PUP.HWIDChanger.X
PUP.HWIDChanger.X是潜在有害程序 (PUP) 的检测名称，这类程序属于硬件 ID (HWID) 欺骗或更改工具的范畴。这些实用程序通常被宣传为可以更改或掩盖计算机的唯一硬件标识符，其目的往往是为了帮助用户绕过在线游戏、软件许可系统或其他追踪硬件指纹的服务所施加的封禁。虽然其宣称的目的听起来可能无害，甚至对某些用户来说还很有用，但由于其传播方式、对系统造成的更改以及引入的安全风险，被标记为 PUP.HWIDChanger.X 的程序都被视为有害程序。
目录
PUP.HWIDChanger.X 的作用
被识别为 PUP.HWIDChanger.X 的程序通常会尝试修改与计算机硬件关联的底层系统标识符，例如与网络适配器、存储驱动器或其他应用程序用于识别特定计算机的组件相关的值。为了实现这一点，此类工具通常需要提升的管理员权限，并且可能会对系统设置或 Windows 注册表进行超出普通用户程序所需的更改。这种深度系统访问是此类潜在有害程序的典型特征，因为它会破坏操作系统的稳定性、干扰合法软件或与安全工具产生冲突。
许多硬件ID更改工具还会要求用户在安装前禁用杀毒软件或其他防护软件，声称这是程序正常运行的必要条件。这是潜在有害程序（PUP）的常见且令人担忧的特点，因为禁用安全防护会使系统暴露于其他潜在更危险的威胁之下。
它通常是如何进入电脑的
与大多数潜在有害程序一样，硬件ID修改工具通常通过非官方渠道而非可信的软件商店传播。常见的传播方式包括从专门用于绕过游戏封禁或软件限制的论坛下载、从文件共享网站下载，以及与破解版或盗版软件捆绑销售。用户往往会主动寻找这些工具，但可能并未充分意识到其中捆绑的额外程序、广告软件组件或安全风险。
用户面临的风险
由于 PUP.HWIDChanger.X 需要对系统进行深度修改，并且通常会要求用户降低安全防护级别，因此它可能使计算机面临多种风险。这些风险包括系统不稳定、意外崩溃或与合法驱动程序和软件冲突。此外，还存在二次感染的风险，因为从非官方渠道获取的工具通常会捆绑广告软件、浏览器劫持程序或其他更严重的恶意软件。另外，使用此类工具绕过封禁或许可限制可能违反相关平台的服务条款，从而导致相应的后果。
感染迹象
用户在安装此类程序后可能会注意到系统出现异常行为，包括系统设置意外更改、提示禁用安全软件或启动项中出现陌生条目。系统运行速度变慢、出现意外弹出窗口或出现额外的工具栏或应用程序也可能表明硬件 ID 更改工具带来了不必要的附加组件。
如何做好防护
为了避免感染 PUP.HWIDChanger.X 等潜在有害程序，最好不要从非官方论坛、破解软件仓库或声称可以绕过封禁和限制的网站下载软件。保持安全软件处于激活和更新状态，避免接受禁用保护的请求，并仔细检查安装提示中捆绑的额外程序，这些都是降低风险的有效方法。定期扫描系统并检查已安装程序也有助于识别并移除有害软件，防止其造成更多问题。
分析报告
一般信息
| 姓： | PUP.HWIDChanger.X |
|---|---|
| 签名状态： | No Signature |
已知样本
已知样本
本节列出了其他据信与该家族有关的文件样本。|
MD5:
21adff0121ec88e41b66b6f7d60a74db
SHA1:
d79ec8fe336f98826b7ceb6e6e5bc0771c451552
SHA256:
010CE3183A0DE0AD656952889E9F4313F8F96FCC9D4A87A5C718F3D10651764D
文件大小:
180.22 KB,180224字节
|
Windows 可移植可执行文件属性
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have security information
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
文件特征
- fptable
- No Version Info
- x64
区块信息
区块信息
在分析过程中，EnigmaSoft 会将文件样本分解成逻辑块，以便进行分类并与其他样本进行比较。这些逻辑块可用于生成恶意软件检测规则，并根据共享的源代码、功能以及其他显著属性和特征将文件样本分组到不同的家族中。本节概述了这些逻辑块数据及其 EnigmaSoft 分类结果。如果可用，还会显示逻辑块数据的可视化表示。| 总区块数： | 569 |
|---|---|
| 潜在恶意块： | 20 |
| 白名单区块： | 540 |
| 未知区块： | 9 |
可视化地图
0
0
?
