威胁数据库 特洛伊木马 Trojan.Kryptik.NFRE

Trojan.Kryptik.NFRE

通过CagedTech在 特洛伊木马
发布时间：
最后更新：
翻译为：

威胁评分卡

人气排名： 20,414
威胁级别： 80 % (高的)
受感染的计算机： 4
初见： September 24, 2026
最后一次露面： October 4, 2026
受影响的操作系统： Windows

Trojan.Kryptik.NFRE是一种针对 Windows 操作系统的木马威胁。与其他 Kryptik 家族成员一样，它旨在悄无声息地入侵系统，在用户不知情或未经许可的情况下执行恶意操作。安全研究人员将此威胁评为高危级别，表明一旦它控制了受感染的计算机，就会造成严重的危害。

Trojan.Kryptik.NFRE 的作用

一旦在系统中激活，Trojan.Kryptik.NFRE 的行为方式与复杂的木马病毒感染类似。它旨在入侵受感染的计算机并控制关键系统功能。此类威胁通常会尝试下载并安装其他恶意组件、未经授权修改系统设置、干扰安全工具，并打开一个通道，允许远程攻击者向受感染的计算机发出命令。根据变种和攻击者的目标，这些命令可能包括窃取存储的凭据、记录键盘输入、截取屏幕截图或监控用户的在线活动。由于该恶意软件被设计为隐蔽运行，因此它通常在后台静默运行，使得未经训练的用户难以发现。

它通常是如何进入电脑的

这类木马通常通过欺骗手段传播，而非利用单一的特定漏洞。常见的感染途径包括伪装成发票、收据、简历或其他看似合法文档的电子邮件附件，以及与盗版软件、破解程序或密钥生成器捆绑在一起的可执行文件。恶意广告、被入侵的网站和虚假的软件更新提示也可能传播此类恶意软件。由于涉及的文件扩展名可能千差万别——从可执行文件到看似无害的文档或图像——用户常常会在不知不觉中打开文件，而不会察觉到任何异常。

用户面临的风险

此类感染一旦发生，可能会给用户带来严重后果。鉴于 Kryptik 系列木马通常具有强大的功能，受害者可能面临密码和财务信息被盗、计算机遭到未经授权的远程访问、其他恶意软件被安装、文件损坏或删除，以及系统设置完全失控等问题。由于该木马可以充当后门，它也可能成为其他攻击（包括勒索软件或间谍软件）的入口，随着时间的推移，损害会不断加剧。

感染迹象

木马程序旨在隐藏自身，但某些症状可能表明系统已被入侵。用户应注意系统性能意外下降、任务管理器中出现不明进程、程序自行启动或关闭、浏览器或安全设置未经用户更改、即使在空闲状态下也出现异常网络活动，以及安全软件被禁用或无法更新。频繁崩溃或出现不明原因的弹出窗口也可能是警告信号。

如何做好防护

预防感染始于谨慎的上网习惯。用户应避免打开来自未知或意外发件人的电子邮件附件或点击链接，不要从非官方或盗版来源下载软件，并确保操作系统和已安装的应用程序始终更新到最新的安全补丁。运行信誉良好且最新的反恶意软件解决方案并定期进行系统扫描，有助于在 Trojan.Kryptik.NFRE 等威胁造成严重损害之前将其检测并清除。定期备份重要文件也能降低潜在安全漏洞的影响，确保即使系统受到影响也能恢复数据。

