Sample details: 67bffa7c7037bcd0ff1355b666dcd4bd --

Hashes
MD5: 67bffa7c7037bcd0ff1355b666dcd4bd
SHA1: 6323b2e7333c298ae665ae6e9dd0d20eca444522
SHA256: 95966d29d229e3643a7670604daa0e3b0ffc4c7488eeca9b1b8268072b5e4b80
SSDEEP: 12288:2PUyUvmrCuqe6TN++w0luizUNcPN23kb8N6HCM+esTCm:2PU1m+uqp++r4YTPA3kb8N682m
Details
File Type: PE32
Yara Hits
YRP/ASProtect_v123_RC1 | YRP/ASProtect_v12x_New_Strain_additional | YRP/Microsoft_Visual_Basic_v50 | YRP/ASProtect_v12x_New_Strain | YRP/ASProtect_v11_BRS | YRP/ASProtect_V2X_Registered_Alexey_Solodovnikov | YRP/ASProtect_133_21_Registered_Alexey_Solodovnikov | YRP/VMProtect_1704_phpbb3 | YRP/ASProtect_v12_additional | YRP/ASProtect_123_RC4_130824_Solodovnikov_Alexey | YRP/ASProtect_133_21_Registered_Alexey_Solodovnikov_additional | YRP/ASProtectSKE21xexeAlexeySolodovnikov | YRP/ASProtect13321RegisteredAlexeySolodovnikov | YRP/ASProtectv12xNewStrain | YRP/ASProtectv123RC1 | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/IsPacked | YRP/domain | YRP/contentis_base64 | YRP/keylogger | YRP/win_registry | YRP/suspicious_packer_section |
Strings
		This program must be run under Win32
.adata
,9{Z}(
cHiEA(
7`>UY H5
a	Vg.y
B!wUe~
(F&sVy
A	R_3o
.xnj.X
27)\U;H
@z@"1Cay
-$}beK{
,% k~U
7qMeEH/M
zqu1"V
EwcseDt
9t[ui&/%C
RHu jI@
Hr5RI-W
uhD8Fi
FEx@>JD
cVtrS-
*JDwFU
<_$Smc
/!h0*<
YUD0t`
b!j%@Z)
JhsAZb
_cc_<s
{f7<]h
|aq1*K
fZ9en+)?
]'alY\&m
Toh{^U
lxP)a#
1jj/F<!|
ct\="U
Uq@l7j
$VWRe?
v~yU^M*i
+"G=D??
Kk&_;?g{
:2aIdcA
luk:aA
{ L\of
f[7YXm
69gxR`oG
'7q}DR
n]zWc.
E9$kP{x
'f?${=
@l~0/'
=?Rh<p
&it88I,
Dt IpL
^U&}6x
))s;30N
4]=hlwk^
7cPP(l(
afuFI|0^B
]AEm<^*
}]\;B8
Qq;G2B
H66?D]
b/#YX1
!1=?|I
NYp^xV
K~\6va
fOCa 3
!3YKto
3;JE7A
MJ7,}g
iF:^'"
X=kUE-n
})O&5t
1Nj$`n2
46u=CZ
M!4F*c,
0(>ebTU_
=Dwl#P
M}kF^NP
1"P@mu3e
%b;px0un
cdhKiB
Wi:^d8
 N"&+ey:&gw
W'N=JJq-k
qA6>@#N
ivtg!j
(WrJ{z)hi
p?7n$*
+LhRT#
UI38{e
tEHVQ%
2F%oVH&
;\Q-\I
2*`08LG
]0I]<a
]@/@	^
[V], @
R;M_t$;&Le
|+e~4\^k3l
UKMke&
-d};V\
I<1|R)
k>4CV&
7sqwj5N
J0dtup
m-P<#4#
 ->AnB
y6#tE=W>
zP.Mdhu2n]Y
lxj0O^
:*Z 6t
'G42.;
v!RdPz
6Ce2>6`
{mB\UFd
&b3gD)
8i')RF
J~]x2c
Giu-j3S*
)[O9D&"
ykO]#`
IfW94h
u_!22e\
=q!scf
qvcjFI
D$aKr-k
3Y[-=M?k
}+aqw)
aM6CTz
u#z	5s
?nE}(?)!
