ID: Sample Name: Antidetect 7_Cracked_by_Blazing_Soul.exe Cookbook: default.jbs Time: 22:04:44 Date: 17/01/2018 Version: 20.0.

Transcription

1 ID: Sample Name: Antidetect 7_Cracked_by_Blazing_Soul.exe Cookbook: default.jbs Time: 22:04:44 Date: 17/01/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview Information Detection Confidence Classification Analysis Advice Signature Overview AV Detection: Networking: Persistence and Installation Behavior: Data Obfuscation: System Summary: HIPS / PFW / Operating System Protection Evasion: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshot Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info File Icon Static PE Info Entrypoint Preview Data Directories Sections Resources Imports Possible Origin Network Behavior Copyright Joe Security LLC 201 Page 2 of 1

3 Code Manipulations Statistics Behavior System Behavior Analysis Process: Antidetect 7_Cracked_by_Blazing_Soul.exe PID: 3120 Parent PID: 252 File Activities Analysis Process: cmd.exe PID: 314 Parent PID: 3120 File Activities File Written Analysis Process: cmd.exe PID: 3156 Parent PID: 3120 Analysis Process: Robocopy.exe PID: 3164 Parent PID: 3156 File Activities Registry Activities Key Created Key Value Created Analysis Process: cmd.exe PID: 314 Parent PID: 3120 Analysis Process: Robocopy.exe PID: 3192 Parent PID: 314 File Activities Analysis Process: ADCracked.exe PID: 320 Parent PID: 3120 Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of 1

4 Analysis Report Overview Information Joe Sandbox Version: Analysis ID: Start time: 22:04:44 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 7m 41s light Antidetect 7_Cracked_by_Blazing_Soul.exe default.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 10 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: HCA Information: EGA Information: MAL HCA enabled EGA enabled HDC enabled mal76.winexe@13/4@0/0 HDC Information: Successful, ratio: 100% (good quality ratio 100%) Quality average: 67.5% Quality standard deviation: 32.5% Cookbook Comments: Warnings: Failed Failed Found application associated with file extension:.exe Show All Exclude process from analysis (whitelisted): WmiApSrv.exe, conhost.exe, dllhost.exe Execution Graph export aborted for target Antidetect 7_Cracked_by_Blazing_Soul.exe, PID 3120 because there are no executed function Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 201 Page 4 of 1

5 Strategy Score Range Further Analysis Required? Threshold Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior Signature Overview Copyright Joe Security LLC 201 Page 5 of 1

6 AV Detection Networking Persistence and Installation Behavior Data Obfuscation System Summary HIPS / PFW / Operating System Protection Evasion Malware Analysis System Evasion Hooking and other Techniques for Hiding and Protection Language, Device and Operating System Detection Click to jump to signature section AV Detection: Antivirus detection for dropped file Antivirus detection for submitted file Networking: Urls found in memory or binary data Persistence and Installation Behavior: Drops PE files May use bcdedit to modify the Windows boot settings Data Obfuscation: Binary may include packed or encrypted code Entry point lies outside standard sections PE file contains sections with non-standard names System Summary: Submission file is bigger than most known malware samples PE file has a big raw section PE file contains a debug data directory Binary contains paths to debug symbols Binary contains device paths (device paths are often used for kernel mode <-> user mode communication) Classification label Creates temporary files Parts of this applications are using Borland Delphi (Probably coded in Delphi) Reads software policies Sample is known by Antivirus (Virustotal or Metascan) Spawns processes PE file has section (not.text) which is very likely to contain packed code (zlib compression ratio < 0.011) Enables security privileges PE file contains executable resources (Code or Archives) Sample file is different than original file name gathered from version info Tries to load missing DLLs Creates files with lurking names (e.g. Crack.exe) PE file contains more sections than normal Copyright Joe Security LLC 201 Page 6 of 1

