ThreatExpert Report

Submission Summary:

Submission details:

Submission received: 11 September 2011, 09:04:11
Processing time: 9 min 34 sec
Submitted sample:

File MD5: 0xBF5007B61A803390EF0A02E5B8074E23
File SHA-1: 0xDFC199FFF877AEFC167E9790D341A87EABBE8E8D
Filesize: 3,649,080 bytes

Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Downloads/requests other files from Internet.
Creates a startup registry entry.
Registers a 32-bit in-process server DLL.
Registers a Browser Helper Object (Microsoft's Internet Explorer plugin module).

Technical Details:

The new window was created, as shown below:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash
1	%AppData%\PCTuto\PCTuto\autoupdater.exe	663,168 bytes	MD5: 0x6D8D4EF5E23EC7A3E739BBD9AE941961 SHA-1: 0x03B39D5E8B77894DD8F7DD620DCD71442594339C
2	%AppData%\PCTuto\PCTuto\help_config.cyp	128 bytes	MD5: 0xC04F0940CF62ACF5D30ED48D542EF8D0 SHA-1: 0x75D31086F88B94473D8DF481FDB8F08438F3176A
3	[pathname with a string SHARE]\shared.cyp	32 bytes	MD5: 0xB87D61F807A48D4BB8ED92D4A4416130 SHA-1: 0x4DA552EC023211D87869213AA88E3DE4ECAAE9D1
4	%AppData%\PCTuto\PCTuto\Software\itsTV\4.0.0.2532532\frsu.exe	20,480 bytes	MD5: 0xB160131F489AF743217C1B89D9176454 SHA-1: 0x0B630B55B8855CE8DABFE22ED34025447C9BB495
5	%AppData%\PCTuto\PCTuto\UpdatePCTuto.exe	769,664 bytes	MD5: 0x97547C615C63033190D2C45344824CB4 SHA-1: 0xB09F98BBEBDA3054F9DC7567D35DE6659A5C4950
6	%AppData%\PCTuto\PCTuto\user_config.cyp	300 bytes	MD5: 0x94F59E1EC883853DBB080E386FECF905 SHA-1: 0x8C33BFE3920DFF47B414AC6090DFB928624E7057
7	%AppData%\PCTuto\PCTuto\user_profil.cyp	856 bytes	MD5: 0xBF4986342FB5D3071BF0C22573CA18CC SHA-1: 0x9FD2B019610E54314AAA21C79707B4EF29BF786B
8	%AppData%\PCTuto\PCTuto\confmedia.cyp %ProgramFiles%\PCTuto\confmedia.cyp	2,712 bytes	MD5: 0x60E9F80E46832C92E348637401C04ECA SHA-1: 0xEBB640B779A5AF293E6FDD7736F89DEF64FAB347
9	%AppData%\PCTuto\PCTuto\EoStats\eoStats.txt %Temp%\ins2.tmp	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709
10	%AppData%\PCTuto\PCTuto\pctuto_confMedia.cyp	2,840 bytes	MD5: 0x0249B362331B6847F0AE95D095C929CF SHA-1: 0x11DA8BAEEE7BB51AF41712BB353BFE6B2D7B4953
11	%AppData%\PCTuto\PCTuto\user.cyp	152 bytes	MD5: 0x59F53D94D57C9D29D2AEEBC56D7AC17A SHA-1: 0x16A3A4916066B02DA6F6287958F7DD34FF96C53A
