Sample details: 5b9e02836418a78c591cc395fe524890 --

Hashes
MD5: 5b9e02836418a78c591cc395fe524890
SHA1: 2c5483ac5447ebda5c990d4d4d27d98ce32b8f77
SHA256: 2e429e3b4d385902980aa13fd5acb9d717d2fb2724192a3a6529e619fec2119d
SSDEEP: 12288:0MUr+vxf98i+WHyu4dm9425NASjZCNVFD0IrMzzPJV1byTV66SC3ApWc49SzSN55:Rhxwu4M9nZCNVZ7GJV4xwk9Vx
Details
File Type: PE32
Yara Hits
YRP/UPX_v0896_v102_v105_v122_Delphi_stub_additional | YRP/UPX_v0896_v102_v105_v122_Delphi_stub_Laszlo_Markus | YRP/PackerUPX_CompresorGratuito_wwwupxsourceforgenet | YRP/UPX_wwwupxsourceforgenet_additional | YRP/MSLRH_V031_emadicius | YRP/yodas_Protector_v1033_dllocx_Ashkbiz_Danehkar_h | YRP/UPX_v0896_v102_v105_v122_Delphi_stub | YRP/UPX_wwwupxsourceforgenet | YRP/Borland | YRP/UPXv20MarkusLaszloReiser | YRP/UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser | YRP/UPXProtectorv10x2 | YRP/UPX20030XMarkusOberhumerLaszloMolnarJohnReiser | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/IsPacked | YRP/IsBeyondImageSize | YRP/domain | YRP/contentis_base64 | YRP/android_meterpreter | YRP/UPX | YRP/suspicious_packer_section |
Sub Files
b7090d75ec0115c909d2a4eb291b60cb
Source
http://www.sledinskaya.by/cli/8888akwu.exe
Strings
		This program must be run under Win32
Boolean
Integer
ByWl'Word
TObject
rface+
HD@<9999840,g
2w;;thsz
->Vb1*
M`S(4W
MJ%NHJ
+t_$xtZ
wsXtU0u
0"	w%9
~KxI[)
TWARE\Borland\Delphi\RTL
FPUMaskO
GZ)%tP,
"^gCf?
xZTUWVS
_-Rf;` 
K"W8A#
P.8T|z
kernel32.dll_GetLongPathN
ameA'o
o6oftware
cales27
gd@q{Q
?  t.<
`#XG2#
`GF|o!
Y=GKhK]
Y\;6PF
n#\Cg8c
}Q+lw_
odSel^ed
&Disabl
FocusDefaultP
HotLigh
ive>NoAcc3{
k[rBd1
omboBoxEdih
Windows
TOwnND?
/0wStaJ
,(''''$ 
|NNNNxtplNNNNhd`\NNNNXTPLNNNNHD@<NNNN840,NNNN($ 
NNNN|xtpNNNNlhd`NNNN\XTPNNNNLHD@
?VZwW<
Magelx MSWHEEL
%_ROLL
ORT_(_A
.SCK_LINES/
jx-Cr@
	ExcepXon
utOfMemory.
EDivByZe
v0t &K$>W
K$>/r;]`
TThreadO
 lus~W!
$jH5$"`
]d-NAV
 P'yp@.
