Sample details: c26a18962389b29e07873fb3f74e3a79 --

Hashes
MD5: c26a18962389b29e07873fb3f74e3a79
SHA1: 66a4591096b78b9724c9d69f30c026924fdcf196
SHA256: b266bf5879122f2a0ab8623f4c35bea290dab54acfe6e7c3ffde5dc09f75a630
SSDEEP: 12288:NZQ0DbdqA4r3FpkcyA3Jerv+JyyBPk8j//adVHOs+esTCmz+:LQ8bb45pkcyA3Jerv+Qn87Cda2mz
Details
File Type: PE32
Yara Hits
YRP/ASProtect_v123_RC1 | YRP/ASProtect_v12x_New_Strain_additional | YRP/Microsoft_Visual_Basic_v50 | YRP/ASProtect_v12x_New_Strain | YRP/ASProtect_v11_BRS | YRP/ASProtect_V2X_Registered_Alexey_Solodovnikov | YRP/ASProtect_133_21_Registered_Alexey_Solodovnikov | YRP/VMProtect_1704_phpbb3 | YRP/ASProtect_v12_additional | YRP/ASProtect_123_RC4_130824_Solodovnikov_Alexey | YRP/ASProtect_133_21_Registered_Alexey_Solodovnikov_additional | YRP/ASProtectSKE21xexeAlexeySolodovnikov | YRP/ASProtect13321RegisteredAlexeySolodovnikov | YRP/ASProtectv12xNewStrain | YRP/ASProtectv123RC1 | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/IsPacked | YRP/domain | YRP/contentis_base64 | YRP/keylogger | YRP/win_registry | YRP/suspicious_packer_section |
Strings
		This program must be run under Win32
.adata
	zY>ir
~O@,dRg
xVz[`	)
Wj+0=x
L0O|&`
YjirU/
Eh^$c7N&x
AWd<`:
]K{%Z]
~w0KfU
]AC(Tk
o2?xTcc
I};E6+y
+|M9Ne!$!t1
!]]9Db>
oRJaqDyV
f	u^At}
_.[ZW]
bk`-+3#
ZqDP%F
!	y*BR
z1_.3<
\@!Oq\2
&WA;m2=
>2cnoe
Ap&cgxiq
GyVa2T7dY
'2<.4T4
sR$Gr\
a-Pr1,
>|~@[k
!A.!{M
>m4DAC
U63@ L2
M)j/tl
gcO9&k
u<DWEB
2unoyNj
!)p"M"
&B3bW@(
EL?A70
fRLd~y
V*y>GC
5?Jh)Rs
wv<s$a
4U;U*c
x.lo^W
dvT^xI
F$Vl?#7
dN6@:'
G_{O':
.O,s~v
3mO`WUw
`uuXje
O!~7F>
`(t'@;U
&TS[od
?d JRD
cbCY@u
A|GW+^&a
xe]9(nfO
ACPu8#
}C3},[
oH&dH26
F7obTT
GPRi_Q
2P0P%|
?.Ni={w
ZqcTChN
Hsmu[T
E!UCoF
aw&?Wi=
!E]sY:s
rSd=@i
W&p#|O
A hW,+U
;BjbZL
+?0V4jg
KWtT]2p
tIbA65j
zqNL\o2
bn]tc[
U$2y)G~
	TK\P+x
n\nYar
a<c}v{
(_5~>.
'&D#Sb
=DMf[ Bf
bm=!::;	
6O!-Kc};
 |7A1Z
}kx4C"
Xnyu]0
1s^IZ5
W<Z+IbpH
xL?L#m
+7W;Tt
S`uvU{
9D?;rB
QNAa@#!
2n>0Xvf
XKv%_9B
"nTJ|`
5 NQ;7A
m(}cYu
w=107N
)#N.cdo
_e 6cM
G;hlmK
< 7bz\
62<>UU
5R	0{1PcS
ILsjF:GF'+F
w`E7.I
_AZ"<@O|'}
&:xCI|
 vm7~-
Mg7:4`
2I--e?7)
B>0~v=I-M
Q/AR.z
vz0{Gn
%	sXel
m7=tHC
oXH8lLZ
T{`kZv
WqhQ;"
CQgQa;>
#e<Ejn:C
+~vqEB
1w8<^B
07^ZSDP.
8xhAXiw
c+m5Sk
	A^1Gm3
$"[4tN
%>D$ K
AuZRx)!
