Sample details: 99afda6820e000917b438a94d86a2300 --

Hashes
MD5: 99afda6820e000917b438a94d86a2300
SHA1: 33cad1e56d8d14e18c8eb7572219ed0db71df55b
SHA256: 016c8ec209b1d3c0de2883229ca9f9f21f9a3b7fa53688e8ba84c0ed394874b5
SSDEEP: 6144:L45lD5xdSxP+vF1+LqEOISQHo6Hs0ZthKduqjaYpq0fKvp1ZIWk:05d5rmO+LAIRH7MIgXjNMx3IWk
Details
File Type: PE32
Yara Hits
YRP/UPX_v0896_v102_v105_v122_Delphi_stub_additional | YRP/UPX_v0896_v102_v105_v122_Delphi_stub_Laszlo_Markus | YRP/PackerUPX_CompresorGratuito_wwwupxsourceforgenet | YRP/UPX_wwwupxsourceforgenet_additional | YRP/MSLRH_V031_emadicius | YRP/yodas_Protector_v1033_dllocx_Ashkbiz_Danehkar_h | YRP/UPX_v0896_v102_v105_v122_Delphi_stub | YRP/UPX_wwwupxsourceforgenet | YRP/UPXv20MarkusLaszloReiser | YRP/UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser | YRP/UPXProtectorv10x2 | YRP/UPX20030XMarkusOberhumerLaszloMolnarJohnReiser | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/IsPacked | YRP/IsBeyondImageSize | YRP/domain | YRP/contentis_base64 | YRP/UPX | YRP/suspicious_packer_section |
Sub Files
0bfd9d6954b05f1466c79f81739d85da
Source
http://www.asaigoldenrice.com/daq/exe/9.exe
http://www.asaigoldenrice.com/daq/exe/9.exe
Strings
		This program must be run under Win32
Boolean
Integer
ByWl'Word
TObject
rfaceK
PY\YGp
|rrrrxtp
rrrrlhd
`\rrrr
rrrTPLS
HD@''''<840
;2w;;thsz
t[gzfS
9PK1$])
sF+=N/
yHJ%NHJ
n'PPl,
$xtZXtU0u
0"	w%9
~KxI[)
SOFTWARE\Borl
and\Delphi\RTL
FPUMaskValu^=
	6s}%D
t7I r@x
ZTUWVSpP
 5`;!?
\[aZX>
_-Rf;` 
\K"W8A
~N|*(}&
f`!Wwd
%>Q\	NI
M'w364
)A9xuV@
}!*?9r6Xl
E$t(;Q
[(.\gx
el32.dll_GetLongPathNameA
P~oftware_
cales27|
m{loLx
t	CF3u
?  t.<
!#XG3n
e#U\[|FV
-ap.Cr@4apD
&Disabl
FocusDefaultPHotL
ive>NoAcc
omboBoxEdit
TOwnND0w
D9999@<8499990,($9999 
#ONFTP
''''|xtp''''lhd`''''\XTP''''LHD@''''<840'''',($ ''''
*XZ/QK
!/WV,]_
@ MSWHEEL
%_ROLL
ORT_(_.wh
SCK_LINES/g
	Exception
EOutOfMemory
EDivByZe
HvN0z>'
TThreadob
;*5,"F
l];#e.Ls
o?=40`_3
h|wA l
	Gw>R@H
J^0WTx`
b|E/\:
|^.uH}
0r=<9w9i
INFNAN
* (()@-3$-	u
n*-&F&Q
0()(2)
Xpw3;I
8,fk<d
(6Eb_A
wU$w4ys
?AM/PM
>5"gu4
6TX!%~
B!I(^`
B6@GF}
I!F,%J
K+6Kgd
\B/eSM8
|[MT;4
}<r'x$
9j*!Sh
C(iCh"
:ss6%LO!
,kFreeSp
{;w$t|Q
s\*|NG
)PzYs4
/od_nOr
_Cmp4FromSt*
Ft?Htb
t6[u&h
[7!/d`
<"4FXf
`/%hA*7AJ
'$Cb'Gs
&Q5Q6b
=`Q6X9Qc
.@_~.G
07o<!p|7L
a~bCYx
gEmpty
RrSma 
Currenc
UnknowDeci
(<@gh.
