Attackers frequently use the promise of free, pre-activated software to bundle dangerous malware, spyware, ransomware, or cryptocurrency miners into the core system files ( ntoskrnl.exe , explorer.exe ). Because the malware is baked into the operating system, standard antivirus software may fail to detect it.