?
?
?
?
x
?
x
x
?
1
x
x
x
x
x
0
?
x
x
x
x
x
0
?
x
x
x
x
x
0
x
0
x
2
0
0
0
0
1
0
1
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
1
0
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0 - 可能的保险箱
? - 未知区块
x - 潜在恶意拦截
? - 未知区块
x - 潜在恶意拦截
相似家庭
相似家庭
本节根据 EnigmaSoft 的分析，列出了与此恶意软件家族具有相似性的其他家族。许多恶意软件家族都基于相同的恶意软件工具包创建，并使用相同的打包和加密技术，但各自扩展了独特的功能。相似的家族可能共享源代码、属性、图标、子组件、受损和/或无效的数字签名以及网络特征。研究人员利用这些相似性来快速有效地对文件样本进行分类，并扩展恶意软件检测规则。- Trojan.Injector.Gen.JZV
- Trojan.Kryptik.Gen.KTZ
文件已修改
文件已修改
本节列出了该系列样本创建、修改、移动和/或删除的文件。文件系统活动可以帮助我们深入了解恶意软件在操作系统上的运行方式。| 文件 | 属性 |
|---|---|
| \device\namedpipe\gmdasllogger | Generic Write,Read Attributes |
| \device\namedpipe\srvsvc | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c: | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\programdata\microsoft\windows\wer | Synchronize,Write Attributes |
| c:\programdata\ntuser.pol | Synchronize,Write Attributes |
| c:\system volume information\tracking.log | Synchronize,Write Attributes |
| c:\users\default\ntuser.dat | Synchronize,Write Attributes |
| c:\users\public\libraries | Synchronize,Write Attributes |
| c:\users\user\appdata\local\d3dscache | Synchronize,Write Attributes |
| c:\users\user\appdata\local\microsoft\feeds | Synchronize,Write Attributes |
显示更多
| c:\users\user\appdata\local\microsoft\feeds cache | Synchronize,Write Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcache | Synchronize,Write Attributes |
| c:\users\user\appdata\local\microsoft\windows\inetcookies | Synchronize,Write Attributes |
| c:\users\user\appdata\local\microsoft\windows\webcache | Synchronize,Write Attributes |
| c:\users\user\appdata\local\microsoft\xboxlive\authstatecache.dat | Synchronize,Write Attributes |
| c:\windows\inf\setupapi.dev.log | Synchronize,Write Attributes |
| c:\windows\inf\setupapi.setup.log | Synchronize,Write Attributes |
| c:\windows\prefetch\agapplaunch.db | Synchronize,Write Attributes |
| c:\windows\prefetch\agcx_s1_s-1-5-21-3119368278-1123331430-659265220-1001.snp.db | Synchronize,Write Attributes |
| c:\windows\prefetch\agcx_sc4.db | Synchronize,Write Attributes |
| c:\windows\prefetch\agglfaulthistory.db | Synchronize,Write Attributes |
| c:\windows\prefetch\agglfgapphistory.db | Synchronize,Write Attributes |
| c:\windows\prefetch\agglglobalhistory.db | Synchronize,Write Attributes |
| c:\windows\prefetch\aggluad_p_s-1-5-21-3119368278-1123331430-659265220-1001.db | Synchronize,Write Attributes |
| c:\windows\prefetch\aggluad_s-1-5-21-3119368278-1123331430-659265220-1001.db | Synchronize,Write Attributes |
| c:\windows\prefetch\agrobust.db | Synchronize,Write Attributes |
| c:\windows\prefetch\applicationframehost.exe-cceef759.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\atbroker.exe-2e15a492.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\backgroundtaskhost.exe-353e93dd.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\backgroundtaskhost.exe-d61f7b44.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\backgroundtransferhost.exe-0849bbbc.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\backgroundtransferhost.exe-11ae310d.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\backgroundtransferhost.exe-4abde2db.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\backgroundtransferhost.exe-4fd26b36.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\backgroundtransferhost.exe-7f685c33.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\backgroundtransferhost.exe-bf0ae715.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\backgroundtransferhost.exe-fae7d0ad.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\cadrespri.7db | Synchronize,Write Attributes |