~/dtIlM
%qpnyN9
U'95Si
4R7[{A
@)y6'o
$		Q*Zb
:jH+w^o
u[8>s#w
kj%3fm
9y ^U5
Y5Y}	`
3+qJ8qC'
El.8bAU8!!
Z"_)1K6g
6Mgj?q
;UrX]z]
#/	8^Cn
e5zH<Zd
vJD/CM
Pop7QA-
-nB67	
Phc36^
F>f2MetV
,P_\oc
19o"f(UB
!Mnk83
~.A~wv
!&uUM8
L= USf
lLm(s@
wM0Ky8
4SA8g)
UE"T_j
%-,$We
TV#TI2
Xwjgst
B1a~H;mT
*d170h
Js=@ek 
"z?6Z,5
<uyMD3
FMDlij
^	&mr>C
~C_g|xK
g3*opV\
U}&GH(
6(5`8H
ffn1i|f
PlPfP)
RLE-pVI
%*(Itl
c!O8oD
Wb;NW!RI
N[F/Epi
FA(!(*j
&}6_QJ
	S;JGp):
'Etl[=z
(e<F(qN
4'43>(
o."kLd
!S2)	u
:2T+9|
th=eKd:
M)A\%9
L1h":p
qxT#<N	
n}}1A='?
|E:<.ib1
]O]Dk{W.
Ru+v	_A
b05#J,
p@"0K[
0/,O,D
9fM%U	
aEn'J[
&zfl,9
.YI'tY
Hl!R?mt<_yZ
{H;2jw
V@k7WGF$N
=]EK	c
uo7-{7
8ky0NpnK
N|G/)i
Bk36#X
$_1UyF
|T~/lP
llL NI
So0;jY70c
]qc{_i
amDcHLG5
9;Z^V!-
Wk!CE	)8
[g em	H
OK(i#f.
+zc#MC
+SZ"^N
qQZ9=fF$
<I%HIN{
#s?2>P
hHKV7D5f
35 >U8
~dJO<O
1Lqqv<
_4CL),
,2-;Qq
^Orr"u
	J@B(L
:s=|Zt7
`V-xI(
{`b6;8
[DzxEDO
L-uMg9
bj'T*;
Z1HTj~
frdCO$
j2AMJ1IQO
1;%70+n
,jxamgt
ko{NI_
_;uZ%}
`eG,YT
`]@:qM
au(oeO
xNaWq,JN
w`kFF~9g|
lXrr}a
y4	\^B
`8`z_L
kZhwipg/
YB[M#q
v)"NOc
~%TF^B
Om!FdmH
T})N>t
.,%V'q
J]4K^q
q:_&| |
.75u|Ty
p#O"[Be]
[4+-Y^
/=YM?Lqy
-LRb.C
Y)?\-$
]kik=-
;;"r<8
Hvg"4a
g~J-10
'~0TGo
}7*' H
a$ A..7
(dsXV[;_
%dcBn8
+m<7AGn
@"H]Ye
_MyfH|
s-gk7v
NhYK%Ay
{=_2NU
OiI/!<
hLcl03
P#;MO#
-E31o7
5p91ut4
Vv.O]F
[EJG3F
P:MY9d
IY}'iw>s
Bdl 'S
nh^Fi6~"
wv^|q^
xjq[4>
S')%SQ'
]OZzbJ
,DjG\G]
qqX%lC
Mg~T6x
@"`RBm
P2Df|V
;.J&&A
_Od`'">(
Ex?v2+
!Mj/:\
xx\lEU
|Ijk7@+
HBN!\ZxI
+/&2~Ja
Zpw{-\
O1;Y`c
;}#ge:W
mhAlBC
5nJ+M`
/e0b4H_
C>kT+_
#m>XU2
l-qkHH
Heop~<v
/'NWEU
'F"NEx
:diAI/
 wO149
e|E}&Rl.E
0h0./nQ
($[J{Uk
W_+fg	
UnbY~F-
A">uDXf=0
ip^c~n
j|}SgR
1B_5oee
r~*K*s@
qi0f6V
:):jj/}
;.,0p6
z)ezks0
{_:^Yu
J#X6(Q
;EBM@O
utiU/]
#]OkU![
R3Gbp-
O%O`6D
,MnULK
=+WX:%
n_P?:\n
(Im)L^
13U*]/
uq8989$
#k{l6J#
xPyj}8/
ez*k@h
in5t4M
(asf3i
AcoHp`V
	&.:3q
Uvq&-h
RZ/'b6
,	Cx}7
PrT@51
bx{(o.