12	%Temp%\dd_vcredistUI1370.txt	1,060 bytes	MD5: 0xDAADBF679AC3B3D5294A2E9312BB52EC SHA-1: 0x31602FD194460475CE5621A7D293B600D68E9F9B
13	%Temp%\VGX10.tmp %Temp%\VGX26.tmp %Temp%\VGX38.tmp %Temp%\VGX4C.tmp	1,397 bytes	MD5: 0xD5417453A79455BFDF96F36C56421493 SHA-1: 0x123D2354237B1CE6A7EABAA8F1D618CBB60B2177
14	%Temp%\VGX11.tmp %Temp%\VGX27.tmp %Temp%\VGX3A.tmp %Temp%\VGX4D.tmp	1,580 bytes	MD5: 0xD5FD53E583FE8AF8AC0982662B06B778 SHA-1: 0xF2D48C3973FA92D3D1DD0C5B944D39489FB1E970
15	%Temp%\VGX12.tmp %Temp%\VGX28.tmp %Temp%\VGX39.tmp %Temp%\VGX4E.tmp	808 bytes	MD5: 0x69DD89C9CEE1BBE7625EFBF970AFB1FB SHA-1: 0x4854ABCC6294724108F967EA4CC06A4EA92930DA
16	%Temp%\VGX13.tmp %Temp%\VGX29.tmp %Temp%\VGX3B.tmp %Temp%\VGX4F.tmp	1,309 bytes	MD5: 0xE204B4A87C3E5183B87E2FA15C806134 SHA-1: 0xBE0085D131BFB8F3B6630E38F61392AEE656A442
17	%Temp%\VGX14.tmp %Temp%\VGX2A.tmp %Temp%\VGX3C.tmp %Temp%\VGX50.tmp	1,564 bytes	MD5: 0xF6DECF0DC0B523CCE0283C6944468F40 SHA-1: 0xB9854DE8B5F465DD77A41E802606AB9F8C947C47
18	%Temp%\VGX15.tmp %Temp%\VGX2B.tmp %Temp%\VGX3D.tmp %Temp%\VGX51.tmp	30,563 bytes	MD5: 0x04AF930FCF53FD604BD82D7DAF92632C SHA-1: 0xD8961CE12832F07B68A45C76BC74A7AAE209DA46
19	%Temp%\VGX16.tmp %Temp%\VGX2D.tmp %Temp%\VGX3E.tmp %Temp%\VGX52.tmp	1,139 bytes	MD5: 0x61F76F87E44793F458F0E808BBA888CC SHA-1: 0x0604128FA553136B298A3CC1F48DC2B2AD3135B1
20	%Temp%\VGX17.tmp %Temp%\VGX30.tmp	940 bytes	MD5: 0xB39D6C715423DEB2771B447E92C5B9B7 SHA-1: 0x1D16AE9A374EC237710586C9D8E45CEAFC0EC829
21	%Temp%\VGX18.tmp %Temp%\VGX2E.tmp	784 bytes	MD5: 0xDB8F839760606148983A0A1D0FE8CAB8 SHA-1: 0xE0E2B570F8733F7838F1FB61C8CA95A03E2FD6E4
22	%Temp%\VGX19.tmp %Temp%\VGX2F.tmp %Temp%\VGX44.tmp %Temp%\VGX54.tmp	878 bytes	MD5: 0x3B440280E6FFA4E0ADE4327C129D69C1 SHA-1: 0x350AB826587C58A0B0757F7B8F59B62C997AF119
23	%Temp%\VGX1A.tmp %Temp%\VGX3.tmp %Temp%\VGX31.tmp %Temp%\VGX3F.tmp	3,095 bytes	MD5: 0x162475634E903776F5D2C6A5206C87A7 SHA-1: 0x3FFD931818005F05C8DB257F4860BAD82647855C
24	%Temp%\VGX1B.tmp %Temp%\VGX32.tmp %Temp%\VGX4.tmp %Temp%\VGX40.tmp	139,684 bytes	MD5: 0xA48D8A78B0C784402B4D41BFCD676490 SHA-1: 0x900CE697165239DE9EFF1A330B02F726D7F9DE9D
25	%Temp%\VGX1C.tmp %Temp%\VGX45.tmp %Temp%\VGX56.tmp %Temp%\VGX6.tmp	7,064 bytes	MD5: 0x6827E53FC97CF835598BEFD028EFA6E8 SHA-1: 0x5100F0B948F90E58289972DF3655A7DAA880EC8F
26	%Temp%\VGX1D.tmp %Temp%\VGX46.tmp %Temp%\VGX55.tmp %Temp%\VGX7.tmp	145 bytes	MD5: 0xD72CB7CD89932F369BF2F1719F027F76 SHA-1: 0x12B3EEA9E21109AC96709BC2BDB68AA6D33F7C37