>2)&)=
*B#AI@
	jbZU1
+qwT\a
rs=`pO
]Zz7K=O
mwx.	=
joBb:4#
S+vBjT
8~<jIfN
'/N2_8j
CNnM_5
v?k~X-
gbB"T9
}T/C$S
_afv"/I
Sz9RtS
V}^t+N
vY&6v0
,Re;9Y&
>=Iq|hv~j
z"RSDD
x\f"-2B
u0NN$Z
FZH[%Uv>
J1.O9y
2y#t?{
Mw^)fosi
H1{4+i
]qJ?T}Z
jVfqp^
vlr>]D
_Qd##a
.I<gu#'
B<J_2ZF,V
sUtEd0
oO5,!*
8j-Dvr'CkE
Lf+;BX
5qX;3x
`+|3Zt
c3IXt(
!!rRN0
KL+!ah
w6'Ff*
0S%"pB5i
H;QnvE7{
0fJ(Sv
TPkz0^c
#Zo/+T
sMt<r!
a6c}cp
TNy,MW
%q71q%
e|AH:=
~jI).C
pxD	V{pr
;'S	Ppx
e.Tv*D
+,]$kc
RgINB6
!NjbHAs)
8tQ@dJbr
C*51	]
k6>%Eu
5N-5.,
rs>c43!
 x!:&q
1/FE\?
B})}b*
pg?2"N
e SYY-[f
C]"DL;
<gYidK
`8}TZf
lkjt\h
'^	;\;<M
TLYQJj
Gq	-Zm
hxO>&L
WfzL*X
ughft{
!N.~ly
80bb\5
wQl`+g"
Wd[}7z
a'o^oM
?RW8Wz
0q.+%G
H`kQKZ"
n$"aru
+z]y\Z
(`)"OO'|t+
A& vUM
8\b6Zl
`gqOH|d8
<0%l,'|
^nR1|P
 kdUWA
><ri&ula
\g<p"|rK
#Um))8
Y>KHW^
]Y;G.~
ug$ J8
xviM61
%7aM6e
k>^~1|
f/Wj4 
!U=qYU
|v O/v
T`/SKcq
f".OP1
$iP 85(
rUABfc
(q\o}0
sjgmKyYO
|,Sj+!
cP^B|Y}?
r`*f#A
<f"_G<
ttSPDd<e
Y*By%7h
0<98VZ|
d]9Dwt
i(M.WG}
d\>#d	
%nEtX"
~)M5/w2[
tb^]3r7^9
Dx<u4J
@j5koG@(
*|j@6v
ErRPg`I
otkFT|
yzxq^y-
|zp@3	
<zdk0z
+sY.K7
pWkFLK
Y!>^mN
;E7god*
w6O{e8HO
*8/]#c
hV/*p6
XxiHzq
{H*DU1^
&e&d?]
_+oI#r
o:JH247
agsN	s
:^/r\&
F%`ff/
qB<Mnt/
#yv(Sh
9P1,;3
A#E%Rn
EM1K+y
'C	F6\
(aQE~B;,
9"&FB#
S4_?1m
:TO_9w
kr	2V`
&.Qz&sG#
SyOu4&
Xs4t.}>3u
L5A3<t
,#:0O~
FDwK9#
crAq1qX+z
Oe	(_%
z8nd(s
g&O;r6~
T[aP}M
+$RI=ZD"
Tn5akW@
FK(Pu7
8)J4FT
e@f:bd
*b0)q&
^VKh,F{
kjVS^("n
yJE.xcK")
-vT"sK
Ff:/hCJG
io0G,r
b7<8mZ\
aVE^V6
:g8GF$
_b-_1c
7@KL=z1H
zhwKy!
#*YOt]
`>j9[R\
Fj2|r+&
;a.3((
6s(:-)__
SZuEMx=
kTT8^|
BqSR_r
`P pm.
u >A6D
|YKh5k
Fvf{2\
vq4U_W
rs7Ok7
WsH?n$
MIc&s$
g:]PmWv
eu-/2S
f6aM)I
dX0XmE
VWi`srhA
doG#*S
93>6(r
T"*H1C
@LqT!"z^o
+_0BMe
~k.&X>	
Lm4(,a
0+`vy?
2H'1L+
bU>yyG
$_{8fZ
6UFk7;
ESh@*6
BjcGqlJ
mWdPO5
kP4\;X)
_?36&9e
w-F\Be
3]D/;# 
7BM_nRftE
Gp#m[	
#=0<6P
T %N.[
^zxeV2
PDRfxJ
H$F/Kaf
Qo(/3Q
r.B_v*SH
~TQ#Cu#r
~a3~L_P
/!R;uT
?JQ%!U4
hAU}WQ
}`jwt$
hYG Sf
%O:bog
=H(A8a
wW6:EZ.
2"BV:|
6elip>
:Tk\pi
woevj(
8mOQ`Wf
_%t:5kyX
[P`J}H
|6(ZO2
l'E7	p
s0gsIg
e~F<-^
aPor'$
Xu&g<w
JR(K.5
VC{_rStv
v)jbs4
c`u{C&*
CcKr<Ax'
1$uY<3M
s:=XgSa
8zX({w
7W$W&w
7ja~(_S
<pN}H#W
<)+jw1
Ras{>^
ciBW.t
8<izfw06
SCvp]&
Nkia|r0
Og%i~\
}_Gt.H
 P'\a6
QvFfs 
3]^w PAn
L@-e{h
DF*f2E=
Vr>7.F
H$L}ia
O4zD5p
[4?Q:B
7p^ O+
}FeH3$
0Dn8L8
Bs}OBi
Pr&ukL
:N]2+	7
U'g5}f
x:b6=]
bW=^p`
qS*lXI
-Ge,yB
vu]YoC
<B#bXs
%P,GNj
by%Dnm
i{e$AL@
[a`oRw
!j.0bru
'D$9(Zd
:%,aAz
A$N<EX\
 "(x-7H
z(qfIDf
rxRa5M+'
{.+|5\
*-K-=8
+zj+)Nb#W
v	n[/3
dX<	rx
@x%Laig
+*	wNy
\@'ZKx,
1dh3`1 m
"S>6*!
