WINLOGIN.EXE – Trojan Kazy removal

WINLOGIN.EXE size: 210958 bytes
WINLOGIN.EXE hash: E19B0B1A55508A4064FE54003B52182D

Created files:

%Program Files%\%appdata%\Adobex64\api-example.php
%Program Files%\%appdata%\Adobex64\bat.exe
%Program Files%\%appdata%\Adobex64\diablo130302.cl
%Program Files%\%appdata%\Adobex64\diakgcn121016.cl
%Program Files%\%appdata%\Adobex64\example.conf
%Program Files%\%appdata%\Adobex64\invis.vbs
%Program Files%\%appdata%\Adobex64\libcurl.dll
%Program Files%\%appdata%\Adobex64\libeay32.dll
%Program Files%\%appdata%\Adobex64\libidn-11.dll
%Program Files%\%appdata%\Adobex64\librtmp.dll
%Program Files%\%appdata%\Adobex64\libssh2.dll
%Program Files%\%appdata%\Adobex64\libusb-1.0.dll
%Program Files%\%appdata%\Adobex64\miner.php
%Program Files%\%appdata%\Adobex64\phatk121016.cl
%Program Files%\%appdata%\Adobex64\poclbm130302.cl
%Program Files%\%appdata%\Adobex64\scrypt130511.cl
%Program Files%\%appdata%\Adobex64\ssleay32.dll
%Program Files%\%appdata%\Adobex64\winlogin.exe
%Program Files%\%appdata%\Adobex64\zlib1.dll

Detected by UnHackMe:

WINLOGIN.EXE
Default location: %PROGRAM FILES%\%APPDATA%\ADOBEX64\WINLOGIN.EXE

Dropper information:
MD5: 4f625de0e4830f9b6feb9ccc6ccecb05
File size: 1613791 bytes