The source file executable install itself under C:\Users\\GUCUE directory. This directory looks empty if the malware process is running and hiding the files. However, the contents listed earlier are still in that directory.