MALI.EXE – Unclassified Malware removal

MALI.EXE size: 799256 bytes
MALI.EXE hash: 84DEABF70254107D179DF96DC593D8D2

Created files:

%AppData%\theam\common\bin\RemoveTAM.exe
%AppData%\theam\common\bin\TAMGuard.exe
%AppData%\theam\common\bin\TAMUpdate.exe
%AppData%\theam\common\bin\TheAM.exe
%SysDir%\mali.exe

Autostart registry keys:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\TheAM: %WinDir%\System32\config\Systemprofile\Application Data\theam\common\bin\TAMUpdate.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\guardtam: %WinDir%\System32\config\Systemprofile\Application Data\theam\common\bin\tamguard.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\tamgrd: %WinDir%\System32\config\Systemprofile\Application Data\theam\common\bin\TheAm.exe

Detected by UnHackMe:

MALI.EXE
Default location: %SYSDIR%\MALI.EXE

Dropper information:
MD5: 04e09092f1d671c83ac911657c2aa8d1
File size: 839680 bytes