SWISSARMYKNIFEV3.EXE – Unclassified Malware removal

SWISSARMYKNIFEV3.EXE size: 400384 bytes
SWISSARMYKNIFEV3.EXE hash: 5BE7786513FDB0288F276439487351EA

Created files:

%SysDir%\MSDCSC\msdcsc.exe
%TEMP%\SWISSARMYKNIFEV3.EXE

Autostart registry keys:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit: %WinDir%\System32\userinit.exe,%WinDir%\System32\MSDCSC\msdcsc.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate: %WinDir%\System32\MSDCSC\msdcsc.exe

Detected by UnHackMe:

SWISSARMYKNIFEV3.EXE
Default location: %TEMP%\SWISSARMYKNIFEV3.EXE

Dropper information:
MD5: 0407eefb5590a438721b27cacffc9117
File size: 1079808 bytes