BAROSVC.EXE – Unclassified Malware removal

BAROSVC.EXE size: 98382 bytes
BAROSVC.EXE hash: EEAB4B288312FDB32A13F8ED0A9F9EDC

Created files:

%Program Files%\barocn\barocn.exe
%Program Files%\barocn\barosvc.exe
%Program Files%\barocn\uninst.exe
%Common AppData%\Microsoft\Dr Watson\user.dmp

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\barocn\Type: 10000000
HKLM\System\CurrentControlSet\Services\barocn\Start: 02000000
HKLM\System\CurrentControlSet\Services\barocn\ErrorControl: 01000000
HKLM\System\CurrentControlSet\Services\barocn\DisplayName: barocn svc
HKLM\System\CurrentControlSet\Services\barocn\ImagePath: %Program Files%\barocn\barosvc.exe

Detected by UnHackMe:

BAROSVC.EXE
Default location: %PROGRAM FILES%\BAROCN\BAROSVC.EXE

Dropper information:
MD5: 62c82fea6ddd2c530fc4bb0de94c995e
File size: 161531 bytes