Behavior Details

1. Creates Registry:
Adds data
{0B76F689-C5F7-40D8-85AA-407BBABF1397}
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\InstalledWin32AppsRevision
Adds data
\x02\x00\x00\x00\xb6\xd2\xb0\x9b:\xf2\xdc\x01\x00\x00\x00\x00CB\x01\x00
\x12

9P\x00~\x00M\x00I\x00C\x00R\x00O\x00S\x00O\x00F\x00T\x00.\x00W\x00I\x00N\x00D\x00O\x00W\x00S\x00.\x00S\x00E\x00C\x00H\x00E\x00A\x00L\x00T\x00H\x00U\x00I\x00_\x00C\x00W\x005\x00N\x001\x00H\x002\x00T\x00X\x00Y\x00E\x00W\x00Y\x00!\x00S\x00E\x00C\x00H\x00E\x00A\x00L\x00T\x00H\x00U\x00I\x00\xc7
\xf0b ;\xc5\x14\x04\xc6\x1e\xa0\xe4\x9d\xa0\xa3\xca\xb7\xee\x01\x00*P\x00~\x00M\x00I\x00C\x00R\x00O\x00S\x00O\x00F\x00T\x00.\x00W\x00I\x00N\x00D\x00O\x00W\x00S\x00S\x00T\x00O\x00R\x00E\x00_\x008\x00W\x00E\x00K\x00Y\x00B\x003\x00D\x008\x00B\x00B\x00W\x00E\x00!\x00A\x00P\x00P\x00\xc7
\xe7\x9b_:\xc5\x14\x02\xc6\x1e\xe0\xa9\xcb\xd0\x8e\xcd\xb7\xee\x01\x00\x1cW\x00~\x00M\x00I\x00C\x00R\x00O\x00S\x00O\x00F\x00T\x00.\x00W\x00I\x00N\x00D\x00O\x00W\x00S\x00.\x00E\x00X\x00P\x00L\x00O\x00R\x00E\x00R\x00\xc7
%\xe5.=\xc5\x14’\xc6\x1e\xf0\xcf\x9f\x94\xd7\xb3\xbb\xee\x01\x00\x08W\x00~\x00M\x00S\x00E\x00D\x00G\x00E\x00\xc7
)\xfc\xea=\xc5\x14\x19\xc6\x1e\x80\xd9\xc3\x8d\xca\xb3\xbb\xee\x01\x000W\x00~\x00{\x001\x00A\x00C\x001\x004\x00E\x007\x007\x00-\x000\x002\x00E\x007\x00-\x004\x00E\x005\x00D\x00-\x00B\x007\x004\x004\x00-\x002\x00E\x00B\x001\x00A\x00E\x005\x001\x009\x008\x00B\x007\x00}\x00\\x00C\x00M\x00D\x00.\x00E\x00X\x00E\x00\xc7
u+\xa8=\xc5\x14+\xc6\x1e\xb0\xcc\xdf\x8b\xce\xed\xbb\xee\x01\x005W\x00~\x00{\x001\x00A\x00C
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\$de${9e86d2a2-54f2-4d00-9598-a92376f38323}$$windows.data.unifiedtile.localstartvolatiletilepropertiesmap\Current\Data
Adds data
\x92\xa5\xbd\x01\x00\x00\x00\x00
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wmic.exe\VBScriptSetScriptStateStarted
Adds data
0
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\VBSFile_.vbs
Adds data
1
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
Adds data
Microsoft \xae Windows Based Script Host
under
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\System32\WScript.exe.FriendlyAppName
Adds data
C:\RecoveryData\
under
HKEY_CURRENT_USER\SOFTWARE\WinRAR SFX\C%%RecoveryData%
Adds data
1
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
Adds data
1
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
Adds data
0
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
Adds data
{5AE1D45C-C87C-4690-A45C-9D549BDDFD1A}
under
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\InstalledWin32AppsRevision
Adds data
Microsoft Corporation
under
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\System32\WScript.exe.ApplicationCompany

Removal Instructions

1. Update K7 security to the latest version.
2. Open Windows registry editor and delete the following keys:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\InstalledWin32AppsRevision
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\$de${9e86d2a2-54f2-4d00-9598-a92376f38323}$$windows.data.unifiedtile.localstartvolatiletilepropertiesmap\Current\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wmic.exe\VBScriptSetScriptStateStarted
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\VBSFile_.vbs
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\System32\WScript.exe.FriendlyAppName
HKEY_CURRENT_USER\SOFTWARE\WinRAR SFX\C%%RecoveryData%
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\InstalledWin32AppsRevision
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\System32\WScript.exe.ApplicationCompany
3. Restart the machine.