27	%Temp%\VGX1E.tmp %Temp%\VGX47.tmp %Temp%\VGX57.tmp %Temp%\VGX8.tmp	5,909 bytes	MD5: 0x2CBC5FDDDB27E3C58B5B82086642A82D SHA-1: 0xE22CF4A8A41CC06E43834DF57FC33DB5AAA483F4
28	%Temp%\VGX1F.tmp %Temp%\VGX48.tmp %Temp%\VGX58.tmp %Temp%\VGX9.tmp	881 bytes	MD5: 0x41D3122B90C97EAFCAE7CB7E59807087 SHA-1: 0xF8B077DE2CB1CDFFA40943A1B4065887045A1C57
29	%Temp%\VGX20.tmp %Temp%\VGX34.tmp %Temp%\VGX41.tmp %Temp%\VGXA.tmp	149 bytes	MD5: 0xBCADB97D40BE5EF0A6414BE8C234A762 SHA-1: 0x450C33DF18EF42D70C846F0D51EE194C1CAC73AE
30	%Temp%\VGX21.tmp %Temp%\VGX49.tmp %Temp%\VGX59.tmp %Temp%\VGXB.tmp	932 bytes	MD5: 0xFED44FAFA16B87010530778F083EEB5E SHA-1: 0x078645C224DE1515FACCC6A7042E4401CFEB4824
31	%Temp%\VGX22.tmp %Temp%\VGX4A.tmp %Temp%\VGX5A.tmp %Temp%\VGXC.tmp	440 bytes	MD5: 0x7986B2CC53D7A14C34CEF8DC862D7D57 SHA-1: 0x476203BABD713BF12416B39B85F4CBFA36BF6AEF
32	%Temp%\VGX23.tmp %Temp%\VGX35.tmp %Temp%\VGX42.tmp %Temp%\VGXD.tmp	941 bytes	MD5: 0xA95844D407F72EE255EF90BE12F04DEC SHA-1: 0x16F87C9B902E25453A060219BE6C18083879C631
33	%Temp%\VGX24.tmp %Temp%\VGX36.tmp %Temp%\VGX43.tmp %Temp%\VGXE.tmp	1,101 bytes	MD5: 0x807EC04AF390D9B802F2A60747437202 SHA-1: 0xEEFBB2AFD35D273AFA1D1442DE6036851B36718C
34	%Temp%\VGX25.tmp %Temp%\VGX37.tmp %Temp%\VGX4B.tmp %Temp%\VGXF.tmp	861 bytes	MD5: 0x1A9D5979BF02D9495DAF44D5F062F2CC SHA-1: 0xBD88552D251A08AF667F309353B9088B11D43D5A
35	%Temp%\VGX2C.tmp %Temp%\VGX33.tmp %Temp%\VGX5.tmp %Temp%\VGX53.tmp	193,549 bytes	MD5: 0x781C5A97E3C9CF12884A59E491CA7489 SHA-1: 0x1A80B4ED15BE92238F36C4D3452CC8013FFC5468
36	%ProgramFiles%\PCTuto\pctuto.exe	982,656 bytes	MD5: 0xE89AF3748774C10C12264E57AB3BAF4B SHA-1: 0xB625491CCEC649A4D6CFA4AB62409A69616E564F
37	%ProgramFiles%\PCTuto\pctutoBHO.dll	228,992 bytes	MD5: 0x110DFB1DFA4280E689B2486241EB918E SHA-1: 0x901AAD7E27E150D162F3B134FEAC8688558682BF
38	%ProgramFiles%\PCTuto\unins000.dat	6,488 bytes	MD5: 0x2CB4146FBDCA6433097E6F302CF75670 SHA-1: 0x7040D0898057F60AE39DFC15D0EFFF546F5F16C0
39	%ProgramFiles%\PCTuto\unins000.exe	1,180,625 bytes	MD5: 0xB2676D3DE7AFE48FC95B694D35C2F69D SHA-1: 0x4BA20C56A7E11320BDE395A50B69CC7CD064C843
40	[file and pathname of the sample #1]	3,649,080 bytes	MD5: 0xBF5007B61A803390EF0A02E5B8074E23 SHA-1: 0xDFC199FFF877AEFC167E9790D341A87EABBE8E8D

