Sample details: 84a44f6cd793ac944eb64dfa2beef098 --

Hashes
MD5: 84a44f6cd793ac944eb64dfa2beef098
SHA1: ea2e48fa30d45d4dd07e6de778c5ee97fa554ca7
SHA256: aadf35a06b39044bb107a473230639d22e01d4974e59f52e20f1f9742d8801f8
SSDEEP: 12288:up3iHotQ6t1GG3iDNFL/LKH2hmFt1EBO+esTCmq:uBiItQsG1FLjKHht1of2mq
Details
File Type: PE32
Yara Hits
YRP/ASProtect_v123_RC1 | YRP/ASProtect_v12x_New_Strain_additional | YRP/Microsoft_Visual_Basic_v50 | YRP/ASProtect_v12x_New_Strain | YRP/ASProtect_v11_BRS | YRP/ASProtect_V2X_Registered_Alexey_Solodovnikov | YRP/ASProtect_133_21_Registered_Alexey_Solodovnikov | YRP/VMProtect_1704_phpbb3 | YRP/ASProtect_v12_additional | YRP/ASProtect_123_RC4_130824_Solodovnikov_Alexey | YRP/ASProtect_133_21_Registered_Alexey_Solodovnikov_additional | YRP/ASProtectSKE21xexeAlexeySolodovnikov | YRP/ASProtect13321RegisteredAlexeySolodovnikov | YRP/ASProtectv12xNewStrain | YRP/ASProtectv123RC1 | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/IsPacked | YRP/IsBeyondImageSize | YRP/domain | YRP/IP | YRP/contentis_base64 | YRP/keylogger | YRP/win_registry | YRP/suspicious_packer_section |
Source
http://www.asaigoldenrice.com/daq/exe/6.exe
http://www.asaigoldenrice.com/daq/exe/6.exe
Strings
		This program must be run under Win32
.adata
!wC@-`
1@X'TI
2a8g#4
,Rric(
88yng["
(u'7H<A]
8q|F]!G!
8{B5|ql
ybLzNAv
]we-Ud
H.dcv{
\H)o@n2`v
4Z;g#v
RK|+8q
Qono1'
p*zKYf
iu0Oh~
	J-<XF
bVA?`HA32
,=xu/E
$h7C)Y
d0HWKg~
b7\;Rh
:Xpn&}
b?W@2*
`By4\A
tY\&{~
U[)r?""
	c_dGG]w
f6I+G$
)B="6 -
Ld+G,=
H4^*ql)X
M]EHIPC
5cnbInR^
	%ICX!
|nrz~p
bL!YgT
cdkINB
sXO59%a
rD?A94}'
r%Z/eD
@wQ_=h
,1:J	6
YSckl~
b_Xv:$
J)t[JeW
_R6}B9R\
1hbl9`f
1k7~""
v:XFq%C
Sd+T0|)
ZJl.Rx@b
*I'HG6i
	D1o0>
%j@h4[*
6HQ&Hnr2_6
W8S_Pv
s skr;
Vs$cAP
m7[-2w
^-E;lp
+C@Z(a
-mn[CD
[1K$G]
1&!Y89
/=_E1Ir
lUj4$K
^X7F{\ H
Rj=ort]
:K)	D:
"TJ~-*
)Fw<	,
w	~pCA
Z3Kv `
*%H4Dz
Pl(FB;_
3BS!~e
U"#J}u
FYZipE
((4XI&
LB<V9zx
g!::O)^
8Epa5gy5
CYq*gI
?OfCHc
FYd>{%\
4#=m14Pp:
Z#f|A/q
/{	ri~
XyR[,#
9]pH|go
4F	|(q
it^>w61
A'JMe@
-i7b;7Y&
<|t\_M
`}nBPk
~ha^h9
$aj	P:
~J&Nl7
h'MqcL
KLt11K{
#%#x	y&
.1BAAl`
E(@&N_
HS\Pm2
o9(Q|}
t:R]HNV
yMi9)Y
Nt={zC
kw[ wyA	
Q./6`.
YgT!iQ+v
S!m<di
AZ]cZu
L5A)sZr
;"V[,/&
7Q.N^}
r1gi-]T
,-BP9j
!rJ"}D
3o jK,
p&&SPh?
