Sample details: 934f5d55869362d924c51b0e2e8c6c66 --

Hashes
MD5: 934f5d55869362d924c51b0e2e8c6c66
SHA1: 564fe94f15ef1c9d5fc245f702e5f8d029ae9a3c
SHA256: 3c285fea2389acdfd36a0b235f701aef5e03629838b401db8197830bce1aa7e1
SSDEEP: 12288:Np3hTk3yJvssDn6blPothZfM3PoTwNCLDtCH3r7VVYZkz3hQ4f8vMoAJnx:NpG3yJ9Dn0AthG/oTdvc7gObjUvVa
Details
File Type: PE32
Yara Hits
YRP/PackerUPX_CompresorGratuito_wwwupxsourceforgenet | YRP/UPX_wwwupxsourceforgenet_additional | YRP/yodas_Protector_v1033_dllocx_Ashkbiz_Danehkar_h | YRP/Netopsystems_FEAD_Optimizer_1 | YRP/UPX_290_LZMA | YRP/UPX_290_LZMA_Markus_Oberhumer_Laszlo_Molnar_John_Reiser | YRP/UPX_290_LZMA_additional | YRP/UPX_wwwupxsourceforgenet | YRP/Borland | YRP/UPXv20MarkusLaszloReiser | YRP/UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser | YRP/UPX20030XMarkusOberhumerLaszloMolnarJohnReiser | YRP/UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser | YRP/upx_3 | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/HasOverlay | YRP/domain | YRP/contentis_base64 | YRP/screenshot | YRP/UPX | YRP/suspicious_packer_section |
Sub Files
d1c98762270fc4d66fc1912ebf501708
Source
http://cryptovoip.in/bn/TGFX.exe
Strings
		This program must be run under Win32
Boolean
Integer
ByWl'Word
ShXtStr6
TObject<
I9rface
On''D@
Y;vBjCX
X\:r~0
+P4xo04
bZYYdq*
CY	vcQ
tHuv9p
7XJjdah[]
+t_$xt
ZXtU0u
Vh4<Kg
SOFTWARE\Borland\Delphi\RTL
askValue
_]t7:fP
t7I@r,V
ZTUWVS
ytqQ&Y
_-Rf;` 
D{/:pd*<
%K"W8n
N|*(}&
s9@~A(
Cp$'d@\CpS
.m/aLG
(F0d{G
GWFq2u'
rnel32.dll
GetLongPathNamX
Software
cales27
~CIgctg
?  t.<
l'!@P#
y CpA(
AdjhA(
pp?v ~!
&Disabl
FocusDefa
ultPHotLigh
BoxEdit
Windows
ND0wStaJ
|x''''tplh''''d`\X''''TPLH''''D@<8''''40,(''''$ 
999<84
/)'w*0
RT_(_.SCK_LINES/
	Exception
+i[U$ls
tOfMemory
EDivByZer+
~Range
Inverr
8X%fv0idOp
fecal8~
Y\G8(P
TThread'
|$TMul
 lus6W
#vpP`5(x
s99R|+@
N@y]mB
@T9h6T
0r=<9w9i
X^o`V0
INFNAN
* (()@-3$g
-	*-&*$Q
^$&-[-o
0()(2)
@=dm1{=& 
v5RHtI
AM/PMr
I8_8#7Af	 u5
0MsS*U
`wC0p/
om/d/o
dH%[40 
kFreeSp
;G$t@&<
8.(4$n
otAddSub//
MulDivIdivod
Gf_nOr
Cmp4FromSt*
Dispatch
Ft?Htb
 mTo?,
(;OcRF
Q=>rb=6
=%'FbZ
u\ SryeL
W`)8+ 
"r!~`<0
/-AQe-o
I@CB9qG
i8 SdK:u
BtO=51aKM=3=
0a=Ad9
p[M=9V7
76r0!#
v9r&#A()
	?I_hWP
<j4O;W
}gE|'#
;Urd.5	("2
E{HX"pS-
/Empty
Doub@I
Currencg!
DatgOlX
UnknowDeci
WAnyEg
,ClassM
hod W{
7Property
AJ>Nm!"
pQ,"R!
rdA<dB
1CVhh%G
tagMULTI_QI
B^8lHHl:
TAlignment
0vLeftJ
loBiDi^[Yy
uf Only
Middle
nMCut0
Bits0r>
'K8PKO`
TBjicA
2gGroup
vstgKH
Uh;6^/
'	ymAky
%s[%d]
~MJ=d E
4/C;^X{
ndb"_g
.OK5%s
@= Q :
xTRg@G	
s3%	{cd
ar*A:Es
hP<h&N
T"Fixup'
h|+.4:P
K8*yH~E%
CAsK~`
14ZM0O
B'M^P7
\QC]0xpCp>
<ODVhz
pKIV30*
]lx$ja
Y])8cEo
43W>sq
RF?n	BB
@-st5#T
!:u'1?
t`/{RO
68=UGn
#Tli9i
,QA2,s
$%GcTPW]
x>(t/r
` NSp.Zi
WLeftTopy 
$;=G1t98jL
R bW77
1	l&TP
Al!t^`
(5BNN:3
pqrNNNNstuvNNNNwxyzNNNN{|}~NNNN
`abNNNNcdefNNNNghijNNNNklmnNNNNoPQRNNNNSTUVNNNNWXYZNNNN[\]^NNNN_@ABNNNNCDEFNNNNGHIJNNNNKLMNNNNNO012NNNN3456NNNN789:NNNN;<=>NNNN? !"qNNN#$%d
FontPitch
l|Styl
	`fIns
.FDiag
 oross&%
Msg{h<x
a0*/LD	
TIconNDC
MuE;@ 1
pgAURP
clMaroonG
PurpleGTeal
f@~gSilver
Yellow
uG	Fuchsiag
<h__ppWX&
/BtnFU
ANSI_CHARSET
'DEFA*5"
SYMBOLc
HIFTJI`v
G{BIG5
TURKISHH
RUSSIAN44w 
EASTROPE
t,U*M^
Wv"1[E
Dgl/89
a19dPf_
tSXD<#
/i|{xI
J{ z],
Ix3"^ <
:SsDk[4
Qub!(zp
oJ&\sA
%icobmp
T7	JYG
u5| [(f
	4)UL5
K1*%-8
Rp'Ehi
(s^"hL
=otEw?
 hb:#:
i!"448I
mFP?!/I
gB__22
+QtA6X
}WSD3<
%Ov0f"F
6XykEp
OInitC&mon
sPg[c{'
HDrrrr@<84
($9999 
mWJK80Pl
rA0)_*a
T~)l, 
4ZE&x5
 lH)^g
WnISPLAY
3Viewe
F$d0	o]
 _IXk20,
E^3FcX
Device
UpdPEQ
0*;W~]bt
 jh$	,
9X\XhJe
W/SEnf
 $(####,048
6ZGQ`g
{;Xc7(
He@(P, 
:uxtheme
3QClose!
wIcqIs
lyTznsp
ytogYj
urmn/_8n
W&+ mK  
2 Mik0
aN&Olbsf
r 	)JWiW2
 !"#$%
%6DR`y
A"e#2He
Dv4D(D
s<&zj(
xs"VisivCo
(9TQ.XQ
vTabNB
WDlSTr
vl-)`tc
+VaaK!`
ln_W"Ax
k	Q|xU
	99pp^
rlPW/}
,+mM6>S
D<0LN7C
#5$	osA
7'g9HI
%<!0<<
*W	` #F
1)eIZO]
=$?'Bdn
S!$?CO
'OZ5\2Qh
9Q\j_ksz
DZ:H;d
olzD{%
^-r(TYNG
<ZpL.Cx
SquN)3
sYCircj
vC{H1`]
NajalNumb
`opR1S,
cFTCt4
|dgI`b
i-#L6]
\UBkj8F
['<xS<
ytBw:Il
}LR)A]
HHI_'A
-kURHR
C=Sh_t
8/|@z+
ds	cIx
\2LDh6
T>ax(zaBa5Xa.
