| K7 Detection Name | Affected OS | Prevalence | AV Definition Version |
|---|---|---|---|
| Trojan ( 006d70f91 ) | Windows | High | 14.20.57791 |
| MD5 | 63208390e0734f8650a3c4e024c0beac |
| SHA256 | c64d9f51ed0d054f08670e274aa8ae62f0018874f852ef5ba38a003b2cf81eab |
| File Size | 552,140 bytes |
| Packer Information | N/A |
| First Seen | 25-11-2025 |
| Last Seen | 04-09-2026 |
| Aliases | Win32.Generic |
Behavior Details
1. Creates Registry:
Adds data
rundll32.exe
under
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Name
Adds data
microsoft corporation
under
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Publisher
Adds data
10.0.19041.5794
under
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\ProductVersion
Adds data
07/29/1998 17:20:24
under
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\LinkDate
Adds data
microsoft\xae windows\xae operating system
under
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\ProductName
Adds data
1
under
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\WritePermissionsCheck
Adds data
10.0.19041.5794
under
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\BinFileVersion
Adds data
1033
under
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Language
Adds data
rundll32.exe
under
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\OriginalFileName
Adds data
0000f519feec486de87ed73cb92d3cac802400000000
under
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\ProgramId
Adds data
10.0.19041.5794 (winbuild.160101.0800)
under
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Version
Adds data
1
under
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\IsOsComponent
Adds data
P\x88\xd2\x1e\x00\x00\x00\x00
under
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Usn
Adds data
\x00^\x01\x00\x00\x00\x00\x00
under
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Size
Adds data
c:\windows\system32\rundll32.exe
under
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\LowerCaseLongPath
Adds data
10.0.19041.5794
under
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\BinProductVersion
Adds data
\x9b\xe7\x9f\x02\x01\xd8\x00\x80\x89u\xb2\x80\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x11\x04\xae\x02\x02\x00\x02\x00\xd8\xd4\xef\x94\x00\x00\x00\x00\x01\x00\x00\x00\x8c\x01\x00\x00*n\xb2\x02\x01\x00\x00\x80\x94\xd0\x9e\xed\x00\x00\x00\x00\x02\x00\x00\x00l\x00\x00\x00y\x1a\xb6\x02\x01\x00\x03\x00\x8c\x8b\xe9\x96\x00\x00\x00\x00\x04\x00\x00\x007\x00\x00\x00\x13\xba\xeb\x02\x01\x02\x00\x80\x81\x82\x1a\xcb\x00\x00\x00\x00\x02\x00\x00\x00l\x00\x00\x00\x9e\x96\x03\x03\x01K\x00\x80\xc0\xf2\xcc\xa9\x00\x00\x00\x00\xed\x00\x00\x00\x07\x00\x00\x00
under
HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\TIP\AggregateResults\data
Adds data
rundll32.exe|c8d854bf61fafc41
under
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\LongPathHash
Adds data
pe64_amd64
under
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\BinaryType
Adds data
0000ea8254338ff3811aa47061ed360c6dfe482aadaa
under
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\FileId
Removal Instructions
1. Update K7 security to the latest version.
2. Open Windows registry editor and delete the following keys:
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Name
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Publisher
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\ProductVersion
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\LinkDate
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\ProductName
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\WritePermissionsCheck
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\BinFileVersion
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Language
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\OriginalFileName
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\ProgramId
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Version
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\IsOsComponent
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Usn
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\Size
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\LowerCaseLongPath
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\BinProductVersion
HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\TIP\AggregateResults\data
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\LongPathHash
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\BinaryType
\REGISTRY\A\{e715be08-34b1-a973-f1a7-9c049be0335c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41\FileId
3. Restart the machine.