分析报告

一般信息

姓： Trojan.Kryptik.NFRE
签名状态： No Signature

已知样本

MD5: f7329b5b0fc724f92c8e5d32354693dc
SHA1: c88c8c84a70f51a3a23c1ee80afce3f7f1259c69
SHA256: 0448EF245659C937AE9226E46487713D7BD2CFBD0D7E0F24017C6C90289D3E46
文件大小: 6.79 MB,6787839字节
MD5: be2fac9ea175929596dfc5fd4d96f2e0
SHA1: 401c57ce42f94f197f875040492badb0f316696f
SHA256: 188BCE62EAE6B5FB9FC3E28F8734EB1F0E1C71B2CD3126358897073204D8EDE5
文件大小: 622.25 KB,622250字节
MD5: 8b16415d153c16c6d86d8da88785d790
SHA1: 957e0ed4aeac7b7d3558734db21e2aab0f126ae1
SHA256: 715B07757808181B3B2046FE4C2F373049688EE41342C701AA99577241B252E5
文件大小: 6.79 MB,6787183字节
MD5: ec3faa430a00a0d5b48bd9c3847ffadc
SHA1: 5feb0407415743ae8caeddb81f7c596c649ff5f0
SHA256: 698BC0CEA28BC9EDAE60273A7ABCE0C5EF3DCA86087A71B95FC82949F4698A94
文件大小: 131.00 KB,131000字节
MD5: 64b250c5436c5e6792c89e38d5b30192
SHA1: 84f97b0e946678b77a9b77cbc4ad601ea3828759
SHA256: A83232C48043EC9954AC4349DDB6B89F926335545BA708E5E48095B9FA2AF085
文件大小: 6.79 MB,6790385字节
显示更多
MD5: 8506089a507d926af7804fc18ba867a6
SHA1: 0986800bd023b2b4b57b307f6712d3c76c70ac46
SHA256: 70071C35DCB2B8F95145C1F252965BC7AA3A49119D0F6D9F35B13C78EF2B9AA4
文件大小: 6.13 MB,6134943字节
MD5: 7fc446210b147c71bccea7c81889b81b
SHA1: 5964a1d153abf58853f87d4d3a545465f9d44a4d
SHA256: 316BFF44736CA0A8020A3A31028559544D19EAB47C9ABE8C0D6D569AAE30CE02
文件大小: 6.79 MB,6787839字节

Windows 可移植可执行文件属性

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have security information
  • File has TLS information
  • File is 64-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
显示更多
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

文件图标

文件特征

  • 2+ executable sections
  • big overlay
  • HighEntropy
  • No Version Info
  • upx
  • x64

区块信息

总区块数： 70
潜在恶意块： 7
白名单区块： 61
未知区块： 2

可视化地图

0 0 0 0 0 0 0 ? x x x x x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ?
0 - 可能的保险箱
? - 未知区块
x - 潜在恶意拦截

相似家庭

  • Kryptik.KPG
  • Kryptik.NFRE

文件已修改

文件 属性
c:\users\user\appdata\local\microsoft\windows\update Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\0986800bd023b2b4b57b307f6712d3c76c70ac46_0006134943 Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\84f97b0e946678b77a9b77cbc4ad601ea3828759_0006790385 Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\957e0ed4aeac7b7d3558734db21e2aab0f126ae1_0006787183 Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\build.json Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\build.json Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839 Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\config.dat Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\config.dat Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\config.json Generic Write,Read Attributes
显示更多
c:\users\user\appdata\local\microsoft\windows\update\config.json Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdateworker.exe Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\microsoftupdateworker.exe Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\runtime_donate_phase.json Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\runtime_donate_phase.json Synchronize,Write Attributes
c:\users\user\appdata\local\microsoft\windows\update\taskmgr_hook.dll Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\update\taskmgr_hook.dll Synchronize,Write Attributes
c:\users\user\appdata\local\temp\wininetcache\dd.exe Generic Write,Read Attributes
c:\users\user\appdata\local\temp\wininetcache\dd.exe Synchronize,Write Attributes
c:\users\user\appdata\local\temp\wininetcache\ddd.exe Generic Write,Read Attributes
c:\users\user\appdata\local\temp\wininetcache\ddd.exe Synchronize,Write Attributes
c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\windowsupdate.vbs Generic Write,Read Attributes
c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\windowsupdate.vbs Synchronize,Write Attributes

注册表修改

键::值 数据 API名称
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839 RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839 RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839 RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\extensions::exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\extensions::.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\features::tamperprotection RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\features::tamperprotection RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe RegNtPreCreateKey
显示更多
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839 RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839 RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\extensions::exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\extensions::.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\rt\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\temp\wininetcache\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\explorer\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\wer\reportqueue\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\comwindows\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\update\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\windows\themes\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\xmrig.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\checker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\watchdog.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\roaming\microsoft\comwindows\settingssync.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\paths::c:\users\yvztibwz\appdata\local\microsoft\windows\update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839 RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateassistant.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdateworker.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\microsoftupdatehealth.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::c:\users\yvztibwz\appdata\local\microsoft\windows\update\miner.exe RegNtPreCreateKey
HKLM\software\policies\microsoft\windows defender\exclusions\processes::xmrig.exe RegNtPreCreateKey

