PATCH-X64.EXE – Unclassified Malware removal

PATCH-X64.EXE size: 81768 bytes
PATCH-X64.EXE hash: 0546ABE6293BA40348E1734FAFCA47EC

Created files:

%SysDir%\vncrdpv3\Patch-x64.exe
%SysDir%\vncrdpv3\Patch-x86.exe
%SysDir%\vncrdpv3\setcad.exe
%SysDir%\vncrdpv3\termsrv.dll
%SysDir%\vncrdpv3\vnchooks.dll
%SysDir%\vncrdpv3\w8hook.dll
%SysDir%\vncrdpv3\winvnc.exe
%UserProfile%\system\app\bin\libeay32.dll
%UserProfile%\system\app\bin\libpkcs11-helper-1.dll
%UserProfile%\system\app\bin\lzo2.dll
%UserProfile%\system\app\bin\msvcr90.dll
%UserProfile%\system\app\bin\openssl.exe
%UserProfile%\system\app\bin\openvpn-gui.exe
%UserProfile%\system\app\bin\openvpn.exe
%UserProfile%\system\app\bin\openvpnserv.exe
%UserProfile%\system\app\bin\ssleay32.dll
%UserProfile%\system\app\bin\tapinstallWin32.exe
%UserProfile%\system\app\bin\tapinstallWin64.exe
%UserProfile%\system\app\driver\win32\tap0901.sys
%UserProfile%\system\app\driver\win64\tap0901.sys
%UserProfile%\system\data\config\ca.crt
%UserProfile%\system\data\config\vpnservice.wha.la.crt
%UserProfile%\system\OpenVPNPortable.exe
%UserProfile%\system\vncrdpv3.exe

Detected by UnHackMe:

PATCH-X64.EXE
Default location: %SYSDIR%\VNCRDPV3\PATCH-X64.EXE

Dropper information:
MD5: 3f53287673539fddd361d897f842913d
File size: 3105633 bytes