R)Dv5I
u/k`X>
ef>l^LTn
7zv:07
ehZJ1Jb
c.-Xck
?a\6QC
]!><{mTe
g6y*ef8
j3.GCe
DOiV/`
Y{2 ba
=d 3>0/
"7nG`~
kI2~Khq
Y?|Eim
BMV%rmS$Z
FQdHRt|
:{!xfnG
.Z{zlf
ON!Omn
Wb4W,x
 8z~R0+
C8rNl:
(\dWpD
=D<>!+
pD|	ix
6K~:1B
LED8vM
ew.C!3
j:4}?p
v,k@Ft
{Q?G_L
Kg+; 3
PB}d 6
Ks*vj6(Si/
F#&P X
1d!C!;
P*{dh}
!U3.^,
O2$IFx
NRrBBQ
	`:d32
hkHg4/
|LPbRj
=@(MWx
+XzigXxv
^L IXz
y#GXPp
H*x#=q7
zeB$!v(
w8Ar:}V
X/3qZO
%#gm9Uj	
H9,hE4E
a]6Y<^
9hOV:y
%hJ08Pxl
;<>R",P
</@"t$Mx8`
cB.i/v
D.@?x'3}*
s;CscP
Q6L:@:;
~(igsr
]i;[Fy
lAS^ra
D},s&mW5
9O 6*K
b9+de\
q_odfZ
/hZ8$a
[aZ\W`
.z}|tif
ZkQj<;
=*I	{+
I%aw~M
)2R	&/k4kc
ip>u~H
L7=6EL
2V,C, 
Dq9U?ev69w
((se(3
WM_r\<
	.7{R*
4cZa#	
&leK<eu&8L'
x^"J$'
vu%;KE
X=k6l?9:
<Ouc:8
T?Rp33
c~z>52
nQZsL|
^8 4{p
|R5%[t
>h#Rd/
HL]J9!
!qd6Ut
fv,D}N
A_3P6v	Bip
+&#H1I
	fGJtxG
)6Y>a?
vv(O2W9B
"gK	:2(
Q!qv^ 
4D/hz2
)\HBoe
"8	|3X
SL!wNzdq
;oUV]l
`u:B?.
]KK8\J^%
f6Hq m
%q5z.f
EfZVX|
dSbzB3
x%uzwP
viL{6TW
0b)Z+9
c6O}.U
(zqF94&
"S[.5[}
"eX.Cl7z
"oUtyr
mPXSP#
Wk,*'L,
Z)UYi_
z^X&28
e0}HeC
E>7(]*
b(CV05m
?GbLf5
H* bPdq
v=~1wgx
e>G	"\
>sjPy\Y
eP@N/v
[Se7sj
&YNmeO
jZm/R	%0
#.DkHD8 
PM!(eO
gn|EfN
1n`'kQp
E@BSxE
*rEW$'
5+'-x|U
x6Ml+o
:h}:a9-
$GhE)e
x_r"X\
f$[Q^9&t`
<&{7{b
ME,meo
8BQHm]G
K,/<1m
cD?-OA
Q7?~jbz
r=0,["
]$x[oP
},HYzS
COJmh(
10Wfd@i
%d8*gB`Lf#
f2JaDm
n+6}jE
o>\m]c
F9$g6(+
*Q1FmWE
^q8ro;<>
.!/roP$
T3*{.A
 m6^NE
SD:#4O
\qW.`?
IEw,waz~
fu2eVm
o,Y~Cx3
6& s'?
O$`Ab5
IP?h!0*
=?C#<j
	\!@'4
T`s4z\S
N&rw*|8
jL{	8V
{ !:m-
\sI@oqK
%r;02Y
qJBD@P
>>l]xLQ
n#13jK
j`OFyb
`r }DAR
l!>h.I
-Hr)g2
cq1T#o/
)5Jgp(
ZDuf`9]
~^Q#UC
V*z,I,d
I:z6GCT
"PqGm!
/5#r\:
jK#h4g
vTQ  /H
L4mc)/
w#Q^mV
K4rt4ba
}]Ph0&K
*AdObb
TGH$aP"
x|9q]!h
-`fe~}
<*QdZ}
O+IfGPw7%
e^\V1A'?/
Yf^7A^
*7JRY~1
.IDKG3
K{d2%)
>r%a2\
x<z(H+
-a\[Go]
As)F	_
Pn&aK*4
vXYfp]
{Cif8tS
KRaF*}
T\DPs_U
4|cg3%
K&YOy+>x
^`FF0>Y"
@X+UR>
=`h;\V
1lZJZV
TOQjKY
|Zd90Y
Y+?"6P
MFFx O
FrE/{M
	*hR{[e
yAf#{I@
K8e@,,
q?w"{-
L}__#E
U-jMh%
T,=b)]
(^}e|]n
c|PvJ`s
#iUda	
-wV2Sz
X+W<Gy
b p)Bkt
5vk81(
X?31R5o
IzQ-uxU
fwdw;A
F({kGM
`jS^j$
?EZLwB 
85]sti
!~T?JI
GXvPiT?