| c:\windows\prefetch\cleanmgr.exe-e3c5e89d.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\cmd.exe-4a81b364.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\compattelrunner.exe-db97728f.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\conhost.exe-1f3e9d7e.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\consent.exe-531bd9ea.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\csrss.exe-3fe41f7e.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\ctfmon.exe-9450846b.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\defrag.exe-588f90ad.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\dllhost.exe-041f1888.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\dllhost.exe-0ad6ac16.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\dllhost.exe-2e884d3e.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\dllhost.exe-41467c2f.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\dllhost.exe-5a984e5f.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\dllhost.exe-823ca4da.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\dllhost.exe-88f23425.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\dllhost.exe-9037274d.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\dllhost.exe-b9b46003.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\dllhost.exe-ea533aaf.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\dwm.exe-6ffd3da8.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\dynrespri.7db | Synchronize,Write Attributes |
| c:\windows\prefetch\easeofaccessdialog.exe-2b345401.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\explorer.exe-a80e4f97.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\fontdrvhost.exe-31e45f6d.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\gamebar.exe-0464a06b.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\gamebar.exe-1cad104d.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\gamebar.exe-440f564f.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\gamebar.exe-81633501.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\gamebar.exe-8e91ee43.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\gamebar.exe-9e08df9d.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\gamebar.exe-9ed2879f.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\gamebar.exe-a4611e03.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\gamebar.exe-ca1600f5.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\gamebar.exe-d0b55d8b.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\gamebar.exe-dd84965f.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\gamebar.exe-fb17a891.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\gamebar.exe-fb93a8a1.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\gamebarftserver.exe-436c0bb2.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\gamebarftserver.exe-44b54636.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\gethelp.exe-243ba475.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\layout.ini | Synchronize,Write Attributes |
| c:\windows\prefetch\lockapp.exe-59620d5a.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\lockapp.exe-baddc799.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\logonui.exe-09140401.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\makecab.exe-0f1704a4.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\microsoft.photos.exe-a6cf5fcb.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\microsoftedge_x64_143.0.3650.-64e2136d.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\microsoftedge_x64_143.0.3650.-68a2aa4a.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\microsoftedge_x64_147.0.3912.-3007787d.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\microsoftedge_x64_147.0.3912.-b92690db.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\microsoftedge_x64_147.0.3912.-e31f5cd3.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\microsoftedge_x64_147.0.3912.-e4761e2d.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\microsoftedge_x64_147.0.3912.-f8e2dff7.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\microsoftedge_x64_148.0.3967.-4596b43c.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\microsoftedge_x64_148.0.3967.-848124ee.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\microsoftedge_x64_154.0.4258.-19e3ad99.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\microsoftedge_x64_154.0.4258.-522a17ca.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\microsoftedgeupdate.exe-161141e4.