Technical Information
Modifies file system
Creates the following files
- %TEMP%\e2eecore.2.7.2.dll
- %TEMP%\intel\uninstall.bat
- %TEMP%\intel\nvmupdatew64e.exe
- %TEMP%\intel\iqvw64e.sys
- %TEMP%\intel\iqvw64e.inf
- %TEMP%\intel\iqvw64e.cat
- %TEMP%\intel\iqvsw64e.sys
- %TEMP%\intel\iqvsw64e.inf
- %TEMP%\intel\iqvsw64e.cat
- %TEMP%\intel\intel_diagnostic_tools_license.pdf
- %TEMP%\intel\intel.mac
- %TEMP%\intel\intel.dat
- %TEMP%\intel\install.bat
- %TEMP%\intel\i211b_nobrand.txt
- %TEMP%\intel\i211b.txt
- %TEMP%\intel\i2104ma2_nobrand.bin
- %TEMP%\intel\i2104ma2.bin
- %TEMP%\intel\f4002e12_nobrand.eep
- %TEMP%\intel\f4002e12.eep
- %TEMP%\intel\eeupdatew64e.exe
- %TEMP%\intel\celow64e.exe
- %TEMP%\intel\82574_~2_nobrand.eep
- %TEMP%\intel\82574_~2.eep
- %TEMP%\intelcard.dll
- %TEMP%\intel\dpinst64.exe
- <DRIVERS>\iqvsw64e.sys
Network activity
Connects to
- 'wf##.com':80
TCP
HTTP GET requests
- http://wf##.com/data/admin/getinfo.php?na###############
UDP
- DNS ASK wf##.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\intelcard.dll'
Executes the following
- '<SYSTEM32>\cmd.exe' /c %TEMP%\intel\install.bat /y
- '<SYSTEM32>\cmd.exe' /c ver
- '%TEMP%\intelcard.dll' ' (with hidden window)