7 PE file has nameless sections HIPS / PFW / Operating System Protection Evasion: May try to detect the Windows Explorer process (often used for injection) Allocates memory in foreign processes Writes to foreign memory regions Malware Analysis System Evasion: May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory) Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Language, Device and Operating System Detection: Contains functionality to query local / system time Queries the volume information (name, serial number etc) of a device Behavior Graph Behavior Graph ID: Sample: Antidetect 7_Cracked_by_Blazing_Soul.exe Startdate: 17/01/201 Architecture: WINDOWS Score: 76 Legend: Process Signature Created File DNS/IP Info Is Dropped Hide Legend Antivirus detection for submitted file PE file contains more sections than normal PE file has nameless sections started Is Windows Process Number of created Registry Values Number of created Files Antidetect 7_Cracked_by_Blazing_Soul.exe 1 Visual Basic Delphi Java dropped.net C# or VB.NET C:\Users\HERBBL~1\AppData\...\ADCracked.exe, PE32 C, C++ or other language started started started Is malicious started Creates files with lurking names (e.g. Crack.exe) Writes to foreign memory regions Allocates memory in foreign processes ADCracked.exe cmd.exe cmd.exe cmd.exe Antivirus detection for dropped file started started Robocopy.exe Robocopy.exe 3 Copyright Joe Security LLC 201 Page 7 of 1

8 Simulations Behavior and APIs No simulations Antivirus Detection Initial Sample Source Detection Cloud Link Antidetect 7_Cracked_by_Blazing_Soul.exe 7% virustotal Browse Antidetect 7_Cracked_by_Blazing_Soul.exe 2% metadefender Browse Dropped Files Source Detection Cloud Link C:\Users\HERBBL~1\AppData\Local\Temp\ADCracked.exe 6% virustotal Browse C:\Users\HERBBL~1\AppData\Local\Temp\ADCracked.exe 0% metadefender Browse Domains No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Copyright Joe Security LLC 201 Page of 1

9 Domains No context ASN No context Dropped Files No context Screenshot Startup Copyright Joe Security LLC 201 Page 9 of 1

10 System is w7 Antidetect 7_Cracked_by_Blazing_Soul.exe (PID: 3120 cmdline: 'C:\Users\user\Desktop\Antidetect 7_Cracked_by_Blazing_Soul.exe' MD5: 99BE619ACBEFC AACBD32B40C) cmd.exe (PID: 314 cmdline: C:\Windows\system32\cmd.exe /c copy overrider.xpi C:\Users\HERBBL~1\AppData\Local\Temp\ > nul 2>nul MD5: cleanup AD7B9C1403B52BC532FBA594342B9) cmd.exe (PID: 3156 cmdline: C:\Windows\system32\cmd.exe /c robocopy configs/ C:\Users\HERBBL~1\AppData\Local\Temp\\configs /S > nul 2>nul MD5: AD7B9C1403B52BC532FBA594342B9) Robocopy.exe (PID: 3164 cmdline: robocopy configs/ C:\Users\HERBBL~1\AppData\Local\Temp\\configs /S MD5: 39B9273CA01364E115B464416CFB729B) cmd.exe (PID: 314 cmdline: C:\Windows\system32\cmd.exe /c robocopy fla/ C:\Users\HERBBL~1\AppData\Local\Temp\\fla /S > nul 2>nul MD5: AD7B9C1403B52BC532FBA594342B9) Robocopy.exe (PID: 3192 cmdline: robocopy fla/ C:\Users\HERBBL~1\AppData\Local\Temp\\fla /S MD5: 39B9273CA01364E115B464416CFB729B) ADCracked.exe (PID: 320 cmdline: C:\Users\HERBBL~1\AppData\Local\Temp\ADCracked.exe MD5: 31B994F059D2DEDA617A6774CFAB32) Created / dropped Files C:\Users\HERBBL~1\AppData\Local\Temp\ADCracked.exe File Type: Size (bytes): Entropy (bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Antivirus: Reputation: PE32 executable (GUI) Intel 036, for MS Windows 31B994F059D2DEDA617A6774CFAB32 134D0BAF3D9BDC220C9AAC9E7F5C94BEB91C45 BC3D97D1C4A12EFD24BEF EF601C226CF2C9BC1024DFDD74E2FAF2A1 74BF45F6E6CD3DA6490FB73DE3ABC5CD5AF0CDF4FD6D3B24E423FEAAF50BC707F9EDB36737C7ADA2C BD00CA12D050A2DF79D4042C71476D74 true low Antivirus: virustotal, Detection: 6%, Browse Antivirus: metadefender, Detection: 0%, Browse \Device\Null File Type: Size (bytes): 703 Entropy (bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: ASCII text, with CRLF, CR line terminators 621B590964DADFD AAFFA9A 5AF20713FD0DC015CC3A394F5B6CED569E1C6 CBF0F02E239ED1A2A1D9CE0E122BF16B9ACCEE1E07E5B995B0475E523D9 BE9E550642BD9534DEC3D1E2CAE1F477D1FC60A747DCDB9C FD9D947407B1F37C96E1FF1F225CA59C 0C A9AF959DFE05AEE42AD2CC7DA7 low Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info File type: Entropy (bit): PE32 executable (console) Intel 036, for MS Wind ows Copyright Joe Security LLC 201 Page 10 of 1

