CR01.EXE – Unclassified Malware removal

CR01.EXE size: 3860327 bytes
CR01.EXE hash: 823AF4A7CFD18F8A792FFE4774FB503C

Created files:

%TEMP%\ir_ext_temp_0\AutoPlay\autorun.cdd
%TEMP%\ir_ext_temp_0\AutoPlay\Buttons\1.btn
%TEMP%\ir_ext_temp_0\AutoPlay\Buttons\2.btn
%TEMP%\ir_ext_temp_0\AutoPlay\Buttons\3.btn
%TEMP%\ir_ext_temp_0\AutoPlay\Buttons\4.btn
%TEMP%\ir_ext_temp_0\AutoPlay\Buttons\5.btn
%TEMP%\ir_ext_temp_0\AutoPlay\Buttons\8_1030.btn
%TEMP%\ir_ext_temp_0\AutoPlay\Buttons\botoncorchete.btn
%TEMP%\ir_ext_temp_0\AutoPlay\Buttons\BRedondeado.btn
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\AutoPlay\botoncorchete.btn
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\AutoPlay\BRedondeado.btn
%TEMP%\ir_ext_temp_0\AutoPlay\Docs\AutoPlay\Sin t?tulo-1.psd
%TEMP%\ir_ext_temp_0\AutoPlay\Plugins\IRDissolveTransition.tns
%TEMP%\ir_ext_temp_0\AutoPlay\Plugins\IRSlideTransition.tns
%TEMP%\ir_ext_temp_0\AutoPlay\Plugins\SendKeys\SendKeys.lmd
%TEMP%\ir_ext_temp_0\autorun.exe
%TEMP%\ir_ext_temp_0\CREAR\Actualizador.dll
%TEMP%\ir_ext_temp_0\CREAR\adjuntos.pdf
%TEMP%\ir_ext_temp_0\CREAR\b1_pf_cbe.pdf
%TEMP%\ir_ext_temp_0\CREAR\b2_pj_cbe.pdf
%TEMP%\ir_ext_temp_0\CREAR\b3_pf_sbe.pdf
%TEMP%\ir_ext_temp_0\CREAR\b4_pj_sbe.pdf
%TEMP%\ir_ext_temp_0\CREAR\CapaDatos.dll
%TEMP%\ir_ext_temp_0\CREAR\Capas.dll
%TEMP%\ir_ext_temp_0\CREAR\capsb_01.pdf
%TEMP%\ir_ext_temp_0\CREAR\capsb_02.pdf
%TEMP%\ir_ext_temp_0\CREAR\capsb_03.pdf
%TEMP%\ir_ext_temp_0\CREAR\capsb_04.pdf
%TEMP%\ir_ext_temp_0\CREAR\capsb_05.pdf
%TEMP%\ir_ext_temp_0\CREAR\cap_01.pdf
%TEMP%\ir_ext_temp_0\CREAR\cap_02.pdf
%TEMP%\ir_ext_temp_0\CREAR\cap_03.pdf
%TEMP%\ir_ext_temp_0\CREAR\cap_04.pdf
%TEMP%\ir_ext_temp_0\CREAR\cap_05.pdf
%TEMP%\ir_ext_temp_0\CREAR\cap_06.pdf
%TEMP%\ir_ext_temp_0\CREAR\cap_07.pdf
%TEMP%\ir_ext_temp_0\CREAR\cap_08.pdf
%TEMP%\ir_ext_temp_0\CREAR\cap_09.pdf
%TEMP%\ir_ext_temp_0\CREAR\cap_10.pdf
%TEMP%\ir_ext_temp_0\CREAR\cap_11.pdf
%TEMP%\ir_ext_temp_0\CREAR\cap_12.pdf
%TEMP%\ir_ext_temp_0\CREAR\cnae.pdf
%TEMP%\ir_ext_temp_0\CREAR\cr01.exe
%TEMP%\ir_ext_temp_0\CREAR\CREAR.exe
%TEMP%\ir_ext_temp_0\CREAR\db2_pf.pdf
%TEMP%\ir_ext_temp_0\CREAR\db2_pj.pdf
%TEMP%\ir_ext_temp_0\CREAR\dch_pf.pdf
%TEMP%\ir_ext_temp_0\CREAR\dch_pj.pdf
%TEMP%\ir_ext_temp_0\CREAR\fol.pdf
%TEMP%\ir_ext_temp_0\CREAR\g1.pdf
%TEMP%\ir_ext_temp_0\CREAR\g2.pdf
%TEMP%\ir_ext_temp_0\CREAR\g3.pdf
%TEMP%\ir_ext_temp_0\CREAR\g4.pdf
%TEMP%\ir_ext_temp_0\CREAR\g5.pdf
%TEMP%\ir_ext_temp_0\CREAR\g6.pdf
%TEMP%\ir_ext_temp_0\CREAR\g7.pdf
%TEMP%\ir_ext_temp_0\CREAR\g8.pdf
%TEMP%\ir_ext_temp_0\CREAR\gcompleto.pdf
%TEMP%\ir_ext_temp_0\CREAR\grcrear.pdf

Detected by UnHackMe:

CR01.EXE
Default location: %TEMP%\IR_EXT_TEMP_0\CREAR\CR01.EXE

Dropper information:
MD5: 14baf54501e0a3b91871a460b3c0d062
File size: 33264335 bytes