n$ ^fM
@Wl1,tQ
1tK1x.Z
0r=<9w9i
nw)@-3$-	*-&F&s
	$&-[-o
.t?9$(
'Y"|Sg
8,fk<d
DgF.t"
e`]	3BN
]X5X`a
AM/PMv
C>; LN
\NSU<HtH
UW.'?3t7
'V\$rv
Q	82K_
{/_"r33 
 d, G&
	$kFreeSp
;w$t|Q
/od_nOr
_Cmp4FromSt*
HK	+%TLo2A
WzImpl
Ft?Htb
	R,W^VPK
aNR'4o
Currenc
?Unknow
$t)>Nw
hWBPCU
wpwz$?@S
TAlignment
0VLeftJ
N	TBiDi|
Middle
)(D\>O
sAdapp
6,?L"4|74
_V7Pl0X
tK$?R%
gGroup
[n`oe)
ki)Hi]
8G pt1u8
aO9	\`
PT|z@R
l' Yz=
Gpx@[}C
DB% [7
,Fo]eK
0Fr~Ym#.6-
TPropFixupd`
RWaSb7
WMtkEX2$
xqp~+S:
GX ocWLX
<q@4%<
04B=iPl
_UY:@#
A G;T\
)0B,EOb
t`;M|0q
r{'qk4Y
g%s_%di#
m'>N%x]
&YD@R$Y
.HjmT"
uO}401@M
B9f@6k
9999pqrs9999tuvw9999xyz{9999|}~
9999`abc9999defg9999hijk9999lmno9999PQRS9999TUVW9999XYZ[9999\]^_9999@ABC9999DEFG9999HIJK9999LMNO9999012399994567999989:;
wvBruy>
H|iz#X
wAoross&%
SV	`tX
E;@ 1[
LimegY
	FuchsiaAqua
CaR{`N__ppWXk
?foBh'
G3DDk6
ANSI_CHARSET
wDEFAULT
SYMBOLc
HIFTJIS
!GJO Ba
GB2312
EASTROPE
PBR`@q
0Pga4S5-
l/8dfkt
SI8Fl@ #
pB/C[=Y
@ *+i0
	@iBAf
t$+tuiO
>}+.@O
icobmp
PyEpY+
Fnyoi!
JA+ehi
RAc G.
O[[<C0n
!@Wl<4
G%0>&C
=Ew?Jo
dk$"`y*
!>n+:-
!"448i
12M^q*
PFncM>!x
?["X{[
aa'jtkN
E=2DM&2
pA(K`8
\$4{d<P
7 _(*7
$9999 
 0itor
U2DLL/
3Viewe
i6@0zf@
=l89rr>
F$[US2
h: tLK
]m~\IB(/90
1L\Ovo
 GFFF$(,0j
uxtheme
iClose
9t'R[)$u
Hies?{
NIcqIs
lyTzns&V0
bX2 Cr
\\D=)#
^TPd@.
0!ba`B
Fh$ `=>
X!Fd7b],!
mdlg_h
ipsYCircj
0Hr!!vh[
LTPW  
h_"p`(
N{!C04jP
Bu JX@
g(xgi8
HX{	I\
212\%W
@dCiT#
/!'h7i
]H9{<(
3hCV/l
yg/E@c
*mL$=a
Buttfm
O@*G^!uQ
p0;^9u
99"==$
 "(@D:
p4>}e"
	HaS'u
\<MvvU
rl@UTP
%uSaa:p
'ODbmb
 2001,
2 Mik2
 !"#$%
$2@N\j
"#	`!C$
dz !	4
B^7dCo
/Leaved
9PD.<<
	MaxLeng
BBx>,n
,G#\SP
'L\Sc]
2{&Pp'
P-ic;3
>%l;do
<!,&@E
?HEDI~@
+<VS8G1
S7NsoZwE
AHP5X!
` }4`[
mDZ:Pi+Px
Lcf60x
BUTTON
J}Og1i
H" ^CM
o&T{DnR
QQBr@&
uNRq$b
37IE(AL("%s",4),"
)" JK1
JumpID
AvOvt[B'
u?/+:%`
>_WINHE
F.Cren
`G0><<*
Wheeli
XJ,M: G
ttbv	]
uIk=EC
At.t!v
HOWSEWE
qg `4A
$H~DEp
# ;{D 
GHZqWL
RUuI7$
P]otW|
9Wv9nC
	WGlI[
BaO6[0
NJ'$;~|u
wv;{Du
7y,AT,L
`oR(C>c
*ZCF[K
K~NNO7
-hhCSI/
r7=*@b/@w0
,9(ctf,
Q"a*Ybz
V_Wp,V
x}KY_V
 /<>IN
tz@ul5Ho
@@&@H@',
HP;l7Dlt@V
5=YDBR$-
V#FO0>
l~0-!1
PDt1!FW
2gd"&$/
p22HtY
},;=(kK
 t%ARg
MHo*g&'
C<xDfAS
]!b;wd
@<P#N`
I$_PXR
U]uJuH0
{,FYx"u
H)OgeJ
SfP$>~
x8TD+B
1!l'I(
ELr$DJ
"NFt+v
8d%LIS
bq}DnR9
*F*A e
w}`@%6
qTsA?P
%Y$THV
Vj|Yxq
\P?om-
hEFH%@
h	$;C5x
Ygekk"
"S%%1P"
QROLVc
K@YUD8
$	+!8(
pg|Awc
HF&PP2
YP{h(|l
u'%@NLS
ReLd'm
$<us/S-li(
GYc/3A
Jr=AnZ
;P8u+~?Ea
I/i_F4
X+V 1qu#
2QEjqx<
A;,S3tPz0
c`+a5C\
"74p*o
2BHLBV@
}$",/j
J0Hk@Pp
S,4N03
TAdxncP
keysK<<
"ea.TH
$0y^>D
Tu7 G 
ii4(TX8
123456789
0ABCHGHIJKLMNO
 P`STUVWXYZBJ
aB1xH.C
8RrSv&^`4
L]{$J_/
pL6U`1
y5CumA X
A0b=^8
fDwWtB
/HxxZ|
!lAyt'
9tg9[CP
>4kA*>D@
ZCp`nb
LqOCL0u
#UbIWY#O	
2TXS@%
9.-h(	
u"IP]H0
[W<t5"
57jRB.
