HitmanPro.Alert version 3.8.20 Build 935

Mod123xsd

File: hmpalert3 pre-patched.exe
Virus Total: 01/68
MD5: 0af19cfd8d45bf7c06c6cbf3b40c4c31
SHA1: 44f62f65d20f2c68ccc03543a62060826f81dd8f
SHA256: 01d8e3d6a67432d384e70325c7065213dad9340c4176ee7f3b95902150873e39

下载地址：https://mod123.lanzoum.com/iaqXm01m3uvi

企稳向好

这版本目前还是RC，不过改进很多，顺手贴一个更新日志：

HitmanPro.Alert 3.8.20 Build 935 Release Candidate

Changelog (compared to build 923)
Added SendKeyGuard mitigation (part of Lockdown) to block macro-borne keystroke injection.
Added system-wide protection against defense evasion technique via direct system calls, or SysCall, on 64-bit applications
Added protection against cloning of LSASS process to Credential Theft Protection
Added new mitigation that block code injection via remote thread creation; RemoteThreadGuard. Currently in testing.
Added support for ReFS file system to CryptoGuard
Added NOTEPAD.EXE to Office template
Added GPT partition support to WipeGuard
Added NVMe support to WipeGuard
Added MITRE ATT&CK references to the CookieGuard, SysCall and RemoteThreadGuard mitigations
Added alerting to our protection of sticky key abuse (and other accessibility features)
Added EA Digital Illusions CE AB to game detection
Improved protection against direct system calls, or SysCall, on 32-bit applications
Improved handling of certificates on code-signed applications
Improved CookieGuard alert with information about the application certificate, if any, in the alert
Improved WipeGuard to protection the Volume Boot Record of all mounted partitions. Previously, only the boot partition was protected.
Improved WipeGuard to terminate the offending process. Previously, the offending action was only blocked.
Improved HollowProcess to protect against PEB manipulation in a remote process where PEB is writable
Improved Lockdown mitigation to isolate modules (DLLs) dropped in attacks via Office documents.
Improved the per app mitigation settings in the user interface. It now has room for extra checkboxes.
Change reboot fly-out reminder interval from 1h to 8h
Changed Dynamic Heap Spray detection; it is now disabled on 64-bit applications
Changed text for Benefits button to Help center
Changed Sophos Privacy Notice and Terms of Service
Fixed displaying icons of UWP applications
Fixed several user interface inconsistencies
Fixed false alarm by APCViolation on Avast 'aswhook' DLL
Fixed false alarm by CookieGuard if application starts from a RAM-drive
Fixed false alarm by HollowProcess on Visual Studio
Fixed issue with Lockdown inheritance when parent process is OpenWith.exe
Fixed issue when a user tries to install HitmanPro.Alert on machine where Sophos Home Premium is already installed
Fixed tray icon burning CPU cycles after install
Fixed unexpected removal of Forza Horizon 5 under UWP exclusions
Several other changes under the hood

swizzer

前前后后跟技术人员交流了五六封邮件，总算是把WipeGuard改进了啊