11 TrID: Win32 Executable (generic) a ( /4) 99.94% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Java Script embedded in Visual Basic Script (1500/0) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00% File name: File size: MD5: SHA1: SHA256: SHA512: File Content Preview: Antidetect 7_Cracked_by_Blazing_Soul.exe 99be619acbefc aacbd32b40c 23b5ed679032b42241a751ac51d49df3a5fb00 47d492d44ff9fb66ad7d05b6b697b6ea c920a 95c379d6623f95ff6 e0ced0c29dbfbff63fafa377bb06a3439d229a79ee164fc 9ca274a0f4f373dfff23e49d d0bc650f004fbc5a 9a1ee06fdeee2765b9cbbb33ae39 MZ...@...!..L.!Th is program cannot be run in DOS mode...$... y.. y.. y... y.."z.. y.."}.. y.."x.. y..".. y.3... y.. x.. y.y"p.. y. "... y..... y.y"{.. y.rich. y...pe..l.. File Icon Static PE Info Entrypoint: 0xe036f1 Entrypoint Section: Digitally signed: Imagebase: 0xe00000 Subsystem: windows cui Image File Characteristics: 32BIT_MACHINE, EXECUTABLE_IMAGE DLL Characteristics: TERMINAL_SERVER_AWARE, DYNAMIC_BASE Time Stamp: 0x57FCF12 [Tue Oct 11 14:04: UTC] TLS Callbacks: CLR (.Net) Version: OS Version Major: 6 OS Version Minor: 0 File Version Major: 6 File Version Minor: 0 Subsystem Version Major: 6 Subsystem Version Minor: 0 Import Hash: fb22793fe26a bcf9f274 Entrypoint Preview Instruction call 00007F1F0CF7D1DDh jmp 00007F1F0CF7CA7Ch jmp dword ptr [00E051D4h] push ebp mov ebp, esp push h call dword ptr [00E0502h] push dword ptr [ebp+0h] call dword ptr [00E05054h] push C h call dword ptr [00E0502Ch] push eax call dword ptr [00E05030h] pop ebp ret push ebp Copyright Joe Security LLC 201 Page 11 of 1

12 Instruction mov ebp, esp sub esp, h push h call 00007F1F0CF7D3BEh test eax, eax je 00007F1F0CF7CBF7h push h pop ecx int 29h mov dword ptr [00E07340h], eax mov dword ptr [00E0733Ch], ecx mov dword ptr [00E0733h], edx mov dword ptr [00E07334h], ebx mov dword ptr [00E07330h], esi mov dword ptr [00E0732Ch], edi mov word ptr [00E0735h], ss mov word ptr [00E0734Ch], cs mov word ptr [00E0732h], ds mov word ptr [00E07324h], es mov word ptr [00E07320h], fs mov word ptr [00E0731Ch], gs pushfd pop dword ptr [00E07350h] mov eax, dword ptr [ebp+00h] mov dword ptr [00E07344h], eax mov eax, dword ptr [ebp+04h] mov dword ptr [00E0734h], eax lea eax, dword ptr [ebp+0h] mov dword ptr [00E07354h], eax mov eax, dword ptr [ebp h] Data Directories Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_EXPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IMPORT 0xa xdc.idata IMAGE_DIRECTORY_ENTRY_RESOURCE 0x5d7000 0x5a92c.rsrc IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x0 0x0 IMAGE_DIRECTORY_ENTRY_SECURITY 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BASERELOC 0x x0 IMAGE_DIRECTORY_ENTRY_DEBUG 0x5470 0x70 IMAGE_DIRECTORY_ENTRY_COPYRIGHT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_TLS 0x0 0x0 IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IAT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_RESERVED 0x0 0x0 Sections Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics 0x1000 0x4000 0x3200 False data IMAGE_SCN_MEM_EXECUTE, 0x5000 0x2000 0x1000 False DOS executable (COM) IMAGE_SCN_MEM_EXECUTE, Copyright Joe Security LLC 201 Page 12 of 1