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\microsoftedgeupdate.exe-223adf78.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\microsoftedgeupdate.exe-23ea12c9.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\microsoftedgeupdate.exe-4f9082d9.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\microsoftedgeupdate.exe-c4317749.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\microsoftedgeupdate.exe-ec67f03a.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\microsoftedgeupdatesetup_x86_-370d86c6.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\microsoftedgeupdatesetup_x86_-41269959.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\microsoftedgeupdatesetup_x86_-63832945.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\microsoftedgeupdatesetup_x86_-6a0ad7f2.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\microsoftedgeupdatesetup_x86_-9442561a.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\mmc.exe-381384ef.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\mmc.exe-667e9ca3.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\mmc.exe-7fbb0956.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\mmc.exe-cab79805.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\mobsync.exe-c5e2284f.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\mousocoreworker.exe-681a8fee.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\mscorsvw.exe-57d17daf.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\mscorsvw.exe-c3c515bd.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\msedge.exe-78f14b85.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\msiexec.exe-a2d55cb6.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\msinfo32.exe-95097b65.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\musnotificationux.exe-48ffd505.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\net.exe-df44f913.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\netplwiz.exe-52789dd1.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\ngen.exe-ae594a6b.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\ngen.exe-ec3f9239.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\ngentask.exe-4f8bd802.pf | Synchronize,Write Attributes |
| c:\windows\prefetch\ngentask.exe-bb7f7010.pf | Synchronize,Write Attributes |
注册表修改
注册表修改
本节列出了此系列样本创建、修改和/或删除的注册表项和值。Windows 注册表活动可以提供关于恶意软件功能的宝贵信息。此外，恶意软件通常会创建注册表值，以便在初始感染系统后自动启动并无限期地持续存在。| 键::值 | 数据 | API名称 |
|---|---|---|
| HKLM\system\hardwareconfig::lastconfig | {f1eaebb5-4d2f-7711-a017-94b444b44f11} | RegNtPreCreateKey |
| HKLM\system\hardwareconfig\{f1eaebb5-4d2f-7711-a017-94b444b44f11}::id | RegNtPreCreateKey | |
| HKLM\system\hardwareconfig\{f1eaebb5-4d2f-7711-a017-94b444b44f11}::lastuse | ⭀謱ُǛ | RegNtPreCreateKey |
| HKLM\system\hardwareconfig\{f1eaebb5-4d2f-7711-a017-94b444b44f11}::systembiosversion | Xen - 0 Revision: 1.221 | RegNtPreCreateKey |
| HKLM\system\hardwareconfig\{f1eaebb5-4d2f-7711-a017-94b444b44f11}::enclosuretype | RegNtPreCreateKey | |
| HKLM\system\hardwareconfig\{f1eaebb5-4d2f-7711-a017-94b444b44f11}::systemmanufacturer | Xen | RegNtPreCreateKey |
| HKLM\system\hardwareconfig\{f1eaebb5-4d2f-7711-a017-94b444b44f11}::systemproductname | HVM domU | RegNtPreCreateKey |
| HKLM\system\hardwareconfig\{f1eaebb5-4d2f-7711-a017-94b444b44f11}::biosvendor | Xen | RegNtPreCreateKey |
| HKLM\system\hardwareconfig\{f1eaebb5-4d2f-7711-a017-94b444b44f11}::biosversion | 4.13 | RegNtPreCreateKey |
| HKLM\system\hardwareconfig\{f1eaebb5-4d2f-7711-a017-94b444b44f11}::biosreleasedate | 11/17/2023 | RegNtPreCreateKey |
显示更多
| HKLM\system\hardwareconfig\{f1eaebb5-4d2f-7711-a017-94b444b44f11}::systemversion | 4.13 | RegNtPreCreateKey |
| HKLM\system\hardwareconfig\{f1eaebb5-4d2f-7711-a017-94b444b44f11}::bootdriverflags | RegNtPreCreateKey | |
| HKLM\system\hardwareconfig\{f1eaebb5-4d2f-7711-a017-94b444b44f11}\computerids::{db2321af-1d6a-5ce8-954f-9680c4914ba3} | Xen&&HVM domU&Xen&4.13&04&0d | RegNtPreCreateKey |