Z&_uI@ 
a-sOYh8$
uUl~OW
CM=M| 
%3_;ia
agU-.C
G]T.^{
l\8!$	Nu
"}*L4A&
ezHc;>+
HsT`)/
(y;bDL
n[=v$4
RsH=n9
.r bzo
P=eIwu
gD&	>71
o\caJ>
64DW6Cw
#X8.Z*")
/2fo@Jd 
Rq!?H[
'](PN8
ni~z5%
WL@~s2u@v1e
vXddKz
F$R75X
Oq>!"IC
VGN>[k0
p3	th$
O0|S7^
&r]>k,
&Z<8/1i
0zleC<
J)w5Cl|
U?M08$
x'3F|A~
 N5bHO
;f2]5X
Dym!;{M
o=oo_b
7l\T|I
lC(KCq
a&unLEX
w2	$Hy
CE4^lc
<q#L6h
q?fJ'x
gO=c+ X
%TG}w}
dM+=rKn
EAgmbF
"fXdT';
ue%Yz3B
V6YH'~
6Q084A
AF)m<<
o7v	?Q<W]
7WgNBY
$vb2&n
BPwz\0.Z
Yb0L(4
90(ENs
Iz%gP#
4d-`(w
"M-X.	qp
]m>7)|
w|,8t 
*p okv
W<K878
}OV0cj
jG(}.a
L)3"gM"
!j^648J
JpBp+,
a>Q~z>
l+~A<K@
ZolQ,~
4Q0k@m
Gq4xV0j
4o;~&"
nPiz$~
0~ayzA
TG`YI"
jo %Mk
FGDi-t
7?vL_p
Z-w4-B
$Ny**NI
8eta4#
Y+}w`O
x~R\x)
y<ky\2"
N$q9i]R
[B)2b*?q
#:=xmL*
I8cP=W
H.xOi]
0@v9dP
'4C*2H
wX:F=H_
nxfdV6S
r?Zj$s
p/K:a>
yb9;uUO
c`77|,
`<E"23x
):n<8O
TtbmSF
yE	gz%
Ofny 9
	/ArFb
EaSg`t
xqd#66#
t*cd"d
i]\fzE
0ke_{M
#6g1]Q
tu-HH	
`wT^e8
.~TGLd
grU#7|o
T\Z<{;
|98;yl
:!9/9k
{r75}~O
!''pb7
BO@a}D
B:?Ub@
*Y/*Mck:|#^:k
,EaGXy
H9Wq`}3G
AC5iUn
Gn0?FB
*FMpm[Q
sv)sJg
\G5D\RT
>OsygA2$
Y`n$lF
aC4"13
]o5Th6
.r,GxB;
])Uj*u
[;vC:(
gcqv23U?C
vpLqbL
!6?sIx
KHk2qR>
mq:3vv
7LB#J|
D1&_I" 
	$uARG
CJ=M6TP
a+Z3e+<
6`3;=g
803e/K
beTby7
Fi2AUj*^Z
ltc!"0
9)m-#F
Sxwx.?M"
e4sa9;Dx7x&
G(G#Sy
tpG"POz
#mi&B"
UhRBud
Haf5qs
bex2]O
9TXWg{W
iE*$L"F4d
.SAa<8
 P(fQu'
/BL=H6rj
##Q?E'V
1NnL]U
4FFGpw
(*@Jf3
*JS)uf"
g>a|9#}s
4cRuG|lg m
{xzp&6	
+=0.t6
(B"DRG]
j;>41l
2KC&JAr
6W;9}"eF^
|i#RxAk
l@ 1w$
	&GdtyK
LRJOp'r
V '$/w
iOl8t!
PaX6E:
#Zs=a9
%=o]GP
dZ10FV;
0e.tJq\F
:t)h*v
T(6Xr5
oUf6r9
\J Wbn
Jg'gzj
_5C[^M
\=T*cDlR4
6o2(?xG
pI1%o^
l w<W#
hP%uZc
	+x"&l
FC*Hu=uB
8'97J7
"A4^'4
jZm4d;@
P(#EbL
HI2Ip'
ctW@~g
pAVZyQ
89\m]I
gkJV[Y
S{W"a;
(V[Mv0
Gv~!_/
SoGg2=uD
dHH8eh&
G@lO4"
]I7;'<
"p4< bk
8>!GoDl
MU?13s
|	.{I;
?t`Lpd
u6:rJW
9d-tNX
.8no\z
yOKl[H<d@
H@al#/G
I$'^?	
