Trojan.Agent.OIW
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 25,300 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 37 |
| First Seen: | March 10, 2025 |
| Last Seen: | June 8, 2026 |
| OS(es) Affected: | Windows |
The detection of Trojan.Agent.OIW on your system indicates a potential security threat that requires immediate attention. This type of malware is designed to compromise the security and integrity of your computer, and its presence can lead to a range of problems, from data theft to system crashes. In this report, we will provide an overview of what Trojan.Agent.OIW is, how it operates, and the steps you can take to remove it from your system.
Table of Contents
What Is Trojan.Agent.OIW?
Trojan.Agent.OIW is a type of Trojan malware that is designed to infiltrate and compromise a computer system. The term "Trojan" refers to the fact that this type of malware disguises itself as a legitimate program or file, allowing it to evade detection and gain access to the system. Once inside, the malware can cause a range of problems, including data theft, system crashes, and the installation of additional malware.
How Trojan.Agent.OIW Operates
Trojan.Agent.OIW, like other types of Trojan malware, operates by exploiting vulnerabilities in the system or by tricking the user into installing it. This can happen through a range of means, including opening email attachments, clicking on links, or downloading software from untrusted sources. Once the malware is installed, it can begin to cause problems, including stealing sensitive information, such as passwords and credit card numbers, and using the system to spread additional malware or launch attacks on other systems.
Symptoms of Infection
The symptoms of a Trojan.Agent.OIW infection can vary, but common signs include slow system performance, unexpected crashes, and unfamiliar programs or icons on the desktop. You may also notice that your system is behaving erratically, or that you are being redirected to unfamiliar websites. In some cases, the malware may also attempt to contact its creators or other malicious servers, which can lead to further compromise of the system.
- Slow system performance
- Unexpected crashes or freezes
- Unfamiliar programs or icons on the desktop
- Erratic system behavior
- Redirects to unfamiliar websites
How to Remove Trojan.Agent.OIW
- Boot your system in Safe Mode with Networking to prevent the malware from loading and to allow for easier removal.
- Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and remove any detected threats.
- Uninstall any suspicious programs or applications that may be related to the malware.
- Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any malicious extensions or settings.
- Reboot your system and perform a follow-up scan to ensure that the malware has been fully removed.
Conclusion
The detection of Trojan.Agent.OIW on your system is a serious issue that requires immediate attention. By understanding what this type of malware is, how it operates, and the steps you can take to remove it, you can help to protect your system and your sensitive information. Remember to always be cautious when opening email attachments, clicking on links, or downloading software from untrusted sources, and to keep your anti-malware tools up to date to help prevent future infections.
Analysis Report
General information
| Family Name: | Trojan.Agent.OIW |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
1a82c72c3d7a80ce01ca2885ed0cb085
SHA1:
783209e5a2f45cd21856492e6f11fde5d8dcdb62
SHA256:
14BDEC6B000D9D48231A7C35E30372967BAA3C1071AD15AABAD6EED0FF13EA0D
File Size:
1.52 MB, 1518592 bytes
|
|
MD5:
bca6e8c7035856affe4ae66a94859db6
SHA1:
2337556403c13ea5b83d255bdd3e9b4607e36a50
SHA256:
EB088C539ED3F59275DAD0A9F162E17BB5855EB1F48C32539C0DBDC1E27B0D48
File Size:
2.39 MB, 2393088 bytes
|
|
MD5:
0dfa54cb685a64979272131be5b39e92
SHA1:
895fe7d32a4313c3fc62df01610fe63315735614
SHA256:
885A138345F58F447987BE594CCD837B1B5C68296CC5C2C67E09A4FE96594B8C
File Size:
2.60 MB, 2595840 bytes
|
|
MD5:
2e609e1ff2dc42647254ae84f0abb8cc
SHA1:
011e992448798ef2bc40062c642b17b8484beba6
SHA256:
D3F107CB68D0A818F7910F5BC26BCFFC9311BDA629E4791D8AF22BAD4546D909
File Size:
4.03 MB, 4029952 bytes
|
|
MD5:
ed4a992c2030f52cc30ea6b3b56fa42f
SHA1:
9ac9949c1dc05afe215855adec165913d71269e0
SHA256:
4CA80969FBE5F1DAC023F835070EFA21E2B472F6752D237BF85682371E50A1B3
File Size:
4.01 MB, 4008960 bytes
|
Show More
|
MD5:
2e42004418226bdba66b897a01151351
SHA1:
221b2e3e3c7de7d891bd8e022a32c228daae305f
SHA256:
57713917F2F02FA2E39C59A739E4019F673E530099178B0470212646F5D2A811
File Size:
766.46 KB, 766464 bytes
|
|
MD5:
5e78dfa8309879579533112688d0b116