 WTLAG)Sd
]@1VRL
w=(?XW
TAlignmen
@^LeftJ k
TBiDiVe
Middle
^BjicA
{\h#]l
gGroup
<^$N"`W
ki)Hi4
l%:rTR
$6C0}K
`ywBaHa
%s[%d]
D>PRW'
dQ\;du
JBkYO+
P	(gH7
_QzRue\
TPropFixup
`{vbUK
7PYF;w
 MtkEg
 Sf94Z
=@xQB5S
{O!MNu
~&X{@[
){K;`0
39"Uiz
8OXFrC
:`jC:G
g%s_%dM
@+c@;t
:&YD@R#
BTW]+'
SP9'}en
mOB_V1
:NYX21
T7=\5Xg
@Yo!fz
d$5jtG+
k]'X.$
u%_c`E
>;C@fB
B jE'L
.t"Xo]
rstu9999vwxy9999z{|}9999~
`a9999bcde9999fghi9999jklm9999noPQ9999RSTU9999VWXY9999Z[\]9999^_@A9999BCDE9999FGHI9999JKLM9999NO0199992345999967899999:;<=9999>? !9999"#$%9999&'()9999*+,-
OP0	fp
Boross
Bp(# :
/E;@ K
LimegYel=XS
G	FuchsiaAqu
mGMf	D
_ppWXkxq
/BTgr}"
l/BtnF
r3}foBh'
o/=2[ 
I_CHARSET
wDEFAULT5H
SYMBOLc
a_MACW
GJO Ba
GB2312
TURK*H
EASTROPE
_"XV;P
#'\-"{
K">a<o
$gh4\M/
tzBVoPO
@ Z/i0
\JbleY
M,+D	>UZL
X$OIA9
5=>"j	
iu`;:?
l'\wuC
4>}+bBg
sV	a->
eicobmp6
PX/lD6s
{F(~NT
CGjtC(/
 EMFt/
/#o'fl
[Hs(G_j
:Qx^A% ^R
nU8N$.w H
s[#.qGd
^pS0yP
XT%Ov0k&b
"Z7 40
|$/XNx
aM<-0/
ISPLAY
_2F#hV
IP6W+u$
Jzd{h0zf
	+6s(=H[K
64-x O
p!MwNdR
#9d@ZU
@&1nLR
m"H5D$9
comctYS
FSFSB'U+b
W$^ 7/SEnl
2222 $(,
2204+3t
6uxtheme}
Close!
;IcqIs
lyTznsp
mPyO4Nn
CdDPR^8>8
'W[@86$
_Ign@e
mdlg_h
L.T;yF
8lfAxC
<m3fL,
SKUpqX8
dWZxs0
T:y3dVCE
4L89=D	+I
[p	0uK
!&R'@(7
p0;^9u
Jh7VBK
99"==$
pp4.}e
J$m+)L$i
LHR*]8
WuK{@0.
5<BKp,
]\:X |A
u`%~RK
Hb%O-I
@h)9RY
ge:P t
7?tw4tw	
,}l:R 
pQj]lHh
F\%3\K
vAk_;^
 2001,
aN&Olb^[
@$&12*
y/@Qbs
2He#f$g
)*rAe 
Leav!0
C(zC?ToD
8vhd$e
	MaxLeng.
o0Bpwp
IUpM>2
(yHplp
\%$%%S
lbVnd\
/NHoPi
 9|Y4v
l28!#l:
O=U0;}
]\ "07z!
pFu2M|
BUTTON
(u!I+|
g'3%zyt$E
HW$gO[
LISTBOXn
%jO-H$"f
Rj!W$.
=EMU]e<
yl8daI
7IE(AL("%s",4),"
,3)" JK1*Hma3.)
_WINHELP
7@l<Q"
o"y17t
;A)hMG
}blu$@
Wheeli
s]4shB>
XOWSEWE
pH"Gla
'HSplit
  $$?h
#(<tjZ
U?|H~DEp
hgb&Pm
nVH)x8
GHZqWMck
P^GJx!
$:BWe~
XLu7;Wx
	WGl38iK
hd#	XR
'JKT2TX
(aE4TcT
GH7W@E
r\@v;{Du
j K0(j
-$>h8?
Kaumx.