5L*f'e
#	%=(BLoP0J
I(Mv<J
3JnKj	
!$':nK!
Ih;J4u
54qdcw
aFt@v 
@`!H8r
	Hegul6
-`(H@%\a
BThumb
!>Lg1A#
H=E<>E
guGLGtp
3fs&tZA
X'$t	'
d0(5!/rdO3K.y
q>@4#yStk
v+~|PG*
A`M7UH
T-` 3]
7Kz&t6)t,
F_)"$;
N$y	*|
fN/H<9
mB.P-	;
*!|4z`
9X$a<8
5)@R'wx
B^s|y1
QWh>,Zw
C{J,M	
^axWRj
D@i[F('
&Zzzwa'(<
t;Cpu'}
uzSkLU
AU#Qx%
ngY'WCL
J`E8'	kQ`;
1^1\Qx
' %@x0JHO
B*Gttn]
<%3nqH5
P9999L04|-"C:X
wd+RCP
F[p;sD
W<zj -
'<tp.l4>
MAINIC
[t4/xDMB
DW`t^!
)tZ!~Q
@|{H#7
]tHq8!
%G=NPy"
T |>a[
"{I	U(HZL
go16x1
4x42x8
mbs1.6
&*I~eO
 3D5B2
 U(BYej|
BR/d&k
luhz.fBv
tnN*ujSz}
U'zarX;
m5r[$r
.,ZvT%v
	|kstW
]-4F~?
#t}:\e
h}\	J:
,	LhNP
*`ZDM%
|`j}vy
rApYvt
U!}5Nh\B
Ak{]cn
j/r|7p
Bjma	s}
_B=ha8k
Oa	5Z"q
<9vT^@2d
~|k=}7P
&w$\5.C
`{iw*%XD
k"hFA5
NyrhJ`
3pm!B<%
B}3H?V
Virtua
s	L;iY
snjvpBAw
FY1ypQmU&DO3
JBI5aRbI
>O|@\Q
at 0>0
<,4<DL
`-TPF0Y
(0@XPH
i,8LXp
p!mmo@
f{aV`1 
'1MQR'
'4""C[
:L*y8Z?y
vJ"Q[Q&
>+KO]'
[fQ?'H
HDF&rF
c'?/&x?
3'L3'L'L
1BoC o[KQw
2C`"(8
o~/!u)
]qVn5>
pIfRsA
eBM$QU
mcJ[x#
P~F$K=
$/y"'x[j
oux(f@]
._+w)p
^Q	^Nuq
yLwXzZ
A~!as&
(/~_*U
Z:|.'"
ZLox<Rs>sp
'	bd]Lu
5H4~0I
_(@Vdw
;"lwoc
RpBKfk7[
6y/Vr1
!I\E5K
#m3Nk2
Wt$<;j3
Z?3>tR
="0};/
sWW@;^
|iZMLy~
Ok8|};
tULQkM6w[
m2y\-<
Kjf5~@
&	l!lf
F|]BXU
/BtW}t'`
hFbk)X
.0hG>L
t z@S'
p,/t,4c
kdivXa
iCMTL%t
[BwS^l
/n8]sZ
jxamJZ`
9!eW]y
WtosW$
^zaZl)9
Eta&fbb
+_}qxN
T2*9@l
r)^RrX
FCq"%x
5k5?K1
7r-y`(
lmeVmD
	X2<//
d476,82
l`FKc2
s~lf@0X
VlKd[fy
oVNCxh
YmFd^r
^[2Ma)
w{J53Y$
X}Z09IVAb
,$sJ1Z
NQTeNf
#;W><x
:89}2DK
}V.W	n
/g(x4l+V
MYHOCt
'h]H2u]
NRe}g_
nr\t2R
?a8N3$
gz>C|8
Dnp]YP
pg"n6r'
]*d8:9
	%K3d:
r^#)\l
ZyT6yG
||nL~.
|yGY8:q
:fsG2"OP
. ({;M
lN4AiZo
vh>?P<$
;HJjY4@
IU(K$H2
qTYv02"
tteSE(
TR1<(]5
{}1XfRx
I!>W{Ns
G 6&./
(CN"Of
st\-q|
q0nks,
wfjxi56
M^b|+v
l/o,&1
5`&hi$x`_
eP2<',
RtYqu=
#O|Q&:
xz`:z3
Tp71"4
)!Z{+u
[N%R0*
)vuSxG
J~	?u,
^3`R~l$
R5/yK{j27J
/^E@t-
OwA.%T4
x2Uiz`
M*IA;F
Bqu7s0g
4t6Z}]4
1U<#b4
|RPRyh
EH0GfF
s1Mq/?
?Bw],O
sCq8ol
fn'|se
ja<3>r,B
ZKG1|%
[wkK/b
?_I{ybXUy
`]$RXt
zUKwoU
5ET7Tpr`
 *8.VH
Am*bgS
J,`	+y
;"0e6i
I<;E*}^
"wZLW_M
H?A~7`E
o7A+.f
&Fe@3BI`
&e5Qm'
:.Q=UI
#/~;jDW
(9\Xa6
Osqukn
aSH]GS
\I4:XW
>eFedQq]\
4[vmL"
PARhTF
	Ed,Dd=
"Jm,@T
l%0mHNdi
/W#B_(
@|gV*Bf
w1sf!<d)pmc
eh"Tst
r<5H=?Z
eR1_.X3<
2qm`j2
wa4@rf
88  gsl
 MH343
9)5,J8
)W54l{
ASz%X:
/*f4Q`
RHet.T
6\l|e8OW
buV|GXJ
+4:YLG
qlwBBA
:HH%up
X6!0Pu
wc61B]5
"illfk
4g${6D
5uWN?+
'5>!.e
kfH8O) 
<MSdvBW
rH>'yg
F<fD}P
?aCbE8
12>4:+I
u?$QmEt
m]/X1J-
L\'U*u
pZ)o	@
"mVu,C\
G\85-A
[5~+	B
O4w(2d
R"*ypD
u$-uEdZ
yE	t"Y
XwA\ R
]%|}2TU
SQNW4i
>Gp1l6
~&MVhD
]gZ:#_dU=I	
yY`Jx]
+2 R 2K
j&U82_-
R=uaa>
L4h5^%
u~xLK_
4z="u-
uZ{fOq_
W2'1nX
NF~+z\)
|(<(~sD
|qaJIP
<a*dNrH
-#R5	j
2SF=4N
N9D{!9!
?>$CE7VX@f
iF;@Z!
;j]DBx
V@u&/A}
Wt"r`4o
,V^D61
a)JaXQ
(o vvr
_D*`#z
+[Iun,
@(s%5*,
E+|5:v
"ftnZy
=9Nvdu
sfSGMy
i3m-K?u
jsy16?
|75yRV
=z>2Mf
[dIa4]
sqG~ug
M(mhHmc
#1PjG4
TaySQR
._Ro9L
NHKI!(
tzq6fR
"IK*O6
|h=AiV
1.TdcWz7Ep![A
m3F}2.R
[V{0/mvk
h^Jm`I
 yG_0'
%k|x*"
o}VJRY
P8CTvK<
 |QLa	
W;s}Tu
VIGe`d"`
\-Lx:P
St@=%=|tn
M=2!2u
`Yk9vj
,;H;Lg
f9Sw//
V}Bd:o
VTk+z'	^
?$!PWs
aP-//A
xb\[C/
e,8fUs
@6,h}+@
N3ob<R
[:Y;k!8o
Nw1]_wv=
yxl)O@Q
;qC6 ?
TbMQz*
Ij]3qa
)/p}+4F
zlXJFB
sLTIu{
*e}_*):
VZ~;]~7|
p<^8w)a
ag[F%9WR@
FJ0Xb9
X*.U-t
ji4+M,
'*\<Xt
"	e"O,>Y
mpw%0"
A5:|JA
@WqDI{
>([lFAw
h)2[@MjgU.
YFf+V>
k<Ccx@
9uo@~C
_mU3il
']-M4x
OQ/A[H
Eb/)ds
)y)	q{
i6vol<F
EmtJP(
Dd98gJ$Ik
L)D}r\
=Val(o
wb\4a]X
#ox(EwgME1
d`FAfF
$()u c
`&uOkn
GMA?LC
zs\8;g
1$9?5L
2	W4J#
]{z\jj
#OJ N?
N0u^Q0rZ
zwvka,
17ZL6s
G<3{na
bF(\d5
B|7]$p
yU|S2T@
]2W)UL
.Wi;N	
z_c6Ku;+
O}sa/&
M`0|gB
|5"Sb'
j!T!j2:g
R5|XW~
_@Eqh0
KU	h4Y
0&O4IaB
]H|zu\Q
Z`(c6/
ddEnR#
5k_yvq
xe#Rep
2NF_"m
 ?.4'5
B6`ji-J
r]v"Y*
C	Np07
`\c5yy
Nf1n4]
HREuz_
zQMzC^
rKG}s>
ZRkhD*h
aQW#FU
}=PWw5
:DU9Jc
<b:^^(
5yJj T
	'jrU:
EiL}_h
pETs~E
:g!Y{I
+M*gfmB
-"mjbm8h
GWk{6l
W[s:(r
01j{HW
#a#>T:x
F4:zN4
8!sH Z
aPuoe}m
qB60KL
Z	t'FW
ozMs[%
s-/lbPB
QO~*NQ
\% K"i
^jIE	`
;t2w?O
9!>ZZr
W$7K`cF
6IVO;?
AV@''_
/]:CFy
BThw`	
CcL/&E< 
NOC-	_
xqa`I2`
+T7{ksw
:(X!1mTZ
.P;=-WE
k6o;U%D*
xiF.+,
2n;}RB
.>	bcq]~L
[CF!i<
#kq-o`
p-0;Q|
>9$+zN
phg+v@
9#1wQzC<
_F~kz:(]\,
s3?=b	
g)Lg[b$
O]G.Y0
Z{?i%{
V2>%Xr
^Rp(Y'0
11Kgv"
ta`Uwk@VS
Y%q`h.
A(xJwB1
rgPp3@(
	t/k?fguF\Nf
:AnNcm
?cb	2V
J0c}-G
j3%Nc	
^~^o18
V|ziIl
z4\9`u
:nL4~j
+SCG6yH
t6nZ|E
B9qq;vBa
hb.6&~
"VR,P*
6(n"xI
yC0y:o
R6{/&1
9l|+i3
99^Xt'
*WmeuX" 
b +X"r8
'-_UJ)
:!@cN~(
=bD\oG
<PA[kB
bwM&KJ
HdJ,57
].2eTs
M\l7j\
=@"..*
Xg>.l~Zv
T,6GM$
P	O(TsA
hnCNGo
xd=/+6-
RO~^3c
j4nhh2
Tw6o`,
D8^+u|s
R7l,Rk&
KGM>{0
4OuQQ,9S\_
*1t^v\
Hi?*~Q
5IBQoz
?"^~h%%
yA~lN:
-1MG1?p
31j$a/
H81L<$
>,njJvKJ@\
=E-(u^
sh.*`8
(B`.N+
_@YV}_3
*l~uFP~
</xl*7
H,	l{{k
[*0W{O
wNV8$u
Y9I@4%
OS9l^7V
SY` /-Q
"c(x6r
rG[M_4
.(h:DzZ
<lHB+S
\!N^U<
M	P/6-
oN3JD#U
r7;WEl
6JA1>k
_S/&t5
[2s5?.