13 Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics 0x7000 0x1000 0x400 False data IMAGE_SCN_MEM_EXECUTE, 0x000 0x1000 0x200 False data IMAGE_SCN_MEM_EXECUTE, 0x9000 0x5cd000 0x571e00 unknown unknown unknown unknown IMAGE_SCN_MEM_EXECUTE, 0x5d6000 0x1000 0x0 False 0 empty 0.0 IMAGE_SCN_MEM_EXECUTE,.rsrc 0x5d7000 0x5b000 0x5aa00 False data IMAGE_SCN_MEM_EXECUTE, 0x x x unknown unknown unknown unknown IMAGE_SCN_MEM_EXECUTE,.data 0x xb3000 0xb2200 False data 0.0 IMAGE_SCN_MEM_EXECUTE,.idata 0xa xe2000 0xdda00 False data IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, Resources Name RVA Size Type Language Country RT_ICON 0xa9f400 0x2c12 data French France RT_ICON 0xa x2c12 data French France RT_ICON 0xa x2c12 data French France RT_ICON 0xacb600 0x2c12 data French France RT_ICON 0xaf700 0x2c12 data French France RT_ICON 0x5ef72 0x2c12 data French France RT_RCDATA 0x9220 0x571c00 PE32 executable (GUI) Intel 036, for MS Windows French France RT_GROUP_ICON 0x x5a MS Windows icon resource - 6 icons, 16x16, 256- colors French France RT_MANIFEST 0x6317ac 0x17d XML 1.0 document text English United States Imports DLL kernel32.dll Import SizeofResource, WriteProcessMemory, FindResourceA, OpenProcess, Sleep, GetTempPathA, LockResource, LoadResource, VirtualAllocEx, CreateProcessA, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetModuleHandleW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, UnhandledExceptionFilter Copyright Joe Security LLC 201 Page 13 of 1

14 DLL msvcp140.dll user32.dll vcruntime140.dll ucrtbase.dll ucrtbase.dll ucrtbase.dll ucrtbase.dll ucrtbase.dll ucrtbase.dll GetWindowThreadProcessId, FindWindowA memset, _CxxThrowException, CxxFrameHandler, _except_handler4_common, std_exception_copy, memmove, std_exception_destroy, memcpy, std_terminate _lock_file, _unlock_file _set_new_mode, _callnewh, malloc, free _configthreadlocale setusermatherr _crt_atexit, _cexit, _seh_filter_exe, _set_app_type, _invalid_parameter_noinfo_noreturn, _get_initial_narrow_environment, _initterm, _register_onexit_function, exit, _Exit, p argv, p argc, _errno, _c_exit, _register_thread_local_exe_atexit_callback, _initialize_onexit_table, system, _initialize_narrow_environment, terminate, _controlfp_s, _initterm_e, _invalid_parameter_noinfo, _configure_narrow_argv p commode, fgetpos, setvbuf, fwrite, _get_stream_buffer_pointers, _fseeki64, fsetpos, stdio_common_vfprintf, ungetc, fgetc, _set_fmode, fclose, fflush, fputc, acrt_iob_func Possible Origin Language of compilation system Country where language is spoken Map French France English United States Network Behavior No network behavior found Code Manipulations Statistics Behavior Copyright Joe Security LLC 201 Page 14 of 1

15 Antidetect 7_Cracked_by_Blazing_ cmd.exe cmd.exe Robocopy.exe cmd.exe Robocopy.exe ADCracked.exe Click to jump to process System Behavior Analysis Process: Antidetect 7_Cracked_by_Blazing_Soul.exe PID: 3120 Parent PID: 252 Start time: 22:05:14 Start date: 17/01/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: Reputation: C:\Users\user\Desktop\Antidetect 7_Cracked_by_Blazing_Soul.exe 'C:\Users\user\Desktop\Antidetect 7_Cracked_by_Blazing_Soul.exe' 0x774a bytes 99BE619ACBEFC AACBD32B40C C, C++ or other language low File Activities File Path Access Attributes Options Completion Count Source Address Symbol File Path Offset Length Value Ascii Completion Count Source Address Symbol Analysis Process: cmd.exe PID: 314 Parent PID: 3120 Start time: 22:05:15 Start date: 17/01/201 Path: Wow64 process (32bit): C:\Windows\System32\cmd.exe Commandline: C:\Windows\system32\cmd.exe /c copy overrider.xpi C:\Users\HERBBL~1\AppData\Local\Temp\ > nul 2>nul Imagebase: File size: MD5 hash: Programmed in: Reputation: 0x75a bytes AD7B9C1403B52BC532FBA594342B9 C, C++ or other language high File Activities Copyright Joe Security LLC 201 Page 15 of 1

16 File Written Source File Path Offset Length Value Ascii Completion Count Address \Device\Null unknown d e 6e 6f e c e 0d 0a The system cannot find the file specified... Symbol success or wait 1 4A1445B4 WriteFile Analysis Process: cmd.exe PID: 3156 Parent PID: 3120 Start time: 22:05:16 Start date: 17/01/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: Reputation: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c robocopy configs/ C:\Users\HERBBL~1\AppData\Local \Temp\\configs /S > nul 2>nul 0x75a bytes AD7B9C1403B52BC532FBA594342B9 C, C++ or other language high Analysis Process: Robocopy.exe PID: 3164 Parent PID: 3156 Start time: 22:05:16 Start date: 17/01/201 Path: C:\Windows\System32\Robocopy.exe Wow64 process (32bit): Commandline: robocopy configs/ C:\Users\HERBBL~1\AppData\Local\Temp\\configs /S Imagebase: 0x6b File size: 916 bytes MD5 hash: 39B9273CA01364E115B464416CFB729B Programmed in: C, C++ or other language Reputation: low File Activities File Path Offset Length Value Ascii Completion Count Source Address Symbol Registry Activities Key Created Key Path Completion Count Source Address Symbol HKEY_USERS\Software\Microsoft\ResKit success or wait 1 B60A5C RegCreateKeyExW HKEY_USERS\Software\Microsoft\ResKit\Robocopy success or wait 1 B60A5C RegCreateKeyExW Key Value Created Key Path Name Type Data Completion Count Source Address Symbol Copyright Joe Security LLC 201 Page 16 of 1

17 Key Path Name Type Data Completion Count Source Address Symbol HKEY_USERS\Software\Microsoft\ResKit\Robocopy WaitTime dword success or wait 1 B60B0C RegSetValueExW HKEY_USERS\Software\Microsoft\ResKit\Robocopy RetryMax dword success or wait 1 B60B0C RegSetValueExW HKEY_USERS\Software\Microsoft\ResKit\Robocopy JobDir unicode :: success or wait 1 B60BD1 RegSetValueExW Analysis Process: cmd.exe PID: 314 Parent PID: 3120 Start time: 22:05:19 Start date: 17/01/201 Path: Wow64 process (32bit): C:\Windows\System32\cmd.exe Commandline: C:\Windows\system32\cmd.exe /c robocopy fla/ C:\Users\HERBBL~1\AppData\Local\Temp\\fla /S > nul 2>nul Imagebase: File size: MD5 hash: Programmed in: Reputation: 0x75a bytes AD7B9C1403B52BC532FBA594342B9 C, C++ or other language high Analysis Process: Robocopy.exe PID: 3192 Parent PID: 314 Start time: 22:05:19 Start date: 17/01/201 Path: C:\Windows\System32\Robocopy.exe Wow64 process (32bit): Commandline: robocopy fla/ C:\Users\HERBBL~1\AppData\Local\Temp\\fla /S Imagebase: 0x6b2d0000 File size: 916 bytes MD5 hash: 39B9273CA01364E115B464416CFB729B Programmed in: C, C++ or other language Reputation: low File Activities File Path Offset Length Value Ascii Completion Count Source Address Symbol Analysis Process: ADCracked.exe PID: 320 Parent PID: 3120 Start time: 22:05:21 Start date: 17/01/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: Antivirus matches: Reputation: C:\Users\HERBBL~1\AppData\Local\Temp\ADCracked.exe C:\Users\HERBBL~1\AppData\Local\Temp\ADCracked.exe 0x75a bytes 31B994F059D2DEDA617A6774CFAB32 Borland Delphi low Detection: 6%, virustotal, Browse Detection: 0%, metadefender, Browse Copyright Joe Security LLC 201 Page 17 of 1

18 Disassembly Code Analysis Copyright Joe Security LLC 201 Page 1 of 1