H+hI+^
+!L(b%
r7=@w0
,9(tf,
I@@7c#
G?g`!C
0n_5IV
kFa8l=u}
WcHG&W
Zn8#xt
nG#ul5
@t)%*H_J
i*&@H@H
eSPePW
q)DS'lwmi
HP;t@	
PDt1!n
p4;dBp
 |,;=,
m1g+ t%;
2 Mixx(C{
o|Q0bAx!{
0$_PXR"
x8TD+BPx
[Qz0A;
%tGz=(JrmF
G1[PW	
UcZV7.{
e"t"cu
*R	.YM
,Vx5nn
9;wlt4
#blK%%I
/!n?ds
pdZIX,
PH`?&0
vEFH%@
dYL9mb
Pe7bA 
f9;0u[8Y
S`dlCD
.P"S%%
D`.t+;
!J#Wmp'C
(+/< LC
PqR?b+
d7F@iX
sp0	GX6
;P8u+~
jJ82O!$=
w4DG0k
)A;,C3
GTke@B>
SZrK$A
Q|F4,5EC
1234567890ABC
FGHIJKLMNO@STU
VWXYZ_
UAAAOJ?
<J%E@))HMGFX
}AS=fE|
i'	Xpx
(<	X7n4
LShT>j]
W`X`FxK
$AF[7$7K
y5Cum 
QL5%s 
Hx!o8#i
hmC{':
enOW'<B
TXS@JC+
"uQ2cqAE
tXU{IJ
<+H|I<
z[W<,C
^p1Dco
U`k$B`
}:E, j
*C0564
Ih;J4u
(8(3#-
|t|86pE
5Hj!D&
+*Hz9	:	
s|JJx.60
Smodhm\
BThumb
MFrDvoim
Tr567r
;<bPh8
_;ayJ8	
	,y^TH
fcUsexD
HF\O+\
PixTsPf
Buffeq,
1k=AK>^7
ncz\qE
[-[qS#d;V
cXm t@
w@"CaX
4GDLLa
w0 CrH
Q\K(k(
F08j`U'
KF&dvw
4^rqk8
:^W&p.
f}%!$H
eN^GQ4
b#B-Zk
5!{+d[
t#;ADtiw
-%t8&i
!3H0p|+
>I,|FL=I
u8m\H+Y
0qxik`
FC`W 2
gb\aX|o
PyYQ07u!
)TIU_`
(C;*)`
PL04mH''|X
6i|O8u
VdNxnl
H\n	h6
7H1;sD
\p40]jV
?NsH/-
,tmx3t
87'w$t
C)	/C[
MAINIC
mG=a P
`t^.D 
)tZ!~Q
T (Zv{
r8VP0Ae
+WKxOR
==^W qx
`/NPy"
yPX+M 
miss]T
=!W"Hos
TTLExpi
l-]/$'
zWS2StubM'
QWh$(|
B.!"#B.
B.)*+B.
B.123B.
B.9:;B.
B.ABCB.
B.IJKB.
B.QRSB.
B.YZ[B.
B.abcB.
B.ijkB.
Blm|B.
noWSACgm
mVup,ac
A'WEzy
9M[K7Fe
l|/WEj;U
GWSAWa
~a5qL8
$o;3#Q
LOCALHOS
'127.0
Fc*2,0b
WQsAkj
rAZH?l
K!A(lc
s"eBm$
'9MoTue/Wedc?fJ
atJaFeb
ar/Apryw
`Global
r+Abty{
w^yD9Q
xp_V	.
Tl)rPI
InArDx
g[ P;Kd
=8' /4
94h7kB
fYu{Op41
5 tu$+
(5.`r"
-FO>jKu
sa?$UsM
G(;-|<
Gt xxX|
	kk'[M#"
h9i],n
7OAJiB
.8<I(w
pOBUOpx
	>{d	n
VB<TCPi
#	Mt##
rBgh4\
eC!yX<
QXk)fH
{pR&w/
nlj[n9e
()R mb"
&tE)yY*
Ax1$Mq
n0fx{%m.
X[Lc+'
-fiH1Sj&o
FPse[s
";{"$o
e[@52RQ
NZUH	Qi
wkat4i5
*m.+PZ
YvAva6
zb\E,-
QOTD8Z
o>ohD=
DOQOWIIAP
XS	gol
jQlP$N
u1>JAu#2
uBN-#$,
V*y$a;"}
%X|$#u
=oYZ!H;PG:
I$7iT]g_1
hC*(B,]W@pD
$H~"b\Ai
sX8O}	
:QdH/ Q 
tQh;p+/
ZXI.js
j1\Pb! 
BC2\h`
e\jHl+F
I*(|pq
6Gcn?O
tZr,US
@ZDZ6F
EFitWl
@pz4=KNAp
}o3li]
4Yk\8a
lHqj4]
lepenF
1~!Jp_
%AN>O7+
khmW	+I
\.(\,(
9x-dc3!