SHA1:
93c734c6d7c6ef28264b2d2d75ae2d7740f6d2c9
SHA256:
290BB436E0A90EB131E6B038C2F2DA8C672DD724E803FEF459ABE9033EEC10AF
File Size:
1.27 MB, 1271296 bytes
|
|
MD5:
9bedfa0fe188da59e84ae240b46c9b83
SHA1:
648069ae59d5e966dc2e51f9490e551fc1ded33a
SHA256:
DBF3C6BCB0A18AC76346B5D18EC6D009EC6C8D970E8656BB4D39EE48B434E2FB
File Size:
2.54 MB, 2542592 bytes
|
|
MD5:
4cf8d2f469e07f6a91e68ad1b1cdd9b8
SHA1:
3f4ac4ccb31f9e2264c7425f76ff554ea2d97ea6
SHA256:
AFB49AFE94FF738C7389CFDAE24916E110589EE50E4684CB5B287071CE7EF30E
File Size:
1.36 MB, 1363968 bytes
|
|
MD5:
9870c44e3e543b6e4e6992bec8bd42b5
SHA1:
e91acddfc964d3ee624191a2604852ca1789d5d5
SHA256:
FD6478610542444388E6C3BA68BAAEEFEB5795ED3B2006E651CF7BE4DCB3E600
File Size:
2.37 MB, 2371072 bytes
|
|
MD5:
f1b4baaf7e907653ee3f80a63b7ddafd
SHA1:
dc0c9a4c27685afce40df2046bdab9df2c96e9b9
SHA256:
B550CCF841B235C5BBD59522D2F132EF32C864A6D61166DDE1B30E38CC073C5E
File Size:
946.18 KB, 946176 bytes
|
|
MD5:
2edf2584caaafd5feb1f84ed6ccf17f6
SHA1:
e2e725d4faec5467a9c35d9a6c60ba96cad22b5e
SHA256:
941062F8F2F7BD566388C99928149263E85FC79D53BE0DAF486BB058A8EED682
File Size:
2.49 MB, 2489856 bytes
|
|
MD5:
031c0e66cff15e12ea0db08bb55b62e3
SHA1:
39906571e533ec6182806ec3fa55c5a6946a9f14
SHA256:
D3F3D462B3312AB91E583B4003834B776CA2B4B2C09B822E11E7EF9ABC11B3A8
File Size:
942.08 KB, 942080 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has TLS information
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
Show More
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
File Traits
- 2+ executable sections
- GetConsoleWindow
- HighEntropy
- imgui
- No Version Info
- ntdll
- VirtualQueryEx
- WriteProcessMemory
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 2,970 |
|---|---|
| Potentially Malicious Blocks: | 87 |
| Whitelisted Blocks: | 2,880 |
| Unknown Blocks: | 3 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
x
?
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
x
x
x
0
0
x
x
0
0
0
0
0
0
x
x
x
x
x
x
0
0
0
0
0
0
0
0
0
x
x
0
x
x
x
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
x
x
x
x
0
0
0
0
0
0
x
x
x
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
x
x
x
0
x
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
1
x
0
0
0
0
0
0
0
0
0
1
0
0
0
x
x
0
x
x
x
x
x
x
0
0
0
0
x
x
x
0
0
x
x
x
x
0
0
0
0
0
0
0
0
x
0
x
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
0
0
x
x
x
0
x
x
x
0
x
x
0
0
0
0
0
x
x
x
0
0
0
0
0
0
0
0
0
x
0
x
0
0
0
0
0
x
x
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
1
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.JYT
- Agent.OIW
- Agent.ZFBJ
- Agent.ZFKD
- CsgoInjector.FB
Show More
- CsgoInjector.GG
- CsgoInjector.GJ
- Downloader.Agent.BTF
- Downloader.Agent.BTW
- Gamehack.GACI
- Gamehack.GSH
- Gamehack.GYF
- Gamehack.PS
- Kryptik.ODF
- Kryptik.ODFFC
- Stealer.GTA
- Trojan.Agent.Gen.AUB
- Trojan.Agent.Gen.AWS
- Trojan.Downloader.Gen.KB
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe | Generic Read,Write Attributes |
| \device\namedpipe | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 穏壦䙭ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\cryptography\oid\encodingtype 0\cryptdllfindoidinfo\1.3.6.1.4.1.311.60.3.1!7::name | szOID_ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION | RegNtPreCreateKey |
| HKLM\software\microsoft\cryptography\oid\encodingtype 0\cryptdllfindoidinfo\1.3.6.1.4.1.311.60.3.2!7::name | szOID_ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION | RegNtPreCreateKey |
| HKLM\software\microsoft\cryptography\oid\encodingtype 0\cryptdllfindoidinfo\1.3.6.1.4.1.311.60.3.3!7::name | szOID_ROOT_PROGRAM_NO_OCSP_FAILOVER_TO_CRL | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 癭夤䙭ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ◧奔䙭ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 奘䙭ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 䲕奛䙭ǜ | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| Process Shell Execute |
|
| User Data Access |
|
| Network Winsock2 |
|
| Network Winsock |
|
| Anti Debug |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\WINDOWS\system32\certutil.exe certutil -hashfile "c:\users\user\downloads\221b2e3e3c7de7d891bd8e022a32c228daae305f_0000766464" MD5
|
C:\WINDOWS\system32\find.exe find /i /v "md5"
|
C:\WINDOWS\system32\find.exe find /i /v "certutil"
|
C:\WINDOWS\system32\certutil.exe certutil -hashfile "c:/" MD5
|
C:\WINDOWS\system32\cmd.exe cmd /C "color b && title Error && echo Couldn't resolve host name && timeout /t 5"
|
Show More
WriteConsole: Couldn't resolve
|
C:\WINDOWS\system32\timeout.exe timeout /t 5
|
WriteConsole:
Waiting for 5
|
WriteConsole: seconds, press
|
WriteConsole: 0834
|
WriteConsole: 0833
|
WriteConsole: 0832
|
