<< Back to Top Threats
K7 Detection Name Affected OS Prevalence AV Definition Version
Trojan ( 004d77361 ) Windows Low 12.155.51776
MD5

862d9a823ae99b9181b749ae66198bca
SHA256

af74be686e4636701f86e56d1129cdacdda93b863bb45ab491237d093b8101bf
File Size

219,136 bytes
Packer Information

N/A
First Seen

22-04-2024
Last Seen

16-04-2025
Aliases

MSIL/Agent.AFK

Behavior Details 

1. Creates Registry:

  Adds registry data
     0

  Under the key:
	 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\862d9a823ae99b9181b7_RASAPI32\EnableConsoleTracing

  Adds registry data
     18446744073709486080

  Under the key:
	 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\862d9a823ae99b9181b7_RASAPI32\ConsoleTracingMask

  Adds registry data
     1048576

  Under the key:
	 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\862d9a823ae99b9181b7_RASAPI32\MaxFileSize

  Adds registry data
     %windir%\tracing

  Under the key:
	 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\862d9a823ae99b9181b7_RASAPI32\FileDirectory

Removal Instructions 

1. Update the copy of K7 security to the latest version.
2. Open Windows registry editor.
3. Delete the registry data
     0

   Under the key:
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\862d9a823ae99b9181b7_RASAPI32\EnableConsoleTracing

4. Delete the registry data
     18446744073709486080

   Under the key:
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\862d9a823ae99b9181b7_RASAPI32\ConsoleTracingMask

5. Delete the registry data
     1048576

   Under the key:
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\862d9a823ae99b9181b7_RASAPI32\MaxFileSize

6. Delete the registry data
     %windir%\tracing

   Under the key:
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\862d9a823ae99b9181b7_RASAPI32\FileDirectory
7. Close the Windows registry.
8. Restart the machine.
1. Update the copy of K7 security to the latest version.
2. Open Windows registry editor.
3. Delete the registry data
     0

   Under the key:
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\862d9a823ae99b9181b7_RASAPI32\EnableConsoleTracing

4. Delete the registry data
     18446744073709486080

   Under the key:
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\862d9a823ae99b9181b7_RASAPI32\ConsoleTracingMask

5. Delete the registry data
     1048576

   Under the key:
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\862d9a823ae99b9181b7_RASAPI32\MaxFileSize

6. Delete the registry data
     %windir%\tracing

   Under the key:
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\862d9a823ae99b9181b7_RASAPI32\FileDirectory
7. Close the Windows registry.
8. Restart the machine.