Loading ...

Play interactive tourEdit tour

Analysis Report Agreement Terms Sample.pdf.exe

Overview

General Information

Sample Name:Agreement Terms Sample.pdf.exe
Analysis ID:339336
MD5:76b6c2b227dd2ae92bb3b86a66a8fe52
SHA1:db06ffb667569ab3b379012567c27919c36d885a
SHA256:128fa77a11cedbe782819f0d2e2666a04e4f8d2966a72f215c77b8933c914a47
Tags:exeGuLoader

Most interesting Screenshot:

Detection

GuLoader
Score:88
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected GuLoader
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Found potential dummy code loops (likely to delay analysis)
Initial sample is a PE file and has a suspicious name
Potential time zone aware malware
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected VB6 Downloader Generic
Abnormal high CPU Usage
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to read the PEB
PE file contains strange resources
Program does not show much activity (idle)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Startup

  • System is w10x64
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: Agreement Terms Sample.pdf.exe PID: 6116JoeSecurity_VB6DownloaderGenericYara detected VB6 Downloader GenericJoe Security
    Process Memory Space: Agreement Terms Sample.pdf.exe PID: 6116JoeSecurity_GuLoaderYara detected GuLoaderJoe Security

      Sigma Overview

      No Sigma rule has matched

      Signature Overview

      Click to jump to signature section

      Show All Signature Results

      AV Detection:

      barindex
      Multi AV Scanner detection for submitted fileShow sources
      Source: Agreement Terms Sample.pdf.exeVirustotal: Detection: 20%Perma Link
      Source: Agreement Terms Sample.pdf.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

      System Summary:

      barindex
      Initial sample is a PE file and has a suspicious nameShow sources
      Source: initial sampleStatic PE information: Filename: Agreement Terms Sample.pdf.exe
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeProcess Stats: CPU usage > 98%
      Source: Agreement Terms Sample.pdf.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
      Source: Agreement Terms Sample.pdf.exe, 00000000.00000002.1371583853.0000000000410000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameAffolker.exe vs Agreement Terms Sample.pdf.exe
      Source: Agreement Terms Sample.pdf.exeBinary or memory string: OriginalFilenameAffolker.exe vs Agreement Terms Sample.pdf.exe
      Source: Agreement Terms Sample.pdf.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      Source: classification engineClassification label: mal88.troj.evad.winEXE@1/0@0/0
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeFile created: C:\Users\user\AppData\Local\Temp\~DF053F462F68CD7C8A.TMPJump to behavior
      Source: Agreement Terms Sample.pdf.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dll
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
      Source: Agreement Terms Sample.pdf.exeVirustotal: Detection: 20%

      Data Obfuscation:

      barindex
      Yara detected GuLoaderShow sources
      Source: Yara matchFile source: Process Memory Space: Agreement Terms Sample.pdf.exe PID: 6116, type: MEMORY
      Yara detected VB6 Downloader GenericShow sources
      Source: Yara matchFile source: Process Memory Space: Agreement Terms Sample.pdf.exe PID: 6116, type: MEMORY
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_0040511F push ebp; ret
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_004085AB push esp; retf
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_0042406A pushfd ; iretd
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_0042181D pushfd ; iretd
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_004242BF pushfd ; iretd
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_00424167 pushfd ; iretd
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_00423F6B pushfd ; iretd
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_00423921 pushfd ; iretd
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_00424126 pushfd ; iretd
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_0042493E pushfd ; iretd
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_004241DB pushfd ; iretd
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_00423FE2 pushfd ; iretd

      Hooking and other Techniques for Hiding and Protection:

      barindex
      Uses an obfuscated file name to hide its real file extension (double extension)Show sources
      Source: Possible double extension: pdf.exeStatic PE information: Agreement Terms Sample.pdf.exe
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeProcess information set: NOOPENFILEERRORBOX