I_`Z"X
rNNfTv
]_`HkS
JQg<&0
]7Um	C
\#e-Zo
BReY>K
I]UqTk
:h<=HU
y%xK@uE
6Pay|nua
4.:2  
a"5fg_
(uYbl!
;44f3U8
+pp6qZ
e;YBl%a
:f[x_mb
 hdb*	w
kf}z`%j
\MhNp=
'x@	82
&w<`]Q
goPc;(L
U)ye(z
Dw0fRM[
aF	-c}(
qoAIV&T5
(ZA}0[
(6tq"9
.n0HK~
HBXN0d
7VFt_t/~
B^)LM/#`
~bQ/h]
R	`Tm3=
7qPF5x
A#K>qcS
3o@647sX
w6[/{qR
3m	;,^
KRZ}xO{
;lzi8j
Fw3??G
3Tu,\I=]n
]9qA Ss
		.H$Q
:Y :tp
&P}ue8
buEM^^
R%jqhc&
5^T-?T
	OPQle
2/4_w Q!G
t8gbyE
+6?-L,
'WeL9O
#5dp7=.
bU}u&0
R"}"	B-
^<Q8Thg
9tE%C:
bW;Ak"
=zdxXs
xDK>3I
RX=@0qR&
2s>#K1
%Peumx
yvcN"s
Rqzi8\
rvoKwI
/r&s%s
Dw<*0V0a
!Kd~Ya
>*xFI&3%
!}%"]/
1Ep4lgo.
PD]	aA
5	O"^5
Jf3fM;
L)\p|d
\n2Jl%7
?z7Md3&
%jX];a
o{%V-q
)JEos;
u(`A`x
3L~8te^
'lAz(W
yjY Z5
t=\FnI
]+dB]F
}-&MAz
"#7z[!w
NIZg^9
bGp:QgX)
pN[h=y
[]fnI-Wl
mnA?J8
.aBETUQ
3$M:iKP
	$#GkDF
%q}~P]
5oTQn3
o8RVH\
l>;bF*
\9OYcv$N
0rT\Ec
F~YnYN
;|1d_hz
 '+e=H
r5{b51
VO<|-L
52v0&U
zS*VN 
O]v2RNqq
;a"xTf
VRi~<T
	+3Y3"
b<u	mN
xkXCra
g[>#xo
1CRg^z+
AVz(cH
{ANn(t
yy2G4M
8xu@,x
[)c;Cn
E"+X	D
r	<C%H
{G4G2@
%rYDR'
8h)t"#
,{6!\75m
a]h/^5
2F32%J
~e7YCF
mcmh,:
Caw)N"NNNn
m(*9@PA
.r9:nM
IJkt:v
a3\tG/W
F8><x>YSl
qdObiVgu
b7aCh*r
-2DzG5
W/v7i"
'{w+g,
OsK*l+
_NF1Rr
K Gfs3
aJsg{4E
z>Rcc_
K+`5\]
"RTL-{
*SlllAPI*&
qZ75sp
7dFx7nP8XbJijbX0dVC
ZfVqtj
1HqQDDkiw
Librar
5G`aw+
k'cZ)P
;X_0uU
^|,{sXxiU(@
-p.1Rt
u;H^e!
QtP*'{
p/Uook
1:<Ton
tQuC!*
,yGlW 
Fe+5Q#;
V;|-%mx
G#{`HF^
 `DATS@
XPTPSW
Gggfv@
&vvggd
wwgbvt
1wwwr"gf@
1wwwr"vv@
wr""gf@
wr""&f@
ww"w""@
wr'""@
KERNEL32.DLL
advapi32.dll
comctl32.dll
comdlg32.dll
gdi32.dll
oleaut32.dll
user32.dll
version.dll
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
RegCloseKey
ImageList_Add
FindTextA
SaveDC
VariantCopy
VerQueryValueA