| HKLM\system\hardwareconfig\{f1eaebb5-4d2f-7711-a017-94b444b44f11}\computerids::{a190f5c1-b5c7-5746-8ace-b8917e90d585} | Xen&HVM domU&Xen&4.13&04&0d | RegNtPreCreateKey |
| HKLM\system\hardwareconfig\{f1eaebb5-4d2f-7711-a017-94b444b44f11}\computerids::{67f9d617-c18a-54ea-83d9-9dbb8af9e472} | Xen&&HVM domU | RegNtPreCreateKey |
| HKLM\system\hardwareconfig\{f1eaebb5-4d2f-7711-a017-94b444b44f11}\computerids::{ef48adbc-f2b4-51a9-b03e-3a858764392d} | Xen&HVM domU | RegNtPreCreateKey |
| HKLM\system\hardwareconfig\{f1eaebb5-4d2f-7711-a017-94b444b44f11}\computerids::{524d2732-13bc-5f73-bbdc-6a2b8ec2946e} | Xen&1 | RegNtPreCreateKey |
| HKLM\system\hardwareconfig\{f1eaebb5-4d2f-7711-a017-94b444b44f11}\computerids::{c9d88512-cf58-5151-af5f-39414a55822a} | Xen | RegNtPreCreateKey |
| HKLM\system\hardwareconfig\{f1eaebb5-4d2f-7711-a017-94b444b44f11}\productids::{db2321af-1d6a-5ce8-954f-9680c4914ba3}_amd64 | (NULL) | RegNtPreCreateKey |
| HKLM\system\hardwareconfig\{f1eaebb5-4d2f-7711-a017-94b444b44f11}\productids::{a190f5c1-b5c7-5746-8ace-b8917e90d585}_amd64 | (NULL) | RegNtPreCreateKey |
| HKLM\system\hardwareconfig\{f1eaebb5-4d2f-7711-a017-94b444b44f11}\productids::{67f9d617-c18a-54ea-83d9-9dbb8af9e472}_amd64 | (NULL) | RegNtPreCreateKey |
| HKLM\system\hardwareconfig\{f1eaebb5-4d2f-7711-a017-94b444b44f11}\productids::{ef48adbc-f2b4-51a9-b03e-3a858764392d}_amd64 | (NULL) | RegNtPreCreateKey |
| HKLM\system\controlset001\services\tpm\wmi::windowsaikhash | 挐շ똬柉㟢ֿえ辑鼄늵뜳뻅䊓衜 | RegNtPreCreateKey |
| HKLM\system\controlset001\services\tpm\wmi::windowsaikhash | 潴廆ꍮ䔆䔃霻쩽ᔔꄧ䑕ᔂ焪璹燗 | RegNtPreCreateKey |
| HKLM\hardware\description\system\multifunctionadapter\0\diskcontroller\0\diskperipheral\0::identifier | c372cd05-1e3bd0ad-4 | RegNtPreCreateKey |
| HKLM\system\controlset001\services\tpm\oduid::randomseed | ⑲끫⸊砛䉥隮⯆嘏ꨜ處첢躯㵊뽞⨸ | RegNtPreCreateKey |
| HKLM\software\microsoft\cryptography::machineguid | 0549aede-a9df-074d-f045-cab98918f505 | RegNtPreCreateKey |
| HKLM\system\controlset001\control\idconfigdb\hardware profiles\0001::hwprofileguid | {f3c58997-4f9e-28ab-3a5e-593dbe1a9915} | RegNtPreCreateKey |
| HKLM\software\microsoft\windows\currentversion\windowsupdate::susclientid | d9c42da0-711b-3e7a-e1fb-0fbbeeb5a834 | RegNtPreCreateKey |
| HKLM\software\microsoft\windows\currentversion\windowsupdate::susclientidvalidation | ���0<LZ4 | RegNtPreCreateKey |
| HKLM\system\controlset001\services\tcpip6\parameters::dhcpv6duid | 㜗ײַ䙝秊邉΄툤 | RegNtPreCreateKey |
| HKLM\system\controlset001\services\tcpip6\parameters::dhcpv6duid | �Y���?�bT � | RegNtPreCreateKey |
| HKLM\system\controlset001\control\systeminformation::computerhardwareid | {de34e177-cd0d-5975-5f14-9deea8f524c4} | RegNtPreCreateKey |
| HKLM\system\controlset001\control\systeminformation::computerhardwareids | {3373d2df-c5b1-4add-3bbf-027c52315ddc} {25bce4e4-4a5e-7ccc-1ad7-bbf8fca5b118} {e82b8184-0c71-4b74-bbc8-3580350bbb81} {153b57bc-d | RegNtPreCreateKey |
| HKLM\software\microsoft\internet explorer\migration::ie installed date | 糉婻 | RegNtPreCreateKey |
| HKLM\software\microsoft\sqmclient::machineid | {0ab847f7-8913-5000-7335-a41050c57003} | RegNtPreCreateKey |
| HKLM\software\microsoft\sqmclient::winsqmfirstsessionstarttime | 㪦 ⎠ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion::installtime | 擼 | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion::installdate | ⟁ ⨦ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion::digitalproductid | �}�C߀/�X�B���(��c,�M]Rrħ�)���_Y�Ɩ�w�9�W��\uT`x) _���U��,�N!$V�} �{_����>ػG7 �� ��X��� ��W�s>��#�σ$��doV��g��f��}na!D"h�w�e�#4��� ����'9 | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion::digitalproductid4 | r�c*��^�=Rv��r� wn���p�K�����u5�<D��m��m�<���a�����J70����$g=� zoF�h��-��<�?��&�����z�21��C�$/ +�,Z��,��~��e�Qʟ�桠~D���c� �����6o�)�5v٫������ ��u��h�o�!M��G�e@��eRKS�<3�s�%��>/qۼ�E���Jz�J�`UV$��]�4f� ��U(���� | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion::buildguid | bd8d5db1-cb4b-52dc-2e5d-48e21ca4b8ab | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion::productid | a421a-01d89-17048-def1a | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion::buildlab | 95be3.v9_rclbas3.9edb5a-78c3 | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion::buildlabex | 84818.7.bmbe7er9.vd_r8ldas2.475f34-ece1 | RegNtPreCreateKey |