Notes:

%AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

The following directories were created:

%AppData%\PCTuto
%AppData%\PCTuto\PCTuto
%AppData%\PCTuto\PCTuto\Download
%AppData%\PCTuto\PCTuto\Software
%AppData%\PCTuto\PCTuto\Software\itsTV
%AppData%\PCTuto\PCTuto\Software\itsTV\4.0.0.2532532
%AppData%\PCTuto\PCTuto\EoStats
%ProgramFiles%\PCTuto

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1 without extension].tmp	%Temp%\is-F1HCM.tmp\[filename of the sample #1 without extension].tmp	1,269,760 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\PCTutoBHO.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{759F1421-4D31-4c1f-8C51-E4956A037676}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{293A63F7-C3B6-423a-9845-901AC0A7EE6E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{293A63F7-C3B6-423a-9845-901AC0A7EE6E}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{293A63F7-C3B6-423a-9845-901AC0A7EE6E}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{293A63F7-C3B6-423a-9845-901AC0A7EE6E}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{293A63F7-C3B6-423a-9845-901AC0A7EE6E}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{293A63F7-C3B6-423a-9845-901AC0A7EE6E}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E2ED56B6-35FC-4484-9530-EC87FB458E78}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E2ED56B6-35FC-4484-9530-EC87FB458E78}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E2ED56B6-35FC-4484-9530-EC87FB458E78}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E2ED56B6-35FC-4484-9530-EC87FB458E78}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0BF73E27-2734-4F7B-925A-4BBB1457F5FA}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0BF73E27-2734-4F7B-925A-4BBB1457F5FA}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0BF73E27-2734-4F7B-925A-4BBB1457F5FA}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0BF73E27-2734-4F7B-925A-4BBB1457F5FA}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0BF73E27-2734-4F7B-925A-4BBB1457F5FA}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0BF73E27-2734-4F7B-925A-4BBB1457F5FA}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PCTutoBHO.PCTBHO
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PCTutoBHO.PCTBHO\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PCTutoBHO.PCTBHO\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PCTutoBHO.PCTBHO.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PCTutoBHO.PCTBHO.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{293A63F7-C3B6-423a-9845-901AC0A7EE6E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PCTuto_is1
HKEY_LOCAL_MACHINE\SOFTWARE\PCTuto
HKEY_LOCAL_MACHINE\SOFTWARE\PCTuto\PCTuto
HKEY_CURRENT_USER\Software\PCTuto
HKEY_CURRENT_USER\Software\PCTuto\UpdatePCTuto

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\PCTutoBHO.DLL]

AppID = "{759F1421-4D31-4c1f-8C51-E4956A037676}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{759F1421-4D31-4c1f-8C51-E4956A037676}]

(Default) = "PCTutoBHO"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{293A63F7-C3B6-423a-9845-901AC0A7EE6E}\VersionIndependentProgID]

(Default) = "PCTutoBHO.PCTBHO"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{293A63F7-C3B6-423a-9845-901AC0A7EE6E}\TypeLib]

(Default) = "{{0BF73E27-2734-4f7b-925A-4BBB1457F5FA}}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{293A63F7-C3B6-423a-9845-901AC0A7EE6E}\ProgID]

(Default) = "PCTutoBHO.PCTBHO.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{293A63F7-C3B6-423a-9845-901AC0A7EE6E}\InprocServer32]

(Default) = "%ProgramFiles%\PCTuto\pctutoBHO.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{293A63F7-C3B6-423a-9845-901AC0A7EE6E}]

(Default) = "PCTBHO Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E2ED56B6-35FC-4484-9530-EC87FB458E78}\TypeLib]

(Default) = "{0BF73E27-2734-4F7B-925A-4BBB1457F5FA}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E2ED56B6-35FC-4484-9530-EC87FB458E78}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E2ED56B6-35FC-4484-9530-EC87FB458E78}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E2ED56B6-35FC-4484-9530-EC87FB458E78}]

(Default) = "IPCTBHO"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0BF73E27-2734-4F7B-925A-4BBB1457F5FA}\1.0\0\win32]

(Default) = "%ProgramFiles%\PCTuto\pctutoBHO.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0BF73E27-2734-4F7B-925A-4BBB1457F5FA}\1.0\HELPDIR]

