ThreatExpert Report

Technical Details:

File System Modifications

The following files were created in the system:

Filename(s)

File Size

File Hash

Alias

%Temp%\bios\erase.me
%Temp%\patches\erase.me

25 bytes

MD5: 0x47295AB66EDD6CB81E19148F68B9E3EA
SHA-1: 0x4349F8178595B3AFE443C487F01B189437360870

(not available)

%Temp%\burutter.dll

28,672 bytes

MD5: 0x9701637F8473975E7A8472D462B32CC5
SHA-1: 0x85A7B135834C3F47A71B84ED9E005B8FBFB68572

(not available)

%Temp%\cheats\breath_of_fire_4_usa.cht

56 bytes

MD5: 0x7FB2C3C9E74BC183A4D89E2F0B0230E5
SHA-1: 0x4467D92DA3F612BD3C75EDFEEB074B8DCDCDDBF1

(not available)

%Temp%\docs\ePSXe_en.txt

40,075 bytes

MD5: 0x296DE9677FACD96886DE0326DC0E45AF
SHA-1: 0x0131C37B864EB059D12CA1D23A77187ED6183926

(not available)

%Temp%\docs\ePSXe_sp.txt

46,643 bytes

MD5: 0xE06378EE9DC79CA82FB62E84D092A47B
SHA-1: 0xCD69817DBEFEC10D7871E19D0DE9E4C1E6DFDA66

(not available)

%Temp%\epsxe.chm

92,662 bytes

MD5: 0x169EEB55F1370342934C41B515D6A0D7
SHA-1: 0xE8E5FE6AF3114DA9E5DEB71D9E56B04F3D113A56

(not available)

%Temp%\ePSXe.exe

275,456 bytes

MD5: 0x961304568D43D6CA2279CD28C7D1DC50
SHA-1: 0x21E20EE68C8943C36617921B7F86FE35845B1A4A

packed with PE_Patch.UPX [Kaspersky Lab]

%Temp%\memcards\delete.me

16 bytes

MD5: 0x961CAAAE81980EE4CB40D40104EB330A
SHA-1: 0x2E891831D8B42D00E9ECE0936DFA20711969879D

(not available)

%Temp%\plugins\gpu.dat

548,864 bytes

MD5: 0xF8011FF485A9629BD88C682FF9E37222
SHA-1: 0x0FBE3E91D6739D6696ED74CBF89CE2502808ED77

(not available)

%Temp%\plugins\remove.me

34 bytes

MD5: 0x70C7492142E39DD939080C576E19F905
SHA-1: 0x26E4A1E2ED502E4AE03360D3042DF8C4D3FA1E5B

(not available)

%Temp%\snap\kill.me

27 bytes

MD5: 0x53258AA5D33A6DF86081F145647886F1
SHA-1: 0xC7605F66FB6FB24E97FA34C93942C05DAE2DB478

(not available)

%Temp%\sstates\punch.me

17 bytes

MD5: 0xB897325AA55FCE08FD60CB5964DC81B2
SHA-1: 0x2ED1B2C24224C7610D48E9490345C885AE4FDA13

(not available)

[file and pathname of the sample #1]

529,265 bytes

MD5: 0x0FB0BF74E76C5AD67B7318250474D72A
SHA-1: 0x50A7D5324CF140EF0A1653AB7D07C800CE533675

(not available)

Note:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

The following directories were created:

%Temp%\bios
%Temp%\cheats
%Temp%\docs
%Temp%\memcards
%Temp%\patches
%Temp%\plugins
%Temp%\snap
%Temp%\sstates

Other details

Analysis of the file resources indicate the following possible countries of origin:

Spain

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.

Submission Summary:

Technical Details: