Warning! We are currently in recovery mode. The complete archive is not available.

Sample details: 48f67ca08e0d1c09d0c09540ead9c15b --

Hashes
MD5: 48f67ca08e0d1c09d0c09540ead9c15b
SHA1: b4d5225e4f71c7e48e18783442ac92efa2497b80
SHA256: 409ca99360466803589eb967aaf9ebfff155378c1fc6191655e5a40b4c4b3e17
SSDEEP: 6144:UxBpbYA1HvVjyLoZDL50A21GGHEcDGARIUjPnlR7d4tjzPS/tn:UXp8A1PVjyLoZ41G2DGARjlNe/4n
Details
File Type: PE32
Yara Hits
YRP/UPX_v0896_v102_v105_v122_Delphi_stub_additional | YRP/UPX_v0896_v102_v105_v122_Delphi_stub_Laszlo_Markus | YRP/PackerUPX_CompresorGratuito_wwwupxsourceforgenet | YRP/UPX_wwwupxsourceforgenet_additional | YRP/MSLRH_V031_emadicius | YRP/yodas_Protector_v1033_dllocx_Ashkbiz_Danehkar_h | YRP/UPX_v0896_v102_v105_v122_Delphi_stub | YRP/UPX_wwwupxsourceforgenet | YRP/Borland | YRP/UPXv20MarkusLaszloReiser | YRP/UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser | YRP/UPXProtectorv10x2 | YRP/UPX20030XMarkusOberhumerLaszloMolnarJohnReiser | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/IsPacked | YRP/IsBeyondImageSize | YRP/domain | YRP/contentis_base64 | YRP/UPX | YRP/suspicious_packer_section |
Sub Files
cbee8882f64a0da607e0bcb29f9ffb62
Source
http://www.uwaoma.info/bestking.exe
Strings
		This program must be run under Win32
Boolean
Integer
ByWl'Word
TObject
rfaceK
f	TDa0I
_qTimh
2w;;thsz
LF+=Nx
Mz`S(W
Xu3C<,
HJ%NHJ+
tZXtU0u
0"	w%9
~KxI[)
SOFTWARE\
Borland\Delphi\RTL
FPUMaskValu
t7IDr,v)0
ZTUWVS
y\{pUd%
^Q5`Sg
-Rf;` 
;@"W8A
pr#jiM
<\vX}(4
#4{;-8C8
0<+I=$PB>
{Lu+?#1N
kernel32.dllwGetLongPatB
hNameA'o
C^oftware
cales27
?  t.<
^PjBQt/8
odSelgoWZ
Disabl
sDefaultPHotLigh
ive>NoAcc
omboBoxEdit
Windows
TOwnND0wStN~
4S0,NNNN($ 
|''''xtpl''''hd`\''''XTPL''''HD@<''''840,''''($ 
''''|xtp''''lhd`''''\XTP
rrtplh''''d`\X''''TPLH''''D@<8''''40,(''''$ 
 MSWHEEL
%_ROLL
ORT_(_.SCK_LINES
s|/Cr@
	Exception8
EOutOfMemory
EDivByZe
~Ranget
fv0idOp
0y>;{ 
ExssV$`
$TMFiR
 lus6WB
c4i[HI$U
+0	Vv0<
W/\:~I
rEAIt.
}~<:uQ	
V0r=<9w9i
INFNAN
()@-3$-	*-&F&
	$&-[-o
'w~$Prx
(E\$RY
4]fM1p
>5zgu4
:UL#7h
+4bDX!3
YSU<Ht
8[#8D7H
~e8~AR
*	G-?}
kFreeSp_
2;Qr*VE
{;w$tW%
AddSub
/od_nOr
=Xor_Cmp4FromSt*H
CuNHG;
Loh!$0
Ft?Htb
 ,"fg[
Z*B+	~
`/7A#j
N%oQoD
3MV_&h
Fjn7]r
<O0?Vm
)9yeLlB
Q`2MPd
FLQAQV
8|9QrL8
`B`{l7
6a 7`P
a~bCYx
gb/v~om
DE}kW_
Currenc
UnknowDeci
o)vl4XIP
9K^pU%
1pomk` 
-|	"2t
lignmenj
LeftJa
YN	TBiDi
Middle
Cut`o(i
IYsAdap
DT'A"K
TBjicA
$]lIdfM
$leEQfj
,'	eoI
R(v 16TS|
-vki)Hi
Z;rqdPa
MW2[-^6
]2,i$GI
	KMGJ:#
tOhc<y
eh?dP(
%s[%d]x
Wvw#I/
UKuM2F/
aPabr	
/h< ZR
-7*,(-
RFR_swTvR
kAml|C
TPropFixup~d
7,4yCV.
