>it immediately began to install files, a “very out-of-the-ordinary” event that he had never seen happen before during this kind of analysis. The agent had to i

>it immediately began to install files, a “very out-of-the-ordinary” event that he had never seen happen before during this kind of analysis. The agent had to immediately stop the analysis to halt any further corruption of his computer I've seen some versions of Windows present a conspicuous file copy dialog box when it sees a new flash drive plugged in (or even the same flash drive plugged in to a new port) - some song and dance about copying *.INF driver files. On the other hand I would expect a malicious flash drive to be as silent as possible. What are the odds the agent was just misinterpreting this?