949F4698A94
Tamanho do Arquivo: 131.00 KB.131000 bytes
MD5: 64b250c5436c5e6792c89e38d5b30192
SHA1: 84f97b0e946678b77a9b77cbc4ad601ea3828759
SHA256: A83232C48043EC9954AC4349DDB6B89F926335545BA708E5E48095B9FA2AF085
Tamanho do Arquivo: 6.79 MB.6790385 bytes
Mostrar mais
MD5: 8506089a507d926af7804fc18ba867a6
SHA1: 0986800bd023b2b4b57b307f6712d3c76c70ac46
SHA256: 70071C35DCB2B8F95145C1F252965BC7AA3A49119D0F6D9F35B13C78EF2B9AA4
Tamanho do Arquivo: 6.13 MB.6134943 bytes
MD5: 7fc446210b147c71bccea7c81889b81b
SHA1: 5964a1d153abf58853f87d4d3a545465f9d44a4d
SHA256: 316BFF44736CA0A8020A3A31028559544D19EAB47C9ABE8C0D6D569AAE30CE02
Tamanho do Arquivo: 6.79 MB.6787839 bytes

Atributos do executável portátil do Windows

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have security information
  • File has TLS information
  • File is 64-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
Mostrar mais
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

Ícones de arquivo

Características do arquivo

  • 2+ executable sections
  • big overlay
  • HighEntropy
  • No Version Info
  • upx
  • x64

Informações do bloco

Total de blocos: 70
Blocos potencialmente maliciosos: 7
Blocos permitidos: 61
Blocos desconhecidos: 2

Mapa visual

0 0 0 0 0 0 0 ? x x x x x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ?
0 - Bloco Provavelmente Seguro
? - Bloco Desconhecido
x - Bloco Potencialmente Malicioso

Famílias semelhantes

  • Kryptik.KPG
  • Kryptik.NFRE

Arquivos modificados

Arquivo Atributos
c:\users\user\appdata\local\microsoft\windows\update Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\0986800bd023b2b4b57b307f6712d3c76c70ac46_0006134943 Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\84f97b0e946678b77a9b77cbc4ad601ea3828759_0006790385 Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\957e0ed4aeac7b7d3558734db21e2aab0f126ae1_0006787183 Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\build.json Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\build.json Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839 Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\config.dat Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\config.dat Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\config.json Generic Write,Read Attributes
Mostrar mais
c:\users\user\appdata\local\microsoft\windows\update\config.json Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdateworker.exe Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdateworker.exe Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\runtime_donate_phase.json Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\runtime_donate_phase.json Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\taskmgr_hook.dll Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\taskmgr_hook.dll Synchronize,Write Attributes
c:\users\user\appdata\local\temp\wininetcache\dd.exe Generic Write,Read Attributes
c:\users\user\appdata\local\temp\wininetcache\dd.exe Synchronize,Write Attributes
c:\users\user\appdata\local\temp\wininetcache\ddd.exe Generic Write,Read Attributes
c:\users\user\appdata\local\temp\wininetcache\ddd.exe Synchronize,Write Attributes
c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\windowsupdate.vbs Generic Write,Read Attributes
c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\windowsupdate.vbs Synchronize,Write Attributes

Modificações no Registro

Chave::Valor Dados Nome da API
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839 RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839 RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839 RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\extensions::exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\extensions::.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\features::tamperprotection RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\features::tamperprotection RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe RegNtPreCreateKey
Mostrar mais
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839 RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839 RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\extensions::exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\extensions::.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839 RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::xmrig.exe RegNtPreCreateKey

As 1926 modificações adicionais no registro não são exibidas acima.