r@$~G`
J.5	Ls'
YYY+%-A
@ trnb
_Ignore
Omdlg_h
yAIQYa
|Ww@Bb
E(AL("%s",4),"
aKe{,3)" JK13
JumpID
_WINHELP
#3277IA
mb	mbmb
=X>inv
AMTargetU
Wheeli
P3Dsh\
NyWqDJr
vS&mgX
XeEbenB^>bebe
XOWSEWE
pH:Gla
i $$((
UWHH~DX<
/*x.ZC
+PTmY(
p64\V2C 
}Lu7;Wx
LlM9W.9
3HT:lI@
?$;~|u
r\@v;{D
?:_Wt+
.ZZZRiI
$Kzg%'
Q.%woZ
S8!1Xh
	tER*#,w
P4)Rf B/-%e
0D40Vr
,(af)]2
B$eXv@
+PL)DS't|A
#$=(#/r%^
Ja!}9(W
!^+SD 
1g+`t%
NH>@ul
mB:X7&'
a0,/Syi
]!,THg
#I}@gWL
;XD`}@
~N#`qJ
v"5@ \
qjAo9G
=(JrmF
J{`w/.
LTqNJ!
9;wlt4
,Jnk,X
*b&Y8%=
pIV%m 8n
k2^iOS(
@1%pzj
tS.BPX
hEFH%@
gC+.u@
L`yl9	
Q$;CCK
Ejo-,r
	PP2F-
^ +i|Q
IMETmm
iaKj#Wmp_
cioj/F
IW;P8u+'
i88<<)
/]ptF)
I*E(	f
LmLV]Z
D]vr8(4
5p!sA2
 nYK4:
$coPp.
FO2BH$
 B9q&G
e	G1S _I
TAdxncPu
keysK<
hO>DXnt
|Track	T4
12345678
90ABCpGHIJKLMN
O STUVWXYZ
AAAO`b
4@{if3s
x`BD$jP
q$N Cr
P?:S?M
		W:^8
 >PFPl
~'42r{
HDV:abH
HEY8M*
A+Bu'q
"IP]H0
/8xKJK
 R@Oe[G(-
^F(Y;<
J7Xd/A
HIh;J4
)QdxSM5
qW=6t:p
_N|LxH
egul6G
A ?<mE0
./	K.`
d*78@&@.9:I
EcDr 4
(9J#$@
;H:	dm
Primary
HidF(Ba
(9J.$%
JgjoM"
s5+R'wX
6s.GH<9
rq+cL))
;S$N&p)
d&fP+E
O32!DD
@h1_n`w
o3(]W|
 XHp5wV 
^lHz;~
	l tFh
#3	+#z
=JZwJhg
)|@?XAht
{7Y!Ta
/	5K05
u41iO	l$X
-d#?LD
t;Cpu'
A#,*)7
j&tqx51X
LIENT.
E-bgb;
XhsPxFb,
t#;ADti
P6vHnS[
R ZB@f')A`
lbz\|s
	+q]P.
~/lP*.X
8R	bS0
|aX|3"7
 #C+'!5|N
T'KL,&
:jc"?t
FA/Pam
}ttn]S
Y6@bI8
Zv CKnX
n_A"=et\
40jj -
olnX)B
8/$8<+
fIZI-?#
MAINIC
'@b%5l
6@:  0
HzZ,aH|Sd
nlExxt`
5)tZ!~Q
4e%|`H(Z
Ne7g--
h/\qNqz<xG
.R+yovclt<Hc
est3*m 
't<j@jsD
?;^`u0
C'1a@]
C_W		aM1
hXFFmdFFEv
60hPL[
barUln
)!XLFH
@>B,:Hutn
ED-b4*PU
]YRAtIu
$m g>!
