NIRCMD.EXE – Unclassified Malware removal

NIRCMD.EXE size: 43520 bytes
NIRCMD.EXE hash: 466A42AEA0ABDF4C6B610F0F5E61CFA2

Created files:

C:\Windows\syso\critical\libcurl-4.dll
C:\Windows\syso\critical\libcurl.dll
C:\Windows\syso\critical\pthreadGC2.dll
C:\Windows\syso\critical\system.exe
C:\Windows\syso\critical\zlib1.dll
C:\Windows\system32\nircmd.exe

Autostart registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update: C:\Windows\syso\critical\antivirus.bat

Detected by UnHackMe:

NIRCMD.EXE
Default location: %SYSDIR%\NIRCMD.EXE

Dropper information:
MD5: a9e135b3f32fd24a59e603410c798d6c
File size: 593894 bytes