1xM"gy
f[Z2eJ
#3CAwq
v>k+k(
B^KkVD
4#p|DP
7$(!B6
22;+R;
p9r%V(
fuS`PET/*
Xj^5FD$
sA<)_=
iU%N~#
"`:#aCK
nVx	J?!
T`^WLn
R"bw`D
fqka60x
zxq.=7
+|mK6*
?>,&[$]
P>A}MsT
yZb:Fp
-MF!5WSO
aE?xl!a
^$:j;g
<)+jw1
Ras{>^
ciBW.t
8<izfw06
SCvp]&
Nkia|r0
Og%i~\
l@t]}$8^Z
aY9<SH
O#h3Q9
=ske\a
3lhZg}*
$)=Q%3!
|noS;g
Gd2\fB
#N._	LDm
mXbC]V
wC;&iiV
D>[jH{!f.A
WH!{ZL^
~,btP(
oEta2`
[4?Q:B
7p^ O+
u#|CfR`
6"wb"R}M
YC(Ug}~Y
2oMV<$$
MbSQ-q
F<E_	>l
-d75+;
9h'k	~
Q*+l$p
b3"|39
FNO{B,_^f
|DfM{5
Mp.A&=p
INhu-O\t
PdBDr	
B%_V4p
S}^"?G
o\D@HH
}W4&'T
[fT7C?
L?mteR4
*IBG0<S
4d5>xoMZ
\!Hh	o
~H= $e
PmD*"MO
[qGBvI
CAh|10
Hu^>D=
F=l2lj
eTv*w_
u27fB}p]
/PCX}n
r`/G0#
4BruUj
F3oN>.H
RcmQ)E
~3w@LM
JwcWe$l
 /Aa\K
f?>/[ 
kVg)9wp)
=)9@uU%
9Z]b*?2Q
\gBKNT
KR63QS
^?u~=*
)Ql	juD
Q|C.m<H
w+kmwU
)#9|v&R
PT9NED
~OMYJH1
wFXl r
JLU5yw
.9:m9o
N0/Jb;U
D)\FsvC*
sQ;*mB
M) %92B
zBz*85
nsIn[P
`YHcA+%S
 9{,y3
<n.	Wc
aAN>}Z
!i\6>Y1
\ Kl5*
&gWM1w
( HF[ 
79Q7_/
T>I6~<
\;/g;!