      Malware Analysis System Evasion:

      barindex
      Contains functionality to detect hardware virtualization (CPUID execution measurement)Show sources
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_00426C57
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_00426A17
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_00426A15
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_00426E18
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_00426CD1
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_00426AEF
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_00426CF6
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_00423F6B
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_004267F7
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_00426BAF
      Potential time zone aware malwareShow sources
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeSystem information queried: CurrentTimeZoneInformation
      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
      Source: Agreement Terms Sample.pdf.exeBinary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
      Tries to detect virtualization through RDTSC time measurementsShow sources
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeRDTSC instruction interceptor: First address: 00000000004262EB second address: 00000000004262EB instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FAB3093C388h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d add edi, edx 0x0000001f dec dword ptr [ebp+000000F8h] 0x00000025 cmp dl, 00000015h 0x00000028 cmp dword ptr [ebp+000000F8h], 00000000h 0x0000002f jne 00007FAB3093C365h 0x00000031 cmp dl, dl 0x00000033 cmp eax, ecx 0x00000035 call 00007FAB3093C3FDh 0x0000003a call 00007FAB3093C398h 0x0000003f lfence 0x00000042 mov edx, dword ptr [7FFE0014h] 0x00000048 lfence 0x0000004b ret 0x0000004c mov esi, edx 0x0000004e pushad 0x0000004f rdtsc
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_00426C57 rdtsc
      Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
      Source: Agreement Terms Sample.pdf.exeBinary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

      Anti Debugging:

      barindex
      Found potential dummy code loops (likely to delay analysis)Show sources
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeProcess Stats: CPU usage > 90% for more than 60s
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_00426C57 rdtsc
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_00426A17 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_00426A15 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_00425A2F mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_00421ED3 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_0042229E mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_00425F78 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_0042332A mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_00422537 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\Agreement Terms Sample.pdf.exeCode function: 0_2_004267F7 mov eax, dword ptr fs:[00000030h]
      Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
      Source: Agreement Terms Sample.pdf.exe, 00000000.00000002.1372402958.0000000000CE0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
      Source: Agreement Terms Sample.pdf.exe, 00000000.00000002.1372402958.0000000000CE0000.00000002.00000001.sdmpBinary or memory string: Progman
      Source: Agreement Terms Sample.pdf.exe, 00000000.00000002.1372402958.0000000000CE0000.00000002.00000001.sdmpBinary or memory string: &Program Manager
      Source: Agreement Terms Sample.pdf.exe, 00000000.00000002.1372402958.0000000000CE0000.00000002.00000001.sdmpBinary or memory string: Progmanlock

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection1Masquerading1OS Credential DumpingSystem Time Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsVirtualization/Sandbox Evasion11LSASS MemorySecurity Software Discovery411Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Process Injection1Security Account ManagerVirtualization/Sandbox Evasion11SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Obfuscated Files or Information11NTDSProcess Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA SecretsSystem Information Discovery21SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      Agreement Terms Sample.pdf.exe21%VirustotalBrowse
      Agreement Terms Sample.pdf.exe4%ReversingLabs

      Dropped Files

      No Antivirus matches

      Unpacked PE Files

      No Antivirus matches

      Domains

      No Antivirus matches

      URLs

      No Antivirus matches

      Domains and IPs

      Contacted Domains

      No contacted domains info

      Contacted IPs

      No contacted IP infos

      General Information

      Joe Sandbox Version:31.0.0 Red Diamond
      Analysis ID:339336
      Start date:13.01.2021
      Start time:21:13:29
      Joe Sandbox Product:CloudBasic
      Overall analysis duration:0h 10m 59s
      Hypervisor based Inspection enabled:false
      Report type:light
      Sample file name:Agreement Terms Sample.pdf.exe
      Cookbook file name:default.jbs
      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
      Number of analysed new started processes analysed:11
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • HCA enabled
      • EGA enabled
      • HDC enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Detection:MAL
      Classification:mal88.troj.evad.winEXE@1/0@0/0
      EGA Information:Failed
      HDC Information:
      • Successful, ratio: 12.5% (good quality ratio 3.3%)
      • Quality average: 14.9%
      • Quality standard deviation: 28.3%
      HCA Information:Failed
      Cookbook Comments:
      • Adjust boot time
      • Enable AMSI
      • Found application associated with file extension: .exe
      • Override analysis time to 240s for sample files taking high CPU consumption
      Warnings:
      Show All
      • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, MusNotifyIcon.exe, conhost.exe, svchost.exe