g%s_%d
 8B9t"
QxYD@RW
7cok.'(
UQ?"q4y
{5l}&C
s~:;4l
p2@7azq
mLlljI
X}tP( T
8b!E(	
;S2-z8
;w0c;s
'Z; -P
@i$;vt
"_fP$B
NNNNpqrsNNNNtuvwNNNNxyz{NNNN|}~
NNNN`abcNNNNdefgNNNNhijkNNNNlmnoNNNNPQRSNNNNTUVWNNNNXYZ[NNNN\]^_NNNN@ABCNNNNDEFGNNNNHIJKNNNNLMNONNNN0123NNNN4567NNNN89:;
.oross&%
edImag
^(jYP w
uE;@ 1;
`0:[8C
;&(#L7
36gSil
_nG	FuchsiaA
_ppWXk
?foBh'
a4N.?Sc
NSI_CHARSET
wDEFAULT
SYMBOLc+
GJO Ba
?GB2312
:EBIG5
TURK*k
EASTROPE
!OOEMj
H?u4XS
El<_a8
rGu8] pi
g>97'jB0
?H~&v{S
"J<0e*
TbHsDN
l)>A:x
ob6PQ$
t$+tui
7LiBTAE
(s^0usB
\g2FLc
ar*cSx
N'u6JL
Pgf$v	 
>hocu6
mhlSYl
 \HgIf7@
%(4!Gl 
OInitC&mon
OVJFA!
,iuvz(
<5	)ae8`
ISPLAY
6W+u$oEGI51
:	CwNXC
)3Viewe
NJBUNp
<7?GOWT
.9S7;}
+K3Y)<e
XUCg4H
/i;U#fKW
(|<pC*
d(d@V*d
nSB'U+
_how+3
V6$7LJ
Mlxtheme
Close!
K#e'`1
k?Part
wIcqIs
lyTznsp
yO4Nnk
~m#	U,W
WOK9)`
,\@xS8B,
On`!Og
_Igno2
omdlg_h
:d,;yF
ES$BVisiJ
3ZxL@FC]<
TSButt&a
`UZSGNl
@6nPxF
-EdNZ}
4	hs+s
`Re+K 
?$<	tb
X6xX.|
hS"=&u
\C?Adv,d
pqCtVC$WC
\CDL%S
ayOfWeek
[Fri+Sa
!lA Qm
;P uSiJ@
%|Y'	|XO
*TO;3>
LHf>R[
d !'!,!'
N<0B#`K
gDg}t_50
.JAHA4
_.},wh
VWuP=uJ
{HK#-"
zGqKH2
(NFNFx*
0Mx @0I
Yb]#xCu
P7]DJa!
 @Z8B88
LTuZL<
28Yh-L
0br[24-
pZO#.@
?>'Kh@
0.UC$C
@!*	Vf
>KNOb@
5PZoBb
zCUD`v
3ug4ph
Q%gac4i
2,1u>V
%u'@{V
pC52a$t
	0#[PH&
-27<ss[E4
0RI iN
tM]@GR
 $WF?F
&HLPTc
 2001,
2 Mik2	
>H+@_jl
 !"#$%X
y1BSdu
2!d"eT
#f$g0B*
:(>]ox
 XGStd
%W(}%W
73CH_24
Leavey0"
LengthE$
d23eH<
@v d(@
ovH"K;
EGYdSp
CFZ`a@)
.<EL+M
~X`?Ou
r*=~w#
T \n3D
$\M/3e
	DVCT.T
j_ks=P!<^7
l?Al{dVh
PwZ:Pi6
BUTTON
7IE(AL("%s",4),"l
wJumpID
0p7!k[
LAyG:$
_WINHELP
#32770
&.Cren
><l|G7%'
#'dPf\f|fE
|8Ex6<>x>
d)rp*V
SAXhaD
Ty QeE
9FS`mz
.tW`xW
F).,.<.36
8\x&vb
WE'UpN
'HSpN'
:w@g%3
4M  $$((
2|c$O	#
=|v6C-E
nRX$0Q 
5IS%&l
.m?mY(T
Moll8	o
~0b+kp
GHZqWLP
`xB" V
J taITE
buZt	/
XLu7;Wx
	WGl3M
 W$;~|\
u..<i4
\@v;{Du
j o]KK0(
s`=Qz;<$
x%M\7x
0`yOUA
+%|!WU%|
:_Wt+z
I"F+t 
rZZ	$GRiF``=y
Q.%woZ
S8TZ26)
>a7!Ow
p8F!lR
+!LYFf8
'4RPH 
 = Jt0
\_WpX14&
&bWj:M]F
Sq`QI@
$1:@@&1
4M@H@H
+*q)DS'
HTrV{?