Lo4d+-
;LuVD<
-P/eZb?*
U4OVHy
Cl9"YT
PZ]A-b
Whq&c2!6B
e@7d)b
[<@#N2FH
!^{=N[
Vw@aTW
\">qx<
FVr=p<
U`s'I2a#{=
f7[y40
MWkpqa
3St$EJ
lTwH`o
GfuO~u
-O}Q%a
#R20<tkK
'6{cq>
.>J@YG
dfmypKP
!oh<}D
=*&XdJ#p39
V4ghde!Jj
x0y,#]
MUZF.eJ5D"
"hRP{)u
]P	xV^Z
:pH:V/
'4bx.8
'4FV&8
Eg*9ZT
mh-2!]
kernel32.dll
GetProcAddress
GetModuleHandleA
LoadLibraryA
user32.dll
advapi32.dll
oleaut32.dll
advapi32.dll
version.dll
gdi32.dll
user32.dll
oleaut32.dll
comctl32.dll
shell32.dll
comdlg32.dll
oleaut32.dll
kernel32.dll
GetKeyboardType
RegQueryValueExA
SysFreeString
RegSetValueExA
VerQueryValueA
UnrealizeObject
CreateWindowExA
SafeArrayPtrOfIndex
ImageList_SetIconSize
SHGetSpecialFolderPathA
GetSaveFileNameA
VariantChangeTypeEx
RaiseException
"crh"l
;zl>3D
6kq~fT
scX}+n
X30nD`
hllllo
llllllllllllllll
llllllllllllllll
llllllllllllllll
lllllll
lllllll
lllllll
llllllh
lllllll
llllllllllllllll
llllllllllllllll
llllllllllllllll
!H&1<B
XZ}l|y
&~W?$J
RE\Bor	la<n
UMaskV
uXez$Y
X#1L]'!
Tx^B 4
Por:ti
7W0`yw
", 8@A
jX{O%(l
*"^Yh1
!TDM-B
a=2\lf
kern0l32
LongPa
QH}B^D
0)\~Y{
d-4|s=
prlH9X0d"`#\
`4"0#,
Memory:
EDivB(
DpHtk;9l
BFaHod
c[D#2m)
=K{cXu
).c?'a
QJz};oi
,(t$N@
 !Rec_
L'<TQ$
Nz1=Jt
Y?={W5
m0),Wt
$	jA(5
h	mTg,
'Y$aCl
B'-"}N
E`f6u)
omIniF
jZ^S_0V
ansd@r
p& $i S
q'YQTh
@4vNX@*
#/P!~f
JKLMNOP.Q
yz0123
	u_~QX?m
h0 %2{
7=;%	}
HJ=|n_
C?PY$]
t4!8;UQ
@_*eoL
	xL@^/
vrn=;L
a'tc.|-
o?kb}xW
lo#pyt
.Cache 
Obta1{
 <7ACY
256ToM
Int: L8
?S r}9x<c
sk#C}:
M\"Hd$
VBC`~%
l:-	np
egist\
GCOpot
Hbp\^RaIrX
_K{>}B
Bxy4 v,z
10:Bhm
&'00@K
 s3w%rq)
PActiNv
`I|#uZ
u(IfFN
\Z$M;EX
t*#@q1B~x<
fes8-al
9rhHE%
\ "	'D0	9
(R) 9or
ouwi q\W
ansm;etg
RX1u<Ix
adp*H$
Z_Yz[PX
u7r2yS
|$WN42x
'RDC45
(8P'QR
GgL0"tM
kbq%eip
LO Us>
.With[
	!Sub*
fqrm@`Vg
uEip@)%
ZtCh#6
{s|J?.
 H@ce9fA
~,H0G8:`5
trgpC;	bw
uzgi{pU
'R[Q$&
sN3 {H
\3'sSY
&"P( U
U/&u7{
^ Y\Ps
T'he~@
SI"`J_
qCan-'t
f~HRq%
?RB>@=
${)Tk9
:CK=u)
jlQ]Z@^
VskHM7
(h=V,.
>RHAxL
R}8|^a
K>`+pB
3l]| tL
!)Q5r0
xC0>RQ
%@sFNJ
%2z	f$
-@\Zh	
@A/!>[
 !tGPb
Runtim
~~(&0"
wx(zv 
 dsi.Xkl
"05p`)
00"4NZ
Cri^Gca
]EBoxSH
IsB9"R
L'PGTgb
B'JGRgZ
z/|P~X
(0rBtl
!5r't/vR
#16AX9
x"z*L2
0'4GDgd
' G$g(
T'8<t{
r=tAvExI
zM|Q~U
@<T: :
VLV]3[
rTtX]`a
f:q;{<
wSt[He
J^V	=ro	
jr/tObq?
	@X\Oo
V|i~{]
f2jCg3k
R]@?/C
D|r9t=]
U4^'iD
wI}\?r
~:+;_<c}=
>k?o@s'wa
'0Ah8c(
<69_H-
FK[c0"
4r#t`]B
/?r;^*
*,n/,=
[^YjXbH
e%P`=[B
@8zyjS
s5E<uj
CfM)?ag
?brmuhSQo
;j]i|BP(
D;9,XHA
r!,W?	C
$J2i_!
q	Kh`O
	Y[hyD
eGs~9_
VUfGh[x
]HtH<LA
:)K4/V
{~5?tw
l@v!Un
"QAxaZ