(Default) = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0BF73E27-2734-4F7B-925A-4BBB1457F5FA}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0BF73E27-2734-4F7B-925A-4BBB1457F5FA}\1.0]

(Default) = "PCTEngineBHO 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PCTutoBHO.PCTBHO\CurVer]

(Default) = "PCTutoBHO.PCTBHO.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PCTutoBHO.PCTBHO\CLSID]

(Default) = "{293A63F7-C3B6-423a-9845-901AC0A7EE6E}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PCTutoBHO.PCTBHO]

(Default) = "PCTBHO Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PCTutoBHO.PCTBHO.1\CLSID]

(Default) = "{293A63F7-C3B6-423a-9845-901AC0A7EE6E}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PCTutoBHO.PCTBHO.1]

(Default) = "PCTBHO Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{293A63F7-C3B6-423a-9845-901AC0A7EE6E}]

(Default) = "PCTBHO"
NoExplorer = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

PCTuto = ""%ProgramFiles%\PCTuto\pctuto.exe""
autoupdater = "%AppData%\PCTuto\PCTuto\autoupdater.exe"

so that pctuto.exe runs every time Windows starts

so that autoupdater.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PCTuto_is1]

Inno Setup: Setup Version = "5.4.0 (u)"
Inno Setup: App Path = "%ProgramFiles%\PCTuto"
InstallLocation = "%ProgramFiles%\PCTuto\"
Inno Setup: Icon Group = "PCTuto"
Inno Setup: User = "%UserName%"
Inno Setup: Language = "fr"
DisplayName = "PCTuto 1.0"
UninstallString = ""%ProgramFiles%\PCTuto\unins000.exe""
QuietUninstallString = ""%ProgramFiles%\PCTuto\unins000.exe" /SILENT"
Publisher = "PCTuto"
URLInfoAbout = "http://www.pctuto.com"
HelpLink = "http://www.pctuto.com"
URLUpdateInfo = "http://www.pctuto.com"
NoModify = 0x00000001
NoRepair = 0x00000001
InstallDate = "20110911"

[HKEY_LOCAL_MACHINE\SOFTWARE\PCTuto\PCTuto]

PathInstall = "%ProgramFiles%\PCTuto"

[HKEY_LOCAL_MACHINE\SOFTWARE\PCTuto]

HostGUID = "0A65C030-96BA-42A5-9C1F-91FCD879A988"

[HKEY_CURRENT_USER\Software\PCTuto\UpdatePCTuto]

MainDir = "%AppData%\PCTuto\PCTuto"
Version = "1.0.0.0"
SoftwareDir = "%AppData%\PCTuto\PCTuto\Software"
DownloadDir = "%AppData%\PCTuto\PCTuto\Download"

[HKEY_CURRENT_USER\Software\PCTuto]

LCID = 0x00000409

The following Registry Value was modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Direct3D\MostRecentApplication]

Name =

Other details

Analysis of the file resources indicate the following possible countries of origin:

	France
	Netherlands

There were registered attempts to establish connection with the remote hosts. The connection details are:

Remote Host	Port Number
188.165.192.211	80
188.165.32.92	80
188.165.33.6	80
195.60.188.30	80
195.60.188.35	80
195.60.188.44	80
204.0.5.40	80
204.0.5.43	80
66.220.149.32	80
74.125.67.139	80

The data identified by the following URLs was then requested from the remote web server:

http://dles.eorezo.com/download/frsu.exe?jUrMqP9yIX5Hm9rwRub4rlhYPh0Sp3imlEqdDgH4VtQvQOmu%2BcQ1%2F3Lyuxbf7JsIIqaEjgnOTFby8gkOl07qPvY%2BDgi0xCNUkd4ZQiQ9zu4VbqXPgWF0rWwYtjSibWQcwwBMjGVGfiCoEaIsYl9h9tY5e9C7DjcpVLJNfS%2FkZDhPaqNC%2FFWlJouzCEgxFcqI
http://ad.advertstream.com/a/adclick.php?n_clic=258241218288015&cpme=SMqb2dN5PzbT1nbBuAhFHdc&bannerid=29667&zoneid=25824&log=no&dest=http%3A%2F%2Fsu600.com%2Fr.php%3Fdest%3Dhttp%253A%252F%252Fgt.eredan.com%252F%253Fp%253Dinscription%2526aw%253Dadvert_bid
http://ad.advertstream.com/a/adclick.php?n_clic=258241682268919702&cpme=4UsJcKiJF44INuGy_-fi8Pw&bannerid=29667&zoneid=25824&log=no&dest=http%3A%2F%2Fsu600.com%2Fr.php%3Fdest%3Dhttp%253A%252F%252Fgt.eredan.com%252F%253Fp%253Dinscription%2526aw%253Dadvert_bid
http://l.advertstream.com/a/adclick.php?n_clic=258241218288015&cpme=SMqb2dN5PzbT1nbBuAhFHdc&bannerid=29667&zoneid=25824&log=no&dest=http%3A%2F%2Fsu600.com%2Fr.php%3Fdest%3Dhttp%253A%252F%252Fgt.eredan.com%252F%253Fp%253Dinscription%2526aw%253Dadvert_bid
http://l.advertstream.com/a/adclick.php?n_clic=258241682268919702&cpme=4UsJcKiJF44INuGy_-fi8Pw&bannerid=29667&zoneid=25824&log=no&dest=http%3A%2F%2Fsu600.com%2Fr.php%3Fdest%3Dhttp%253A%252F%252Fgt.eredan.com%252F%253Fp%253Dinscription%2526aw%253Dadvert_bid
http://partenaires.feerik.com/cache/images/fr/2507_88.gif
http://partenaires.feerik.com/cache/images/fr/2513_88x31.gif
http://partenaires.feerik.com/cache/images/fr/2517_Itcg88X31.gif
http://partenaires.feerik.com/cache/images/fr/1860_88x31_01.gif
http://partenaires.feerik.com/cache/images/fr/2502_88x31.gif
http://partenaires.feerik.com/cache/images/fr/2511_88x31.gif
http://bar2.feerik.com/gt.jpg
http://bar2.feerik.com/itcg.png
http://bar2.feerik.com/feerik.png
http://bar2.feerik.com/fond.png
http://gt.eredan.com/?p=inscription&aw=advert_bid
http://gt.eredan.com/css/all.css
http://gt.eredan.com/css/global.css
http://gt.eredan.com/css/jquery.jscrollpane.css
http://gt.eredan.com/lib/base.js
http://gt.eredan.com/lib/fbconnect.js
http://gt.eredan.com/js/xjax.js
http://gt.eredan.com/js/jquery-ui.js
http://gt.eredan.com/js/jquery.gritter.js
http://gt.eredan.com/js/jquery.tooltip.js
http://static.ak.fbcdn.net/rsrc.php/v1/y_/r/K_NKCbppD2k.css
http://static.ak.fbcdn.net/rsrc.php/v1/y7/r/ql9vukDCc4R.png
http://static.ak.fbcdn.net/rsrc.php/v1/yz/r/VKS0m5QqjtF.js
http://static.ak.facebook.com/connect/canvas_proxy.php?version=3
http://www.facebook.com/plugins/like.php?href=http://www.facebook.com/eredan.gt&layout=button_count&show_faces=false&width=110&action=like&colorscheme=light
http://www.google-analytics.com/ga.js
http://partner.googleadservices.com/gampad/google_service.js
http://partner.googleadservices.com/gampad/google_ads.js
http://su600.com/publicite/com/zone.php?zone=25824
http://su600.com/a/adjs2.php?zoneid=25824
http://su600.com/r.php?dest=http%3A%2F%2Fgt.eredan.com%2F%3Fp%3Dinscription%26aw%3Dadvert_bid
http://prof.pctuto.com/cgi-bin/create_profile.cgi
http://prof.pctuto.com/cgi-bin/get_config.cgi
http://prof.pctuto.com/cgi-bin/get_update.cgi
http://ads.eorezo.com/cgi-bin/advert/getads?x_dp_id=43
http://log.pctuto.com/cgi-bin/trace.cgi
http://connect.facebook.net/fr_FR/all.js

Outbound traffic (potentially malicious)

There was an outbound traffic produced on port 80:

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.