3$Gt=5*
U8'K06o
T!<@y*%B%8
PDt1!FW
)dbtRm
G($jIa
/].T&|2
},;=XK
1g+ t%
C<xDf)
@<P#N`
gV!;8@
|Q0bbB
(ud~-RaTQ
F3pklR
1mYU/&
_ABh[4#
@&h'B8\
gwx8TD+Bt	
P9]D"`
jAo9GT
"@k @G
5APm`:
#Hsl+\
9;wlt4
e=ebNm
CKYk.Uca
hEFH%@
-FLBT5
gic'Hq
9*&091
xU!:"Y
]P^ppA
:FHV,e0
/$tqc4
fvYuIB
>om\*;3+Hs
P"m$#P2
us/SiagC*#W
mp	ioj
T+1`LP#
3I7h l\
/7wAnZ[Z
Susp>a
8<@DHL]d
^C0g&\
;P8u+~,
g*;~8A
Pq		87
bpZ.@#
V;3~[8u
.DuFHP
RxM\XZ
(qs8VV8A
94_M2t
Pq(A&b
Rebuil'b
TL U[G
B 8keysK<
Z8K$*du
d(@_	"
npxuN:
#p0F(A
B u;*|
7	spDp
123456789
GHIJKLMNO@
0EHsLD
aH.C;B1
}.d@0>
pTh3@`
?<p`G;
k]X)SW
@;,$>%:-
\ShH>j
O i0u	
`Xw}n7e
gS!B){
WtBRvx
P?:S?r	
5i>\N`*n
N:hdQv
LqOSwa
O1)`?ei
u"IP]ntI
o4FDsBn
@c7BgA
Ih;J4u
|t|h? 
o`A}k"
iM{ZHs<;(
p8>l`7h
8\8-XI
^pSAP>F
Laq#Ae
M3	mbM
 F4O+\5w~
w!O`X/PI
PixTsPf
	yqd0r
x"IN'%(
Mo]N{Ph
(&?<^G
(cFP&J
PE]Dg#
4q,:2rX%\
?~$ijKT
@H@"Ca
&CH3DLL
5d@+)su
tMZ/f?`l@
U4BJ1D
dBfgKw
B1Y>,Zw
^lHz; 
`Z;`IT
9mKimg7
7MI}0F
uu'aZ!
}%!$5H
9t5OGe
;"Ic 8&
WV(/	I
D*EXq1
t;Cpu'
vK[kLU
R;\H%Y
g#;ADtiM
O/9fRi8
X<KkFP
KY9wv$cA3
R@j!gF
rrrrPL04
$\R*ZP 
"]B+)'
6INICCB
lExxt`xC
)tZ!~Q
W7!gu|
<oamdh
35GH?.
h/yDq;
e(Gvclt
]#4a$I
F{HHq8
P@n0`%G
@7m `Q
g;^`u0
{/t6Y'
I$pe6jv
/.p`jY
d4hTLYx
"dChOHos
TTLExpi
L0o.ah7=
WS2StubmD
0;WP"n
r!&'r!
r!./r!
r!67r!
r!>?r!
r!FGr!
r!NOr!
r!VWr!
r!^_r!
r!fgr!
6>WSAC
__"FD&
ZTEzFw
sA'Wi_4V,
$7A'F@1
T/AEJ&W
?LOCALHOS
XH$y#[
K>RnU$0x1
9t/huC
OcNovDec
`Global$
T|<R'"
M9N/&X?Y
NP@JuG
iKn+0>,`i
|D8H\:
GT$[n-
mi$,{"(
Yu{Op4Y
0.i|L%w
QW8L,`
x6	sF;
sa?$Usa
)w=B;-|<
Gt xxX||
i%T\,Z
=PlH.I
&9 G -
$.Cr@4
@iX(<*
5~6G,m
81TCPi
h/J%X*
|MheX!N)
";j ci
C%p%'_*
A<iv$!