2glC{t
h|Ik	R
+Ux]f< (
pPAK`Ef
fnd;^~
l5hHP+
U~7{}$]
R/d}*D
Q8]V*@ d
J+pLjQ
2DG00+x
0U@hh8
D4^et?P
8aa-3 
RGkW75
g;y^CN
4. q$Jw'
(D4U$4
DK0LYw
Y59~;-
/%s\2?=|
,m,E$EUj;0V
Xzcz;5
 \'J~Z
061!S{ft
VWkTG_
G4:JQP
0mo1$q`
6C6=Fv(
j@hcZ`
$@=dNu
t^/kRC
{_S5h0
a5?Rp3b
^7%Z&=
CAx0tB
0Fz6+V
_BKeOL
#'@/pU
_YpsR*u
MZ*mFFj
t0 -2(
h0F"h8V	
L`\Cj<
]>IkGE
t#C|!X
$	C-&}
loxGnF]
Xd[hw&
bME82LO2tw4FZ9bfAKMjiUi4sydi
WZnPzqxjlNJaH
at 0>0\HP(
T\dlt|y
y 0<L`
<,4D\l
't$6t?
y d<8t
(4@LVC
#,_.wxNF
{o/?N_n'a+
QT7gd3$w
'1MQR'o
 3xME'
'4""C[
:L*y8Z?
yvJ"Q[Q
HDF&rP
c'?/&x
L3'L'L'91
Q!wq/N&
^KB}kk
{V1d	}
H)6[}n
$u+}1u
!UHEfG
Xu6d}Z/
JuUL,a
ZCUm|-
p!pz"H
]"Vb_5
~ T&l?_
fWZ V}b
^G"`9w
[3PZ$m
^'LWHM
I=	*YP
Ml;SY:z
)'fOu>
 B!IF4
QDf+%#
._%C/d
K\.p_9
*VcMbD
xR'_T}
|;3>3.
Iz_}o`
BxH^Jd
27hS7!]
S?N/?Sw
P)+sN@
zKc26zU
DhLxxny(}
zz{bbK
B_~BiPbO
LRxAVL8lD\}b
B6ZD_Z/
x}T/y+
|3# 4R7L
3dLK/?}
}ps\FY
3$!E-/Wv
nLAq/m
p'8I -
|D63;t$o
qxzB0z
,&#L9RRK
*\H?U4
M:S.mr
	[7{IF
iSIKk	7
p"b?$F
:2}-"c
T&@x>3
iwB3\"}
CV?PN5N
CuRL[u
`?oZPP;
7qU-E^
_u$"D+
v(hy\a
}B$~JF
'Jz_d*
#.9RLA
<KD[;3
2}N	 4d
7OtY,\
X[hte~
. *i2rt
RHYxfaBi=S
&>13_G
x}w?=&
?@?(>X
v}/<U1
.ebho	
g305'^X
EuRUT9lJ
Zb#!Wu
^IQAEcE^.
SiB'2}
\G}h=\
@Sb#|0
Pvj}"n
2D`m*|
2_/~uT
XX!jf(#%
HV-}6+
jL?v>6"
JGo[M}"
BB#OLZ
}hA+`p
("1HI?
Rv5"Cj
Z@D{f@ED
7$]8N[YS
b8Fho<
3|il,c
*wwqp/aVq
+c8-q;.
g>W7G(_
	dO{}w
P	\%cr
vuRpOt
yFeom8vw;
ia_A`E{x
E0TO./^
,9z0lOg
O3SdSn
x^ [ak
-GDkWhX
w#>'aqb
96DsoG
OJxaU#
5(U-S?/4
	KyGn/
,FW	?6b
Jvf/W(
wi;aGh
Us@>_p
]\.VS>tl
C!qA[6:
aZ;%z8
'/[Qu@pf
b_JSleep
MulDiv
lstrcpyA
Libraro
Ad]E.	
Fzl={Rx
iUeDY.
s	la4I]
ZEfHn-
U<u*'aYH&L
~Zb%~*
II tQu
7Uppw@
XPTPSW
KERNEL32.DLL
advapi32.dll
comctl32.dll
gdi32.dll
oleaut32.dll
user32.dll
version.dll
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
RegCloseKey
ImageList_Add
SaveDC
VariantCopy
VerQueryValueA