NonnJJ
achToa
OY[JJI}
9@^6@A
2pnSu 
T__17e41f4U
[1.6 nta]
<Z|'mFH
h+8<t2I
X\\+`!
ptt+xI
e(,,W0	
+$ZfD>P(
t?X	0[24
MiTeC I =
 2.0 - 
 1997-
f!r:r[
vL O&'
L7 %QG@
&(GWG	
v]p]u?'W5M]
	V\a0Q
`WU|Kx
lGlypht
@	L`vH
aB6lK	
``%O-I
"0,Yl;U@
NQE5%V
uKs@RFr
B6=3Dm9
%%L,)&
<#DP@F
F5*MF8.
Aj1E,x
(;:`_x+
N&:+tR
52a|b{M2
pbB}lypb
OG$OGH
&((hQ{
f(tX`>
Q0 8!'
R60$LbrA$Eg
sE'gP`
L%S9:S
E2;<=4
yR``FO
,*]p7N
G&View
A	QNF6%h
&,chDir
JL#~uD!
JQKDBp!
,PP\ V
0H@0H@
_&p&9VIs
V3pL9AP(
(?8 <E
2HWP`h
9aFob'ddH
5>@~nL
dp!46H|8
5H\y(y48H
,#KTKB
s_sTFJ
 "p(]h
-8%/_b
7^av/X
_O<,64<$
+w;}sl
u#}T<`
W$iGtpg+ 
rrH^TPr
1Xr}iZ($
-LH!L4
K#/ w.
@ORICHEDa)
IKYG7p
6%j_lh
T.TPb-
#AXe,#
"^;P$t
Dg0"1($	[
Y`	M`Q]
NSLZGv_Pc
G!??_,
,dxGi&
vDkqP+
` dcaw
]~}	rw
$-@*P!ZK
4.+_+*
BdB/h;G
!OvK(E
 R" @K
>oP1Ea	o
apB>$o
}r CZH
5,0cCx
eTCA$y
6Xs}AD
p"x.	-@(C
Y~}Amk
!ba,#\
6GD)7b
*hU/i*
-GehAD
$)!Q	K
VWuP=uJ
((O(x@>
$opF.i$
\2HFFF
A	izGq
deg8!!0
2 8<9H
HBU"]_
H,_F~"
Ot:w:X
N],&B6
bfbSZ>
3tp4M3
lg;N*E
9(1.MA)
<%u(Eb3%9
'tE5?<
h)J02X
93%l^gM
p#/8a8{P
	@$'w$
Cg CX0B
QpeCX6
p-J`!	
T`MAkt7' 
pNrrHVtxp
OGgMqCi
nA0=5$
B  rB.
d@.xDx
$PH?Ha;
910%24
JsH 	>
6P#2T3Xy
6t#7x{
Z&{$|k
[YZGupu
KnT fH
t_gToI
/&<*$I
7FV;b?
%d iIs;
vK#$L6
U@yLyXy
@dypy 
A4yLyC:J
HLLPr!
?"&?abcdefghijkl
mnopqrstuvwxyz+/?x
DfVFaN
&dZ/c$
9$|rF/
@_DdDB^]
LPPTr!
pp+tp&
`+@DlW
~DVCLA
Lr1CuL
at 0>A
 (08@y
yHPX`h
y4DTh-x
TPF$W>
x>p`F~/
moWG_o
7ov Gq
gs*"czf
3rOn;g
*untF[
/H_lohkZ
;w"yGW{xw7
o+#V.+
SFb~m_
@w!>/U
V0xOO7W
:g7noaEK
d7`8`W
	"#f"Wk#
Ac@ca$GLibW
h'so2HN
w!vtp://n<a
l7ia5t
  - by ?i
[{?7G7
1K\VWe
=mz:>W7W2
*PsvLv
ifK9a~V6
NfN1V|vF'Q
p0Ml~)D
_;>*Qx
Ihv#@_P
nhSKP^
U*&^Fz
-">~|6
+K.;]f
^f6n	4
7%VFDh
hki{/_
q+XN9N
M$f&Qd
K`vF,pk
c>CWivd&
#AZ>He
P.];nV
Kdx?Lb{
@'6vJFS
mOW6Uq
VUn&V.S
%A~l*$*
vH^NpRCL
4]V4Wn
/ZrF]r^]
N@^.].