5<,<<,
5t*/:>
\L	TKH>
0'q8]e
r@&y1JD8J
;@Xr@lK)
9-tU4Pi
i, [%+
wl#J%$
I6Ig[X'
F%0+PZ7m
x&u<^,z
RW:h^hO
h|1IZdhhnn
 to me!  <CRLF.	>'
,rj'Q_
x!t{wn^NE
/)Y! /
$ Jdy91
@.(s.s on
THINFO
DATEHEAD$
GROUPc@
IHAVE_LAe
~.fmt7
E RpERO
POSQUIZBN0
_XHDRXO\Rx
:QusRt]FB
goodbye!
. E<with
2.j0B,adc
AXL0R9q
Qot:G4
l7xQu\
Cr@&\@
fBPj({y
}r(>OpM
97Jg91
	L5jRn-
d990!4&]]
W~71BQ6
|$|k%x
731&8U
B"(JZx
{_~xJaZ
hGOf9[I
#**s|1
;6??`ah
F(Y_]C
hXcUT'8
AuiWhwb
zO8S8tWtY8l2hsvb
lc<dp4
at 0>0
4<DLT\y
<O 0@P`l8
<P`hpx
.4by/ 
Gp!mmo@
|$>60>p
{o/?N_n'a+
QT7gd3$w
'1MQR'o
 3xME'
'4""C[
:L*y8Z?
yvJ"Q[Q
HDF&rP
c'?/&x
L3'L'L'91
Q!wq/N&
Km*{7M
;el5-/
Kh(/~B
BplkKJ(Qq>
	c4/v.&b
B]nL.a9n.
7u~1kXp
cBxpkX^{-.4
3nu9CK
9"54xz
6`MJ_85
:Jps@ah.KN^
)MC_#?
13~0mwo
DJ's/K
`v~`yA
Q+~?o"
:>9C`r,n
r/bCoQ
bbT{ v
R.?(laa
n2cz\T>
,:nfo D
hT8hdt4
D~.C"LBO
r{zsbp
1}|aV(
5KgOV%
@61+=iC
e4kYzl
T)?"Qw
t4Kr*X
  B$IFw
x[BJyK
?L=d`v
YLD{xd.
BKkL&	Q
dUz#1j
{NxmgA
~[X)@nn.6
0>F]:	
KY @[	N`
	-2T4o~+
J^e35I
!,"6no
P@H >tJ
NmpDF>b
?_xmAh
\r^^IT
5MZ91_zS
>`%zD<
o^Wv@_
5o^g,1
U@n c|
F9@^?=
n-D`s~	
TLfIJi
6@<<}.
IF)l4Z
~e18L ~
^A|l'vD:
~xm.dC&{
T "o.A
mdQ@Z6?
v) ah/0
jau9oR
\X.w>)
4O+&PA
~Pyndf
oFzo4B/
$Kr)#:
"&^x{7s
uj}^&~
lX!tl%:
x-o*>Xh_
l6t(QZ
,Bjo'B
x>~@Cw
W6k}b6
^>67?i4
d4P;~K
KT3>^.
4b{zT]#
PYu7_4{{
a.x9.C
|`. 6B
6^R2!.%
Z)!j6+
E4H]%e
<)4 95
h m2ZK
x/ll.?
(THuaUC
=_61?-
VGzP;EK
#!r_	Ga
N< QU%
l|E09.
`%85xn
jWk:Ud
r_kC$fTp
aFs. h
&lFnnum
;fBiFu
'Wfh"tX
[[|[xJNr3
Sp7Via
n:11oE
G]bB=/c
6uUpKioSEkOf
?gM;ugqqm
CK`(F[
;nnl	;G
d>LK>Y
7s+&/KkO
QWt K)KEJ
/v7iXT
{c/Vb(
]7'fs&
d)Z]zk
Sk.:(VG
jo"{%G
_OKu#Ub;
*g&^oy
IDlgR3
FSleep
Librar]
w!empP 
~u4AA#
,vB`!,o
0"wROP2
d'L7L"T
#L~ZbO
)%~*@D
pUpdA(|
Q78xmN
<ToH9	
.AX.RD
8@5mgH
]Gx}$-
XPTPSW
KERNEL32.DLL
advapi32.dll
comctl32.dll
gdi32.dll
oleaut32.dll
user32.dll
version.dll
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
RegCloseKey
ImageList_Add
SaveDC
VariantCopy
VerQueryValueA