      Simulations

      Behavior and APIs

      No simulations

      Joe Sandbox View / Context

      IPs

      No context

      Domains

      No context

      ASN

      No context

      JA3 Fingerprints

      No context

      Dropped Files

      No context

      Created / dropped Files

      No created / dropped files found

      Static File Info

      General

      File type:PE32 executable (GUI) Intel 80386, for MS Windows
      Entropy (8bit):5.164931273631205
      TrID:
      • Win32 Executable (generic) a (10002005/4) 99.15%
      • Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81%
      • Generic Win/DOS Executable (2004/3) 0.02%
      • DOS Executable Generic (2002/1) 0.02%
      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
      File name:Agreement Terms Sample.pdf.exe
      File size:65536
      MD5:76b6c2b227dd2ae92bb3b86a66a8fe52
      SHA1:db06ffb667569ab3b379012567c27919c36d885a
      SHA256:128fa77a11cedbe782819f0d2e2666a04e4f8d2966a72f215c77b8933c914a47
      SHA512:74614ba4f06a95c07257896002b99023714b85da540a923e2dfa59fbcd3262d2bda715ff4a2a0384b9a7cca0c5dbb34298bda4ae5ebaba9eef51bfc5f87a176b
      SSDEEP:768:tdhWOzU3SN+0MX6x7Z4LNeLmKETN3rWCC0Kg:/hWSUCN+1Xc7ONeFIJ3Hp
      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L...S..M.....................0....................@................

      File Icon

      Icon Hash:f030f0c6f030b100

      Static PE Info

      General

      Entrypoint:0x401200
      Entrypoint Section:.text
      Digitally signed:false
      Imagebase:0x400000
      Subsystem:windows gui
      Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      DLL Characteristics:
      Time Stamp:0x4DF4FD53 [Sun Jun 12 17:54:27 2011 UTC]
      TLS Callbacks:
      CLR (.Net) Version:
      OS Version Major:4
      OS Version Minor:0
      File Version Major:4
      File Version Minor:0
      Subsystem Version Major:4
      Subsystem Version Minor:0
      Import Hash:e4e19abc2b8b3cdf6beb846e51c393a2

      Entrypoint Preview

      Instruction
      push 00401E60h
      call 00007FAB30B1BBF5h
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      xor byte ptr [eax], al
      add byte ptr [eax], al
      inc eax
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [edi], cl
      add bl, byte ptr [esi+09C8E7E3h]
      dec edx

      Data Directories

      NameVirtual AddressVirtual Size Is in Section
      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IMPORT0xd2440x28.text
      IMAGE_DIRECTORY_ENTRY_RESOURCE0x100000x8b0.rsrc
      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x2280x20
      IMAGE_DIRECTORY_ENTRY_IAT0x10000xc4.text
      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

      Sections

      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
      .text0x10000xc5e80xd000False0.519193209135data5.8716351227IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      .data0xe0000x11580x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
      .rsrc0x100000x8b00x1000False0.135986328125data1.29485435267IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

      Resources

      NameRVASizeTypeLanguageCountry
      RT_ICON0x103480x568GLS_BINARY_LSB_FIRST
      RT_GROUP_ICON0x103340x14data
      RT_VERSION0x100f00x244dataEnglishUnited States

      Imports

      DLLImport
      MSVBVM60.DLL__vbaCyForInit, _CIcos, _adj_fptan, __vbaFreeVar, __vbaEnd, _adj_fdiv_m64, _adj_fprem1, __vbaStrCat, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaObjSet, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaVarTstLt, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaCyI2, __vbaStrCmp, __vbaCyI4, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaCyForNext, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaI4Str, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

      Version Infos

      DescriptionData
      Translation0x0409 0x04b0
      InternalNameAffolker
      FileVersion2.00
      CompanyNameAxis Corp
      CommentsAxis Corp
      ProductNameProject1
      ProductVersion2.00
      OriginalFilenameAffolker.exe

      Possible Origin

      Language of compilation systemCountry where language is spokenMap
      EnglishUnited States

      Network Behavior

      No network behavior found

      Code Manipulations

      Statistics

      System Behavior

      General

      Start time:21:14:22
      Start date:13/01/2021
      Path:C:\Users\user\Desktop\Agreement Terms Sample.pdf.exe
      Wow64 process (32bit):true
      Commandline:'C:\Users\user\Desktop\Agreement Terms Sample.pdf.exe'
      Imagebase:0x400000
      File size:65536 bytes
      MD5 hash:76B6C2B227DD2AE92BB3B86A66A8FE52
      Has elevated privileges:true
      Has administrator privileges:true
      Programmed in:Visual Basic
      Reputation:low

      Disassembly

      Code Analysis

      Reset < >