Behavior Details

1. Dropped files:
37b96238.exe
Under the folder
C:\programdata\{9A06B2A7-53D6-C38F-0E90-E29FD34CA467}

2. Dropped files:
Endpoint
Under the folder
\Device\Afd

3. Dropped files:
Report.wer.tmp
Report.wer
Under the folder
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_x64_e317d1ce19fa961dfda531fc4a2c595260922c_cab_052972aa

4. Dropped files:
RasAcd
Under the folder
\Device

5. Dropped files:
{06169A97-7BE6-5F9F-0E90-E29FD34CA467}
Under the folder
C:\Windows\sysnative\Tasks

6. Dropped files:
ValidationTask
ValidationTaskDeadline
Under the folder
C:\Windows\sysnative\Tasks\Microsoft\Windows\Windows Activation Technologies

7. Dropped files:
Uploader
Under the folder
C:\Windows\sysnative\Tasks\Microsoft\Windows\Customer Experience Improvement Program

8. Creates Registry:

Adds registry data
c:\programdata\{9A06B2A7-53D6-C38F-0E90-E29FD34CA467}\37b96238.exe

Under the key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\{06169A97-7BE6-5F9F-0E90-E29FD34CA467}

Adds registry data
1745231513

Under the key:
HKEY_CURRENT_USER\Software\Classes\CLSID\{9A06B2A4-53D5-C38F-0E90-E29FD34CA467}\(Default)

Removal Instructions

1. Update the copy of K7 security to the latest version.
2. Scan the system completely and remove the detected files.
3. Open Windows registry editor.
4. Delete the registry data
c:\programdata\{9A06B2A7-53D6-C38F-0E90-E29FD34CA467}\37b96238.exe

Under the key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\{06169A97-7BE6-5F9F-0E90-E29FD34CA467}

5. Delete the registry data
1745231513

Under the key:
HKEY_CURRENT_USER\Software\Classes\CLSID\{9A06B2A4-53D5-C38F-0E90-E29FD34CA467}\(Default)
6. Close the Windows registry.
7. Restart the machine.1. Update the copy of K7 security to the latest version.
2. Scan the system completely and remove the detected files.
3. Open Windows registry editor.
4. Delete the registry data
c:\programdata\{9A06B2A7-53D6-C38F-0E90-E29FD34CA467}\37b96238.exe

Under the key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\{06169A97-7BE6-5F9F-0E90-E29FD34CA467}

5. Delete the registry data
1745231513

Under the key:
HKEY_CURRENT_USER\Software\Classes\CLSID\{9A06B2A4-53D5-C38F-0E90-E29FD34CA467}\(Default)
6. Close the Windows registry.
7. Restart the machine.