K\wN]65F
m}Nn~&q
6I>Vk6Z
LY&^m}
>V#W.j
mZ 	Ff=b
]m~pAkO?
BnV(U{
S; ncs
mg7N	d
&V~I>3Kh
7TfZnK
NG^xBo
G(DcF@
>bhf^i
N\h?iy
&GG?JA
^^6Pn!
SRvV6O
4vAYfr
V1F.Q^
bnYV8o
&>'EF$
)Z6V|+
JNoGWM
@Wqnf4E[
c}wDZs
|eXiTm'
';X.Np
Iq^v>a
qNr v2O
(Y^:k^R
%HfM._
@Y~P2c
@gF7Ux
NVndaD
BsRWnLn
)XQ_>z
qEFG>8a
%Gb.R]
x:f7v7X
f0SuNr
/V` |,
7FvavpP
Di>3Y2
+Pr6^vSe|
N.^?v$$
>>~cn2
a$<5>v
'*Ce.-M
[}~F'n
:LN5R 
'@b&<>
+Fv$Es'	
D[CH]`>
v0K_|G
-w.0a~
~*:dF0W
fHkx.b8u!&
=[>`3Q
wRfe.V
`@1Pi&p
.^)]!1
i\gWfX[
~STNDM
=QtF1V
7Dd>CU
T|D#0Z
N/VE-r
';."8.E0:d&+F3
_!b+E&?^
&HX$mvf
S_k/Xi|
NN&EN>j
5mZ7?@J
6Vb}Vv
6p@M[.
sn_n~O
3fC\lL|
SbuF^s~
F>Mt{`k
.~NavbBu
IXhDaDA6
D8Jv',
5SE>3n=X
Yfv_\l
N`wnfHZq
P[6k8l>i{
?daQ O
>TfNYo
\t>f}n
bii#P 
fA>=UsoC]
TnVcyhs
Sa}.fK`D<}
7CV^hrN
N~	&+)n
h!P@.w6Xn	7q
2N?ZF>
A^L&ARm
Xb=V\n
FPlVNi
dpzGht~
aE'V{6}
9Bk2gw
>ZgwW_o
.k{,~_
Gct}Pm
IF7w.+
6yg7/o
j^gt|F
[do}vF
vN3F~CZ4
nJTe]T
pgw~6f
Y.MWhai
Nc[n|e
NZdj4d
]/hNYjs
LVhNj~
nNY&bm
"A7o[gq
+7/A+ 
iv`ivF
OU\&ty
	ORVF`Jm
Fo|6(6i
V_nVQ^f
QPS[Weu
M&du~|
NNJVNbs?
^Scpw.3
atVYl5
qBO.L]
c?oeje
N^UdF^
~g{40z/
wc'>O^o
R XG?!
`PHm]f
_`HX+	
@cYM>A
A;;:{xw
jd`RLB:
K>:yvv
(APM) e
@tyyhllqvv
nrrjnn
hkkOPP^```dd
R\^^bff:
gofhhe
{~~AlU
& p) C"
ejQ)F=j w
Microsoftkp
2ducir im
;te2yd`T
@&`&IO
JY`8`QLG33H5
QE@+2QR
35hxy~
f`_OL`a
@A?VUOSN^-4k
%%%QNHoeaTf
451.(()>?>gb^_Tcb
:101322WWR_^lRUlG
~x665)
4km^LA
+onj^ZU
O[gojV
sokhO4m(
Nl`D3M
|4|4O4
igur!{@;
iloswh/
referE
HN1SS\
so_]Z]WW\bpqXo-0O
Bh#uv`m:jh
?/+<e'>k
@Bq Lo&Al&i
bypz^\c`roT
c_bQNYYee@
#o{XVMXRhE[
J& Dwt%
ze_|nj
@@755+YYQ
FF<;;1==3
BB8\\T/
XXOxxo
U}}uee\ssj
rihac>L^
YhH(N?
