MACROMEDIA.EXE_PART1 – Unclassified Malware removal

MACROMEDIA.EXE_PART1 size: 10000 bytes
MACROMEDIA.EXE_PART1 hash: C6A77373CFED7891BF2CE2DF58A7C44D

Created files:

%Program Files%\%appdata%\WindowsLogon\coinutil.dll
%Program Files%\%appdata%\WindowsLogon\macro\macromedia.exe_part1
%Program Files%\%appdata%\WindowsLogon\macro\macromedia.exe_part2
%Program Files%\%appdata%\WindowsLogon\macro\macromedia.exe_part3
%Program Files%\%appdata%\WindowsLogon\macro\macromedia.exe_part4
%Program Files%\%appdata%\WindowsLogon\macro\macromedia.exe_part5
%Program Files%\%appdata%\WindowsLogon\macro\macromedia.exe_part6
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part1
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part10
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part11
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part12
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part13
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part14
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part15
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part16
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part17
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part18
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part19
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part2
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part20
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part21
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part22
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part23
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part24
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part25
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part26
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part27
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part28
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part29
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part3
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part30
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part31
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part32
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part33
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part34
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part35
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part4
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part5
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part6
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part7
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part8
%Program Files%\%appdata%\WindowsLogon\min\miner.dll_part9
%Program Files%\%appdata%\WindowsLogon\openssl.dll
%Program Files%\%appdata%\WindowsLogon\phatk.cl
%Program Files%\%appdata%\WindowsLogon\phatk.ptx
%Program Files%\%appdata%\WindowsLogon\puts.vbs
%Program Files%\%appdata%\WindowsLogon\shel\shell.exe_part1
%Program Files%\%appdata%\WindowsLogon\shel\shell.exe_part2
%Program Files%\%appdata%\WindowsLogon\shel\shell.exe_part3
%Program Files%\%appdata%\WindowsLogon\shel\shell.exe_part4
%Program Files%\%appdata%\WindowsLogon\shel\shell.exe_part5
%Program Files%\%appdata%\WindowsLogon\shel\shell.exe_part6
%Program Files%\%appdata%\WindowsLogon\usft_ext.dll
%Program Files%\%appdata%\WindowsLogon\usft_ext.exe.vbs

Detected by UnHackMe:

MACROMEDIA.EXE_PART1
Default location: %PROGRAM FILES%\%APPDATA%\WINDOWSLOGON\MACRO\MACROMEDIA.EXE_PART1

Dropper information:
MD5: 1b95399fd1a67f7a4b85f593b1f3f4e9
File size: 1029916 bytes