Hdv1b[
(<:iPE
KS_c- =$
KKg{b3
8F.J~sq
QWS]'P
.lP&0C
6,DMg'c
,(=PiZ
)On{_~
[^IR[Q
=`eM%{I
{R(MFl
faWb_~
	}S?3zb
D<2|v:
bzq>1i	?h
>B\-x,
y8Qmka
lCiDaF
D	I=~K
SF,z|Zq
/u'=~55
>qw/|N
yZ^N5[TH
TuF8N5
yQpW1T
M5n*z$76
VFaoJE0=
dwozHo
x3.4z!mw\J
[2	;L>r
Y)#HjhJs
r5CDjr
-Oj';b
pDbKU~a
,U!n`'<
&bE8:B
f@%3WM2}/
<OPvf#d
EC|XsS1K
B{-kPlA>{y
ll[OJ]p
yB]vMU
4;p#zj
l/h>~P7c
lq+&P^Q+fL
xcD[cD
.-2FAO
L1+R%O
9mI]UW)
04g{/P
JW`}23
o$	9cK
KW];}x5
~A2ryQR
2:ysCt
zK4cR]~
uJ_,c 
9 GX2%
R@H x|
&&Cac|!X
a% Oya8
>N4 "\k
< u#hPp
\-'4k6WCS
xW(R)c
>DT4=l
y-Ryr7
Xe Vh 
UvP}|Ud
!9:-T]Dd
Z	tV]~L
j&XQ1Go&
[~9{65~
A_Dz$RBt
O8#RcS	br<
)xN!_:
N7U;&R%7
DEAfT8
Oin==XeS
UPlbSn
8oH[]O
2lg8+i,<
v(c$M44P
fDYuuz
*ZV9u6
Q6*$b@U
z^}!26
^,{'//'6nW
U,vX!q#
Br83<D
OJ8XI4<
3V^K2f+
;YButL
aB.=vl
C1r\)J
]PV3J	Z
L'=xJO
@]32-]
[,Jy(}O
wS>{2+]
2B>`'^
??>:`U
u=>}}P
qMqHJl&%&t
]LWCmXt
)nN/E2eei94
Uuy{sM
GpLM~L
eWroRab
Y7?%&l
Wr-~.?
>h(1!+
i'{?Ad"Ge
uRT#=c
"gnFS*
"-T0U4
H:Ke <e
+US:Mk
7f"c>:
t2^qxK
}cN#<~(glV
C&[}{(
79nFY;)
6%)`-|`L
 vvHot&
0	_}5)>
L-Y!My
PUh'Cr
m(6|6QV
]`.gU<
ffW>Nh
O)!vzj
(Wuk9Nk
d=Z=-4
$KNmyW*
Jlpws7
<QG'vq
n^_*&K
!{-|/P9
Pg#gi3PD
OM%veltD
,kpMcU
?JL}"^
)S]D6X
[At2+R
PccJ\X
VD]	Gi+
mn^&;<
{/7 MIK
%w{NWU
A!5Kvz
(H\sCLW@
"I`^xR
; 3GfU
"0rA4%
svh>z,
)]\4!fY<
Ajo!>&
2}&OMs
cdkA\;w
w v356(
"(N`&5
?k6QVX
 W!Gf/
kvBvl}
e:ePvx
3#8V[\-
ssM >p
7TC-|W
$<3fr[
BwfvwY\)
D6N\f+
]C^g~B3
JPu.x:
FH?@~O
#l))zmF
%-b9-z
G,b5-2
0+c):(%
]_#%;yv
[ST!b-
<0[y1SS.
>u`"G[
>Rw}GS8
P8X.h@R
p=.@VOh5
>Gp=Jq
G0n;a8
YS{2r[B
(S\-57
AtnEr{
F!Er_p
T5cEv;N
!+d	YlH
! y\{7D 
`~4 Hb
&gZKUd
!0Fgo_
]739Ry{
`3MA!I `
}RKL2N
ERYa?V
zX;	>C
bgzk<=
G<\}=*P"
 Uriw[
'.V)nB%
u+]~n0
Xoy<`L
s3=t22<
?R	%A2F
JJ+m1c
J]n6tq
UTl:JP
F4kpHR
"^_0ek
*+qO7;
ds"Ub??&
m]esr/
7"m99&
RG:hx7q#XQ
@g^?>\b|"
k>t)$o
'l#zJa2\
r=AVA{
?BjqK1
lB2S_f
~bq]Tp
!|:gFlqd-
q@.eDIq<
]dnANz
m5flhA
\dE<m0
_%!#.?