以上未显示另外 1926 项注册表修改。

Windows API 使用情况

类别 API
Syscall Use
  • ntdll.dll!NtAlertThreadByThreadId
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtAssociateWaitCompletionPacket
  • ntdll.dll!NtCancelWaitCompletionPacket
  • ntdll.dll!NtClearEvent
  • ntdll.dll!NtClose
  • ntdll.dll!NtConnectPort
  • ntdll.dll!NtCreateEvent
  • ntdll.dll!NtCreateFile
显示更多
  • ntdll.dll!NtCreateKey
  • ntdll.dll!NtCreateMutant
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtCreateSemaphore
  • ntdll.dll!NtDeleteValueKey
  • ntdll.dll!NtDeviceIoControlFile
  • ntdll.dll!NtDuplicateObject
  • ntdll.dll!NtEnumerateValueKey
  • ntdll.dll!NtFlushBuffersFile
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtNotifyChangeKey
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenSemaphore
  • ntdll.dll!NtPowerInformation
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDirectoryFileEx
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQuerySecurityObject
  • ntdll.dll!NtQuerySystemInformation
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtReadRequestData
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtRequestWaitReplyPort
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationKey
  • ntdll.dll!NtSetInformationObject
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationThread
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtSetTimer2
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtWaitForAlertByThreadId
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWaitLowEventPair
  • ntdll.dll!NtWorkerFactoryWorkerReady
  • ntdll.dll!NtWriteFile
  • UNKNOWN
Process Manipulation Evasion
  • NtUnmapViewOfSection
Process Shell Execute
  • CreateProcess
Network Winsock2
  • WSAGetOverlappedResult
  • WSARecvFrom
  • WSASendTo
  • WSASocket
  • WSAStartup
  • WSAttemptAutodialName
User Data Access
  • GetComputerName
  • GetComputerNameEx
  • GetUserObjectInformation
Encryption Used
  • BCryptOpenAlgorithmProvider
Network Winsock
  • bind
  • closesocket
  • freeaddrinfo
  • getaddrinfo
  • getsockname
  • setsockopt
  • socket
Network Info Queried
  • GetAdaptersAddresses
Network Winhttp
  • WinHttpConnect
  • WinHttpOpen
  • WinHttpOpenRequest
  • WinHttpReceiveResponse
  • WinHttpSendRequest
Anti Debug
  • IsDebuggerPresent
Process Terminate
  • TerminateProcess

Shell命令执行

C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\c88c8c84a70f51a3a23c1ee80afce3f7f1259c69_0006787839 (NULL)
C:\Users\Yvztibwz\AppData\Local\Temp\WinInetCache\dd.exe "C:\Users\Yvztibwz\AppData\Local\Temp\WinInetCache\dd.exe"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL LIMITED /TR "C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Delete /F /TN WindowsUpdateBoot
"C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe"
显示更多
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL LIMITED /TR "C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Delete /F /TN WindowsUpdateBoot
"C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe"
"C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL LIMITED /TR "C:\Users\Yvztibwz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Delete /F /TN WindowsUpdateBoot
C:\Users\Slxzpdlz\AppData\Local\Microsoft\Windows\Update\957e0ed4aeac7b7d3558734db21e2aab0f126ae1_0006787183 (NULL)
C:\Users\Slxzpdlz\AppData\Local\Temp\WinInetCache\dd.exe "C:\Users\Slxzpdlz\AppData\Local\Temp\WinInetCache\dd.exe"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL HIGHEST /TR "\"C:\Users\Slxzpdlz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-task"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdateBoot /SC ONSTART /RU SYSTEM /RL HIGHEST /TR "\"C:\Users\Slxzpdlz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-excl"
"C:\Users\Slxzpdlz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe"
"C:\Users\Slxzpdlz\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe"
C:\Users\Copboylc\AppData\Local\Microsoft\Windows\Update\84f97b0e946678b77a9b77cbc4ad601ea3828759_0006790385 (NULL)
C:\Users\Copboylc\AppData\Local\Temp\WinInetCache\dd.exe "C:\Users\Copboylc\AppData\Local\Temp\WinInetCache\dd.exe"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL HIGHEST /TR "\"C:\Users\Copboylc\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-task"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdateBoot /SC ONSTART /RU SYSTEM /RL HIGHEST /TR "\"C:\Users\Copboylc\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-excl"
"C:\Users\Copboylc\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe"
"C:\Users\Copboylc\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe"
C:\Users\Akicetwi\AppData\Local\Microsoft\Windows\Update\0986800bd023b2b4b57b307f6712d3c76c70ac46_0006134943 (NULL)
C:\Users\Akicetwi\AppData\Local\Temp\WinInetCache\ddd.exe "C:\Users\Akicetwi\AppData\Local\Temp\WinInetCache\ddd.exe"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL HIGHEST /TR "\"C:\Users\Akicetwi\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-task"
C:\WINDOWS\system32\schtasks.exe "C:\WINDOWS\system32\schtasks.exe" /Create /F /TN WindowsUpdateBoot /SC ONSTART /RU SYSTEM /RL HIGHEST /TR "\"C:\Users\Akicetwi\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-excl"