Utilização da API do Windows

Categoria API
Syscall Use
  • ntdll.dll!NtAlertThreadByThreadId
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtAssociateWaitCompletionPacket
  • ntdll.dll!NtCancelWaitCompletionPacket
  • ntdll.dll!NtClearEvent
  • ntdll.dll!NtClose
  • ntdll.dll!NtConnectPort
  • ntdll.dll!NtCreateEvent
  • ntdll.dll!NtCreateFile
Mostrar mais
  • ntdll.dll!NtCreateKey
  • ntdll.dll!NtCreateMutant
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtCreateSemaphore
  • ntdll.dll!NtDeleteValueKey
  • ntdll.dll!NtDeviceIoControlFile
  • ntdll.dll!NtDuplicateObject
  • ntdll.dll!NtEnumerateValueKey
  • ntdll.dll!NtFlushBuffersFile
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtNotifyChangeKey
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenSemaphore
  • ntdll.dll!NtPowerInformation
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDirectoryFileEx
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQuerySecurityObject
  • ntdll.dll!NtQuerySystemInformation
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtReadRequestData
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtRequestWaitReplyPort
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationKey
  • ntdll.dll!NtSetInformationObject
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationThread
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtSetTimer2
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtWaitForAlertByThreadId
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWaitLowEventPair
  • ntdll.dll!NtWorkerFactoryWorkerReady
  • ntdll.dll!NtWriteFile
  • UNKNOWN
Process Manipulation Evasion
  • NtUnmapViewOfSection
Process Shell Execute
  • CreateProcess
Network Winsock2
  • WSAGetOverlappedResult
  • WSARecvFrom
  • WSASendTo
  • WSASocket
  • WSAStartup
  • WSAttemptAutodialName
User Data Access
  • GetComputerName
  • GetComputerNameEx
  • GetUserObjectInformation
Encryption Used
  • BCryptOpenAlgorithmProvider
Network Winsock
  • bind
  • closesocket
  • freeaddrinfo
  • getaddrinfo
  • getsockname
  • setsockopt
  • socket
Network Info Queried
  • GetAdaptersAddresses
Network Winhttp
  • WinHttpConnect
  • WinHttpOpen
  • WinHttpOpenRequest
  • WinHttpReceiveResponse
  • WinHttpSendRequest
Anti Debug
  • IsDebuggerPresent
Process Terminate
  • TerminateProcess

Execução de comandos do shell

C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839 (NULL)
C:\Users\Yvztibwz\AppData\Local\Temp\WinInetCache\dd.exe "C:\Users\Yvztibwz\AppData\Local\Temp\WinInetCache\dd.exe"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL LIMITED /TR "C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Delete /F /TN WindowsUpdateBoot
"C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe"
Mostrar mais
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL LIMITED /TR "C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Delete /F /TN WindowsUpdateBoot
"C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe"
"C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL LIMITED /TR "C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Delete /F /TN WindowsUpdateBoot
C:\Users\Slxzpdlz\AppData\Local\Microsoft\Windows\Update\957e0ed4aeac7b7d3558734db21e2aab0f126ae1_0006787183 (NULL)
C:\Users\Slxzpdlz\AppData\Local\Temp\WinInetCache\dd.exe "C:\Users\Slxzpdlz\AppData\Local\Temp\WinInetCache\dd.exe"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL HIGHEST /TR "\"C:\Users\Slxzpdlz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-task"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdateBoot /SC ONSTART /RU SYSTEM /RL HIGHEST /TR "\"C:\Users\Slxzpdlz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-excl"
"C:\Users\Slxzpdlz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe"
"C:\Users\Slxzpdlz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe"
C:\Users\Copboylc\AppData\Local\Microsoft\Windows\Update\84f97b0e946678b77a9b77cbc4ad601ea3828759_0006790385 (NULL)
C:\Users\Copboylc\AppData\Local\Temp\WinInetCache\dd.exe "C:\Users\Copboylc\AppData\Local\Temp\WinInetCache\dd.exe"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL HIGHEST /TR "\"C:\Users\Copboylc\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-task"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdateBoot /SC ONSTART /RU SYSTEM /RL HIGHEST /TR "\"C:\Users\Copboylc\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-excl"
"C:\Users\Copboylc\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe"
"C:\Users\Copboylc\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe"
C:\Users\Akicetwi\AppData\Local\Microsoft\Windows\Update\0986800bd023b2b4b57b307f6712d3c76c70ac46_0006134943 (NULL)
C:\Users\Akicetwi\AppData\Local\Temp\WinInetCache\ddd.exe "C:\Users\Akicetwi\AppData\Local\Temp\WinInetCache\ddd.exe"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL HIGHEST /TR "\"C:\Users\Akicetwi\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-task"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdateBoot /SC ONSTART /RU SYSTEM /RL HIGHEST /TR "\"C:\Users\Akicetwi\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-excl"