_y]54ny0yw
%sn@Hp_p
K@$u)]
s19<I\i|
#0&UO	
<s}l!M%j
L-R"C,
8{(10_
4D?<:3|
FjnS]\
h6/	Ao
7a{G7!6Op,
@P<g='
c}~n)m
=FI|xk
wvm9P#b
<V/WljR
[#MrA\
[fqum`
Q0&UiZ<
Ad6;(gL
wY~8y0
/Bz^w>
!T={ro
Ii`3K+
D%hfKh
o%Jj#w
qwn1`t
amSE>V
	9}&]o
q';x\~<
g'YUZq
E[~y30
WFFW9r
:?=sS@
_:Ual7
GdJJ"xtc
l1g-j|`#
9_URtqSS
f]n[~O
RiGC#s
EweqB4
4R(0UWg
mE`uLpZ
1YiY[<s8
	d\{#v
?hyw$#F
6L{,^)
c0H@L_3
].tkAy
S`LkXc
*2r8ePM
iTR;I<
3X_\D%
kernel32.dll
GetProcAddress
GetModuleHandleA
LoadLibraryA
user32.dll
advapi32.dll
oleaut32.dll
advapi32.dll
version.dll
gdi32.dll
user32.dll
oleaut32.dll
comctl32.dll
winspool.drv
comdlg32.dll
shfolder.dll
oleaut32.dll
kernel32.dll
GetKeyboardType
RegQueryValueExA
SysFreeString
RegQueryValueExA
VerQueryValueA
UnrealizeObject
CreateWindowExA
SafeArrayPtrOfIndex
ImageList_SetIconSize
OpenPrinterA
PrintDlgA
SHGetFolderPathA
VariantChangeTypeEx
RaiseException
y/!WG&
LKogwP
...-.-..-..-..-..-..-..-..-..-...-..-..-..-..-..-..-..-..-.-
$4CR\_____0
"2?P\___________2
/>N\__\______________0
:NZ_______________________2
$__________________________2
QQPPPPPPPPPPPPPPPP0
$__________________________2
__________________>
$__________________________2
__________________?
$__________________________2
$__________________________2
$__________________________2
$__________________________2
$__________________________2
$__________________________2
__________________?
$_______________K:58_______2
$_______W
2_______2
$________"
	W_______2
$________K
-________2
$_________
S________2
$_________G
&_________2
__________________?
$__________
Q_________2
$$$$$$AW$$$$$$$8__?
$__________C
"__________2
$___________
K__________2
$__________Y	
?__________2
$__________8
__________2
$__________
F_________2
WZYYYY__ZZZYYYZ\__?
$_________A
_________2
-----+FW--+-+-+?__?
$_________
I________2
$________K
"________2
$________)
Q_______2
$________>5/Q___-		)_______2
$_________________ZY_______2
QNQNQQW_QQQQNQNW__?
$__________________________2
444443HW3333444C__?
$__________________________2
$__________________________2
$__________________________2
$__________________________2
$__________________________2
GGGGGGP\HGHGHGGQ__?
$__________________________2
____\_____________?
$__________________________2
KKKKKHLKKKKKKKKKKK-
6FT_______________________2
)8GT_________________2
+9GW___________2
-:KZ_____2
v&&/bbbbbbbo&&&&&&&/o
bbbbbo/
o&&&&/
&/bbbb
bbbbbo/
&&&&&/bbb
rbbo&&&
&&&&&&&&&&&&&&&&bbbbbbbbbbbbbbbb&&&&&&&&&&&&&&&&bbbbbbbbbbbbbbbb&&&&&&&&&&&&&&&&bbbbbbbbbbbbbbbb&&&&&&(
&&&&&&&bbbbh
bbbbbbb&&&
&&&bbb
bbb&&&
&&&bbb
bbb&&&
&&&bbb
bbb&&&
&&&bbb
bbb&&&
&&&bbb
bbb&&&
&&&bbb
bbb&&&
&&&bbb
bbb&&&
&&&bbb
bbb&&&&(
&&&&&&&bbbbbbh
bbbbbbb&&&&&&&&&&&&&&&&bbbbbbbbbbbbbbbb&&&&&&&&&&&&&&&&bbbbbbbbbbbbbbbb&&&&&&&&&&&&&&&&bbbbbbbbbbbbbbbb
!H&1<B
XZ}l|y
&~W?$J
RE\Bor	la<n
UMaskV
uXez$Y
X#1L]'!
