» BusinessEverywhere.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

BusinessEverywhere.exe

BusinessEverywhere Module

FRANCE TELECOM

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘Start_BusinessEverywhere_{e34778cb-4457-4646-b83d-76c8241d15b9}’.

File name:

Publisher:

FRANCE TELECOM (signed and verified)

Product:

BusinessEverywhere Module

Description:

Business Everywhere

Version:

4.2.4.8937M

MD5:

da240748c18b4c57e3d87a17aaa5748c

SHA-1:

a78e1f9a8a5ec135ea598d3f80d5c0d76956481f

SHA-256:

1b5b2c2ce0bb77ae9fece0246e350ecc2f83bf910042f89a89277aa0318fe6bb

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

4/24/2024 8:26:58 PM UTC (today)

File size:

3.5 MB (3,642,264 bytes)

Product version:

BEW424

Original file name:

BusinessEverywhere.exe

File type:

Executable application (Win32 EXE)

Language:

Language Neutral

Common path:

C:\Program Files\orangebusinessservices\business everywhere\{e34778cb-4457-4646-b83d-76c8241d15b9}\businesseverywhere.exe

Digital Signature

Signed by:

FRANCE TELECOM

Authority:

Thawte, Inc.

Valid from:

4/15/2013 2:00:00 AM

Valid to:

6/15/2014 1:59:59 AM

Subject:

CN=FRANCE TELECOM, OU=FT OLNC OLPS SOFT RENNES, O=FRANCE TELECOM, L=PARIS, S=Paris, C=FR

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

3EACBEF3A3101F5CC58B8B723E7E7E79

File PE Metadata

Compilation timestamp:

6/13/2013 4:47:10 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

49152:7aHhG2YT5683KN8BfIoBsw8ioy97j/v2pDx4+k755XXkX+MmlPxeOOdfyx09L+dZ:7OhG2MLd+jmSfL+dx7A+

Entry address:

0x1ED9A2

Entry point:

E8, 51, 08, 00, 00, E9, 37, FD, FF, FF, FF, 25, 9C, 46, 65, 00, FF, 25, A4, 46, 65, 00, FF, 25, AC, 46, 65, 00, FF, 25, B4, 46, 65, 00, FF, 25, C8, 46, 65, 00, FF, 25, D8, 46, 65, 00, FF, 25, E0, 46, 65, 00, FF, 25, F0, 46, 65, 00, FF, 25, F4, 46, 65, 00, FF, 25, F8, 46, 65, 00, FF, 25, FC, 46, 65, 00, FF, 25, 00, 47, 65, 00, FF, 25, 04, 47, 65, 00, FF, 25, 08, 47, 65, 00, 6A, 10, 68, B0, 42, 6F, 00, E8, 38, 04, 00, 00, 33, C0, 89, 45, E0, 89, 45, FC, 89, 45, E4, 8B, 45, E4, 3B, 45, 10, 7D, 13, 8B, 75, 08... 
[+]

Code size:

2.3 MB (2,437,120 bytes)

Startup File (All Users Run)

Registry location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

Start_BusinessEverywhere_{e34778cb-4457-4646-b83d-76c8241d15b9}

Command:

C:\Program Files\orangebusinessservices\business everywhere\{e34778cb-4457-4646-b83d-76c8241d15b9}\businesseverywhere.exe

The file BusinessEverywhere.exe has been discovered within the following program.

Business Everywhere by OrangeBusinessServices

www.orange.co.uk

About 4% of users remove it

Scan BusinessEverywhere.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.