DAEMONUPD.EXE – Trojan Downloader removal

DAEMONUPD.EXE size: 32256 bytes
DAEMONUPD.EXE hash: 7A7CC467625FBC1EBD643712E4E5993F

Created files:

%Local AppData%\Google\Update\gupdate.exe
%Local AppData%\Microsoft\Windows\winupdate.exe
%Local AppData%\NVIDIA Corporation\Update\daemonupd.exe

Autostart registry keys:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\NvUpdService: %WinDir%\System32\config\Systemprofile\Local Settings\Application Data\NVIDIA Corporation\Update\daemonupd.exe /app D778BDE190E5214436FC2D9720C33B96
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Google Update: %WinDir%\System32\config\Systemprofile\Local Settings\Application Data\Google\Update\gupdate.exe /app D778BDE190E5214436FC2D9720C33B96

Detected by UnHackMe:

DAEMONUPD.EXE
Default location: %LOCAL APPDATA%\NVIDIA CORPORATION\UPDATE\DAEMONUPD.EXE

Dropper information:
MD5: 48c4e633209130eeaac048d59994c345
File size: 36589 bytes