Tx^B 4
Por:ti
7W0`yw
", 8@A
jX{O%(l
*"^Yh1
!TDM-B
a=2\lf
kern0l32
LongPa
QH}B^D
0)\~Y{
d-4|s=
prlH9X0d"`#\
`4"0#,
Memory:
EDivB(
DpHtk;9l
BFaHod
c[D#2m)
=K{cXu
).c?'a
QJz};oi
,(t$N@
 !Rec_
L'<TQ$
Nz1=Jt
Y?={W5
m0),Wt
$	jA(5
h	mTg,
'Y$aCl
B'-"}N
E`f6u)
omIniF
jZ^S_0V
ansd@r
p& $i S
q'YQTh
@4vNX@*
#/P!~f
JKLMNOP.Q
yz0123
	u_~QX?m
h0 %2{
7=;%	}
HJ=|n_
C?PY$]
t4!8;UQ
@_*eoL
	xL@^/
vrn=;L
a'tc.|-
o?kb}xW
lo#pyt
.Cache 
Obta1{
 <7ACY
256ToM
Int: L8
?S r}9x<c
sk#C}:
M\"Hd$
VBC`~%
l:-	np
egist\
GCOpot
Hbp\^RaIrX
_K{>}B
Bxy4 v,z
10:Bhm
&'00@K
 s3w%rq)
PActiNv
`I|#uZ
u(IfFN
\Z$M;EX
t*#@q1B~x<
fes8-al
9rhHE%
\ "	'D0	9
(R) 9or
ouwi q\W
ansm;etg
RX1u<Ix
adp*H$
Z_Yz[PX
u7r2yS
|$WN42x
'RDC45
(8P'QR
GgL0"tM
kbq%eip
LO Us>
.With[
	!Sub*
fqrm@`Vg
uEip@)%
ZtCh#6
{s|J?.
 H@ce9fA
~,H0G8:`5
trgpC;	bw
uzgi{pU
'R[Q$&
sN3 {H
\3'sSY
&"P( U
U/&u7{
^ Y\Ps
T'he~@
SI"`J_
qCan-'t
f~HRq%
?RB>@=
${)Tk9
:CK=u)
jlQ]Z@^
VskHM7
(h=V,.
>RHAxL
R}8|^a
K>`+pB
3l]| tL
!)Q5r0
xC0>RQ
%@sFNJ
%2z	f$
-@\Zh	
@A/!>[
 !tGPb
Runtim
~~(&0"
wx(zv 
 dsi.Xkl
"05p`)
00"4NZ
Cri^Gca
]EBoxSH
IsB9"R
L'PGTgb
B'JGRgZ
z/|P~X
(0rBtl
!5r't/vR
#16AX9
x"z*L2
0'4GDgd
' G$g(
T'8<t{
r=tAvExI
zM|Q~U
@<T: :
VLV]3[
rTtX]`a
f:q;{<
wSt[He
J^V	=ro	
jr/tObq?
	@X\Oo
V|i~{]
f2jCg3k
R]@?/C
D|r9t=]
U4^'iD
wI}\?r
~:+;_<c}=
>k?o@s'wa
'0Ah8c(
<69_H-
FK[c0"
4r#t`]B
/?r;^*
*,n/,=
[^YjXbH
e%P`=[B
@8zyjS
s5E<uj
CfM)?ag
?brmuhSQo
I_rO;Z
1F{xb{
"L/A%B.
@.4X'ay
Q;9/M8
%pe'YC
&+2Q.b
a4RIRD
B\V)"S
ed>6oE
ck3oir
AH'bC2
r<"PtZ|.
R7`kAi
:I"@N+
E*H?j4
Ler_.XU
<'b*9U
rD|F&g
}Zo$>,
7L&o-FN%
\R=V$S
3SC<h~oA
O{dP+b
~U	\(,M
4Wo(6-y
OCa&GxSo
GNZb2	4
&i/t7}j
~V2iM^
6.L{9s
iFZXCC
XdF@`q