Summary
Files detected as Sus/Behav-166 exhibit suspicious behaviour.
Detailed analysis
Example behaviours of Sus/Behav-166 follow:
Example 1
Runtime Analysis
Registry Keys Created
- HKCR\BFWorkFile1007PV
- DFile
- 053044191052035073197117050033083097113065237121217042115149073012047231149166
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
- {78E611A2-E484-4A0D-811E-C40100A3F452}
- Maihook1007
- HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
- {78E611A2-E484-4A0D-811E-C40100A3F452} {00000000-0000-0000-C000-000000000046} 0x401
- 01 00 00 00 31 00 32 00 0c af 6b 56 7f 59 cb 01
Example 2
Example 3