I$zdm.~
2_recurjN
-(B]<`
x*\.[wh
c!pB2	&
+CTRL+ERg
8 Cir"
/ pWaI
X!)k2A
q!&%1'
P%3si=
lstrcpyA`
ToYzCU|e
adl-*!@^8
A\A!`a
FzlPath
a5i#%E 
\ypReg
I3	#C0
ICA3Hf
)vUB@H&
BcLong
+Q[t`G
'JDi!%
q#EdMH
3V6,Of
2%@tfr%
XPTPSW
&&&&&&&&&&&&&&&&bbbbbbbbbbbbbbbb&&&&&&&&&&&&&&&&bbbbbbbbbbbbbbbb&&&&&&&&&&&&&&&&bbbbbbbbbbbbbbbb&&&&&&(
&&&&&&&bbbbh
bbbbbbb&&&
&&&bbb
bbb&&&
&&&bbb
bbb&&&
&&&bbb
bbb&&&
&&&bbb
bbb&&&
&&&bbb
bbb&&&
&&&bbb
bbb&&&
&&&bbb
bbb&&&
&&&bbb
bbb&&&&(
&&&&&&&bbbbbbh
bbbbbbb&&&&&&&&&&&&&&&&bbbbbbbbbbbbbbbb&&&&&&&&&&&&&&&&bbbbbbbbbbbbbbbb&&&&&&&&&&&&&&&&bbbbbbbbbbbbbbbb
v&&/bbbbbbbo&&&&&&&/o
bbbbbo/
o&&&&/
&/bbbb
bbbbbo/
&&&&&/bbb
rbbo&&&
...-.-..-..-..-..-..-..-..-..-...-..-..-..-..-..-..-..-..-.-
$4CR\_____0
"2?P\___________2
/>N\__\______________0
:NZ_______________________2
$__________________________2
QQPPPPPPPPPPPPPPPP0
$__________________________2
__________________>
$__________________________2
__________________?
$__________________________2
$__________________________2
$__________________________2
$__________________________2
$__________________________2
$__________________________2
__________________?
$_______________K:58_______2
$_______W
2_______2
$________"
	W_______2
$________K
-________2
$_________
S________2
$_________G
&_________2
__________________?
$__________
Q_________2
$$$$$$AW$$$$$$$8__?
$__________C
"__________2
$___________
K__________2
$__________Y	
?__________2
$__________8
__________2
$__________
F_________2
WZYYYY__ZZZYYYZ\__?
$_________A
_________2
-----+FW--+-+-+?__?
$_________
I________2
$________K
"________2
$________)
Q_______2
$________>5/Q___-		)_______2
$_________________ZY_______2
QNQNQQW_QQQQNQNW__?
$__________________________2
444443HW3333444C__?
$__________________________2
$__________________________2
$__________________________2
$__________________________2
$__________________________2
GGGGGGP\HGHGHGGQ__?
$__________________________2
____\_____________?
$__________________________2
KKKKKHLKKKKKKKKKKK-
6FT_______________________2
)8GT_________________2
+9GW___________2
-:KZ_____2
y/!WG&
LKogwP
KERNEL32.DLL
advapi32.dll
comctl32.dll
comdlg32.dll
gdi32.dll
ole32.dll
oleaut32.dll
shell32.dll
user32.dll
version.dll
winspool.drv
LoadLibraryA
GetProcAddress
VirtualProtect
ExitProcess
RegFlushKey
ImageList_Add
PrintDlgA
SaveDC
IsEqualGUID
VariantCopy
SHGetSpecialFolderPathA
VerQueryValueA
OpenPrinterA
&$%@*346863768&$%@*
&$%@*&$%@*1&$%@*&$%@*&$%@*U
80&$%@*&$%@*U
<0000000pp1p0
0000000
0000@p0