Behavior Details

1. Dropped files:
__tmp_rar_sfx_access_check_20799479
config.bat
setup.exe
Under the folder
C:\Users\Public

2. Dropped files:
Windows PowerShell.lnk
Under the folder
C:\Users\Public\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell

3. Dropped files:
AZITZZX9ZP5OASPAI5LQ.temp
d93f411851d7c929.customDestinations-ms
Under the folder
C:\Users\\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations

4. Dropped files:
setup.tmp
Under the folder
C:\Users\\AppData\Local\Temp\is-L0439.tmp

Removal Instructions

1. Update the copy of K7 security to the latest version.
2. Scan the system completely and remove the detected files.
3. Restart the machine.