| HKLM\system\controlset001\control\class\{4d36e972-e325-11ce-bfc1-08002be10318}\0000::networkinterfaceinstalltimestamp | 但 綽 | RegNtPreCreateKey |
| HKLM\system\controlset001\control\class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001::networkinterfaceinstalltimestamp | 楀 Ꭿ | RegNtPreCreateKey |
| HKLM\system\controlset001\control\class\{4d36e972-e325-11ce-bfc1-08002be10318}\0002::networkinterfaceinstalltimestamp | ᡱ 崱 | RegNtPreCreateKey |
| HKLM\system\controlset001\control\class\{4d36e972-e325-11ce-bfc1-08002be10318}\0003::networkinterfaceinstalltimestamp | 㡏 Ή | RegNtPreCreateKey |
| HKLM\system\controlset001\control\class\{4d36e972-e325-11ce-bfc1-08002be10318}\0004::networkinterfaceinstalltimestamp | 䈍 䐛 | RegNtPreCreateKey |
| HKLM\system\controlset001\control\class\{4d36e972-e325-11ce-bfc1-08002be10318}\0005::networkinterfaceinstalltimestamp | 檐 ā | RegNtPreCreateKey |
| HKLM\system\controlset001\control\class\{4d36e972-e325-11ce-bfc1-08002be10318}\0006::networkinterfaceinstalltimestamp | 协 | RegNtPreCreateKey |
| HKLM\system\controlset001\control\class\{4d36e972-e325-11ce-bfc1-08002be10318}\0007::networkinterfaceinstalltimestamp | 浟 ᒗ | RegNtPreCreateKey |
| HKLM\system\controlset001\control\class\{4d36e972-e325-11ce-bfc1-08002be10318}\0008::networkinterfaceinstalltimestamp | ᪫ 䅦 | RegNtPreCreateKey |
| HKLM\system\controlset001\control\class\{4d36e972-e325-11ce-bfc1-08002be10318}\0009::networkinterfaceinstalltimestamp | 嶼 擔 | RegNtPreCreateKey |
| HKLM\system\controlset001\control\class\{4d36e972-e325-11ce-bfc1-08002be10318}\0010::networkinterfaceinstalltimestamp | 刲 絗 | RegNtPreCreateKey |
| HKLM\system\controlset001\control\class\{4d36e972-e325-11ce-bfc1-08002be10318}\0011::networkinterfaceinstalltimestamp | 炗 ൿ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows\currentversion\diagnostics\diagtrack\sevilleeventlogmanager::lasteventlogwrittentime | ᒾ 彈 | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\softwareprotectionplatform\activation::productactivationtime | か 眔 | RegNtPreCreateKey |
| HKCU\software\microsoft\onedrive\accounts::lastupdate | 到 宣 | RegNtPreCreateKey |
| HKLM\software\microsoft\windows\currentversion\onesettings\wsd\setupplatform\queryparameters::deviceid | {fa2fea5f-cdf1-545c-b0a2-ab93d01009f0} | RegNtPreCreateKey |
| HKLM\software\microsoft\windows\currentversion\onesettings\wsd\updateagent\queryparameters::deviceid | {0a3d9aff-f593-2ed9-3789-ac78924f9215} | RegNtPreCreateKey |
| HKLM\software\microsoft\windows\currentversion\vfuprovider::lastupdate | ֬ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows\currentversion\wosc\client\persistent\clientstate\wosc::lastrefreshattempted | 滺 | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\windows\win32kwpp\parameters::wpprecorder_traceguid | {a1f83b17-0592-afb5-ea3e-e349e2b8fcd0} | RegNtPreCreateKey |
| HKLM\system\controlset001\services\kbdclass\parameters::wpprecorder_traceguid | {7ffeb358-1aa5-21b2-cf13-ece92437e35a} | RegNtPreCreateKey |
| HKLM\system\controlset001\services\kbdclass\parameters::wpprecorder_traceguid | {ae19e183-74b8-fb35-abfe-fdd99135c2eb} | RegNtPreCreateKey |
| HKLM\system\controlset001\services\kbdclass\parameters::wpprecorder_traceguid | {9bfbbff5-0aed-c851-249d-2ceaccdc1983} | RegNtPreCreateKey |
| HKLM\system\controlset001\services\mouhid\parameters::wpprecorder_traceguid | {b7fec10b-0d23-addd-4efd-fd19eac5a8a9} | RegNtPreCreateKey |
| HKLM\system\waas\waasmedic\state::featuretimestampoflatestrun | 晽 | RegNtPreCreateKey |
| HKLM\system\waas\waasmedic\state::qualitytimestampoflatestrun | 嬚 | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey |
Windows API 使用情况
Windows API 使用情况
本节列出了此系列样本使用的 Windows API 调用。Windows API 使用情况分析是一项宝贵的工具，可以帮助识别恶意活动，例如键盘记录、安全权限提升、数据加密、数据泄露、干扰防病毒软件以及网络请求篡改。| 类别 | API |
|---|---|
| Syscall Use |
显示更多
|
| Other Suspicious |
|
