ADDTOTRUSTEDSITE.EXE – Unclassified Malware removal

ADDTOTRUSTEDSITE.EXE size: 405504 bytes
ADDTOTRUSTEDSITE.EXE hash: 20C0262EA75EB14F8FCB742DE61E9D28

Created files:

%TEMP%\IXP000.TMP\AddToTrustedSite.exe
%TEMP%\IXP000.TMP\EBWebOffice.ocx
%TEMP%\IXP000.TMP\eWebEditorClient.dll
%TEMP%\IXP000.TMP\NewvCommon.ocx
%TEMP%\IXP000.TMP\NewvRecorder.ocx
%TEMP%\IXP000.TMP\WinLockDll.dll

Autostart registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0: rundll32.exe %WinDir%\System32\advpack.dll,DelNodeRunDLL32 “%TEMP%\IXP000.TMP\”

Detected by UnHackMe:

ADDTOTRUSTEDSITE.EXE
Default location: %TEMP%\IXP000.TMP\ADDTOTRUSTEDSITE.EXE

Dropper information:
MD5: c99082486af9ad80467e3a1648834003
File size: 678872 bytes