ThreatExpert Report

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 8 September 2011, 12:09:48
Processing time: 8 min 38 sec
Submitted sample:

File MD5: 0x26CC4B034EBB1028A6079ADD419C11C8
File SHA-1: 0xD96FDD334810E55AC03630128CE9FB4B24967820
Filesize: 1,384,448 bytes

Technical Details:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash
1	%Temp%\Vwu\AESTFltr.exe	737,280 bytes	MD5: 0x2EE2B4BD9407C19C8E3794F2A1B4A0D0 SHA-1: 0x5B3FEF93F8F1956913485793D9579E1A8D69CB86
2	%Temp%\Vwu\Home.lnk	532 bytes	MD5: 0xE780FF1BCA8EC60ED9E21E2E2656C1CF SHA-1: 0x66B55C12FF0F37C271749C6FD123BA5B729BA9E5
3	%Temp%\Vwu\My Bluetooth Places.lnk	901 bytes	MD5: 0xB1018533129B5364E4AA09E41AA0A797 SHA-1: 0x8278C412E603DDDE80749311831AC5A6BF838DD8
4	%Temp%\Vwu\SecureCRT.exe	3,106,696 bytes	MD5: 0x4178DD7EFA401638304E06483179192B SHA-1: 0x73DC133B774D04FAC9B80B9F09754123F042CAB1
5	%Temp%\Vwu\tfswctrl.exe	122,939 bytes	MD5: 0x790490F273B0E3BCF05DC3C308ABCC0B SHA-1: 0xB4A083B40E4DC1BD5B702FAE187BF2B310FBA311
6	%Temp%\Vwu\vcredist_x86.bat	457 bytes	MD5: 0xA1D3004E0078F79E263A556EF3A8115E SHA-1: 0xA80D60614C8CDC7C3988E26AD15DC751D6BA19B9
7	[file and pathname of the sample #1]	1,384,448 bytes	MD5: 0x26CC4B034EBB1028A6079ADD419C11C8 SHA-1: 0xD96FDD334810E55AC03630128CE9FB4B24967820

Note:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

The following directory was created:

%Temp%\Vwu

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	1,400,832 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_CURRENT_USER\Software\Andrea Electronics
HKEY_CURRENT_USER\Software\Andrea Electronics\aestfltr
HKEY_CURRENT_USER\Software\Andrea Electronics\aestfltr\Settings

The newly created Registry Value is:

[HKEY_CURRENT_USER\Software\Andrea Electronics\aestfltr\Settings]

FilePath = ""%Temp%\vwu\aestfltr.exe""

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.