Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Setup.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
||
|
C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setup.ilg (copy)
|
Composite Document File V2 Document, Cannot read section info
|
dropped
|
||
|
C:\Program Files (x86)\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\setup.ini
|
Generic INItialization configuration [Languages]
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\58f1.rra
|
Composite Document File V2 Document, Cannot read section info
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{1FEFAA11-8F3D-4F80-A5E1-443AA44B1895}\Disk1\ISSetup.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, PECompact2 compressed
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{1FEFAA11-8F3D-4F80-A5E1-443AA44B1895}\Disk1\data1.cab
|
InstallShield CAB
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{1FEFAA11-8F3D-4F80-A5E1-443AA44B1895}\Disk1\data1.hdr
|
InstallShield CAB
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{1FEFAA11-8F3D-4F80-A5E1-443AA44B1895}\Disk1\layout.bin
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{1FEFAA11-8F3D-4F80-A5E1-443AA44B1895}\Disk1\setup.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{1FEFAA11-8F3D-4F80-A5E1-443AA44B1895}\Disk1\setup.ini
|
Generic INItialization configuration [Languages]
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{1FEFAA11-8F3D-4F80-A5E1-443AA44B1895}\Disk1\setup.inx
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{1FEFAA11-8F3D-4F80-A5E1-443AA44B1895}\Disk1\setup.iss
|
Generic INItialization configuration [File Transfer]
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{1FEFAA11-8F3D-4F80-A5E1-443AA44B1895}\_Setup.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{254b0c33-77a9-5a4b-be66-7d93eedacb69}\SETB5E8.tmp
|
Windows setup INFormation
|
modified
|
||
|
C:\Users\user\AppData\Local\Temp\{254b0c33-77a9-5a4b-be66-7d93eedacb69}\ser2pl.inf (copy)
|
Windows setup INFormation
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{5D8075F0-4DED-4B0C-B9EB-DF1DCD69C020}\ISBE59db.rra
|
PE32+ executable (GUI) x86-64, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{5D8075F0-4DED-4B0C-B9EB-DF1DCD69C020}\ISBEW64.exe (copy)
|
PE32+ executable (GUI) x86-64, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{5D8075F0-4DED-4B0C-B9EB-DF1DCD69C020}\core599d.rra
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{5D8075F0-4DED-4B0C-B9EB-DF1DCD69C020}\corecomp.ini (copy)
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{5D8075F0-4DED-4B0C-B9EB-DF1DCD69C020}\dotn599d.rra
|
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{5D8075F0-4DED-4B0C-B9EB-DF1DCD69C020}\dotnetinstaller.exe (copy)
|
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{5D8075F0-4DED-4B0C-B9EB-DF1DCD69C020}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\DIFx59cc.rra
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{5D8075F0-4DED-4B0C-B9EB-DF1DCD69C020}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\DIFxData.ini
(copy)
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{5D8075F0-4DED-4B0C-B9EB-DF1DCD69C020}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Font59bc.rra
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{5D8075F0-4DED-4B0C-B9EB-DF1DCD69C020}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\FontData.ini
(copy)
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{5D8075F0-4DED-4B0C-B9EB-DF1DCD69C020}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Lice597e.rra
|
ASCII text, with very long lines (943), with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{5D8075F0-4DED-4B0C-B9EB-DF1DCD69C020}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\License.txt
(copy)
|
ASCII text, with very long lines (943), with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{5D8075F0-4DED-4B0C-B9EB-DF1DCD69C020}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Setu598d.rra
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{5D8075F0-4DED-4B0C-B9EB-DF1DCD69C020}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\SetupEx.dll
(copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{5D8075F0-4DED-4B0C-B9EB-DF1DCD69C020}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Stri59eb.rra
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{5D8075F0-4DED-4B0C-B9EB-DF1DCD69C020}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\StringTable-0009-English.ips
(copy)
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{5D8075F0-4DED-4B0C-B9EB-DF1DCD69C020}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Vista\ser2ac03.rra
|
PE32 executable (native) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{5D8075F0-4DED-4B0C-B9EB-DF1DCD69C020}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Vista\ser2pl.inf
(copy)
|
PE32 executable (native) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{5D8075F0-4DED-4B0C-B9EB-DF1DCD69C020}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Vista\ser2pl.sys
(copy)
|
PE32 executable (native) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{5D8075F0-4DED-4B0C-B9EB-DF1DCD69C020}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\_IsR5a1a.rra
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, PECompact2 compressed
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{5D8075F0-4DED-4B0C-B9EB-DF1DCD69C020}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\_IsRes.dll
(copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, PECompact2 compressed
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{5D8075F0-4DED-4B0C-B9EB-DF1DCD69C020}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\defa5a0a.rra
|
RIFF (little-endian) data, palette, 1168 bytes, data size 1028, 256 entries, extra bytes 0x6f66666c
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{5D8075F0-4DED-4B0C-B9EB-DF1DCD69C020}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\default.pal
(copy)
|
RIFF (little-endian) data, palette, 1168 bytes, data size 1028, 256 entries, extra bytes 0x6f66666c
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{5D8075F0-4DED-4B0C-B9EB-DF1DCD69C020}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\isrt.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, PECompact2 compressed
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\{5D8075F0-4DED-4B0C-B9EB-DF1DCD69C020}\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\isrt59eb.rra
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, PECompact2 compressed
|
dropped
|
||
|
C:\Windows\INF\SERSabb4.rra
|
Windows setup INFormation
|
dropped
|
||
|
C:\Windows\INF\SERWabb4.rra
|
Generic INItialization configuration [Pro]
|
dropped
|
||
|
C:\Windows\INF\setupapi.dev.log
|
Generic INItialization configuration [BeginLog]
|
dropped
|
||
|
C:\Windows\SysWOW64\SER9PL.sys (copy)
|
PE32 executable (native) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Windows\SysWOW64\SER9ab95.rra
|
PE32 executable (native) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Windows\SysWOW64\SERSPL.VXD (copy)
|
MS-DOS executable, LE executable for MS Windows (VxD)
|
dropped
|
||
|
C:\Windows\SysWOW64\SERSaba5.rra
|
MS-DOS executable, LE executable for MS Windows (VxD)
|
dropped
|
||
|
C:\Windows\System32\DriverStore\Temp\{8c53135d-4d2b-fe49-94ed-d03bab0b35f4}\SETBD77.tmp
|
PE32+ executable (native) x86-64, for MS Windows
|
dropped
|
||
|
C:\Windows\System32\DriverStore\Temp\{8c53135d-4d2b-fe49-94ed-d03bab0b35f4}\SETBE72.tmp
|
data
|
dropped
|
||
|
C:\Windows\System32\DriverStore\Temp\{8c53135d-4d2b-fe49-94ed-d03bab0b35f4}\ser2pl.cat (copy)
|
data
|
dropped
|
||
|
C:\Windows\System32\DriverStore\Temp\{8c53135d-4d2b-fe49-94ed-d03bab0b35f4}\ser2pl64.sys (copy)
|
PE32+ executable (native) x86-64, for MS Windows
|
dropped
|
||
|
C:\Windows\System32\catroot2\dberr.txt
|
ASCII text, with CRLF line terminators
|
modified
|
||
|
C:\Windows\Temp\Deleabd4.rra
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Windows\Temp\DeleteUSB.exe (copy)
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Windows\Temp\PLUninst.exe (copy)
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Windows\Temp\QRemabb4.rra
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Windows\Temp\QRemover.exe (copy)
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Windows\Temp\Uninabe3.rra
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Windows\Temp\Uninstall.ICO (copy)
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Windows\Temp\Uninstall.exe (copy)
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Windows\inf\SERSPL.INF (copy)
|
Windows setup INFormation
|
dropped
|
||
|
C:\Windows\inf\SERWPL.INF (copy)
|
Generic INItialization configuration [Pro]
|
dropped
|
There are 52 hidden files, click here to show them.