}+ec%>!}
%2&1JAl
4iKbF~
^Z@;=z
	@R`Xs+
;0.A$8E
>Ljai<]
fi`o\>
	#2ka1
8=F^Au
z|0aID!0
+qCit=/
G3s5kf
4T1/	NQ
5>R'k-
>#J<zx<
#h'wcb,E
(f$a^s
#}21c#
?#qZlnC
]})9w_s
T~]&F=
x`Ecbl
4QiL(TL
xb:LUS:
Y& \$<
oJ5v1%
\Y.Ua"
^1h+U\
Zwju,0
e|A9-i
'`Xw|K
$_"v3/j
?3scDh
?.@giH
<E]Fx~J
eOE`4j
6u?T	jU
R&4Ru)
$YV@ei
W>=Cz>{"
Z{&]?n8
~VE=~K
.`n$`Z
d]'|U:
98A.l,
*`LHKt>(
'8>5$	
yeXFjL)
e,NOsi
JzApq7NxY
6OWsH'{
P!B%5f
']4][%
bt(y7r
&3'e5(
6}||Id@
&o8LJo
S>bV/e]8
CtF0i_Z
5N Q-d
uFo-+ 
2#LH	{L;
gEEuq;
y8")Cr
%,0S/^
Osi/7?
@Q(!	('{!
GOLO`G
O:SJQ2
a,`e7{
g(6Lvw
T_s<U!
Y|k;-N
.-6]+&
"]hZ] 
x$x~Li
uV30\k
HvVl74OT
^D	3QUU
RLp@'R
r^Vfe)2X
".og3"9nP
Dsm>+!
*S1){'
GxVK1r
!#}DYD
:cqTbZ
a[`P}L'
|J}K4E
%(7.hRv
9>O+'/A
[j`l>g
5R#l3J:|g
@Uqv#y
n7x2Coj
Fy^Aj&
aArSqw
IQtAj\-
bIZl~q
ZTTA:O	
IMHiwM
hP_Cf}
vj[A?5G
z>s8;@
7w)	i*>
ES!rM@
tNL(O_P0
m1VW+\
Pw>*YG
APo}9)
9V'j@@
a'W95,
Q/i}1u
qUxTef
UIeTBQ
,@+:*x:
Y2M	5rSb
5PW4pB
T0ymdxb
C^{90}
Sn\8biJy
<71y%(
)'QgmI:
v_5 <X
LFcQgQ
	"SW=1
[Dj/cK
rp(_*S
G<M(AY
$\,^XQ
zL'TB>`
7%m:g$UXY
H.||"H
vhe:h2
Y7_%2lWa
4+uj(x
Jn>/WjAZ
0}4f[M
'h&wXF
#fr7C0
1{Nt9UzY
{ oi;{=iOn 
P)_oOX
	6koOc|
	&xD=g
J*wylBd(
T.Y|x3
K*KF!pI?&-
omjk%O,NK
5k^w$g
<h`M#]YO
z?(A(:"
9e	3B1$
_&0:JWl
Eyn^kiS
i<g3vC
!V)^~*
6y!SSXq
fwy&97
42;bHjm
Z\*$vR]
mUURJ=
OhYDl,o
nRG|0cme
foY|],x
|1V[L!r
_-%L<]a
+4YhB7
1p{D'A
5%c^",
hq=cP3
tfItt H
87c"13
fx@5wg
{84/IU
aH*VY[9h~^
JJ>1/_
 3ohr|
w|61Th}&
gjM3-w
+C?en'
cc"h?Y
4o@+hE
(h7X`c
WlM]LH=
B.Zj">
Fr@3bG
rP@|r9
	hi+t^
hm\suP]`
*7^WQ&
Rz^hbs[
X?.V:V
"jlLW0
S8s{r_|e
4v'>`k'
,?5*BN
4;~*zn
J.Z7Hd$Y
*"6-O3
D:N5+|oD
X|JpC|
o 1V'My
 `B=EF~q
Z`[hQR
pBL/ t
rso;_u
@*1a 7
Z8=-JU
TZ&3Z0
0:8k/h
fJAoZc&b
4Mea{3
nJr=tVRa:
\t2S`[
*R52Q7
,RN!}<
TQ%X8x
`[ni'V
rD!k7z
^@vxXT
+b zs&
$|}7/u
57F>9+g
2_/M-T
?Pa[m.
[^SgIZ
FGhP	(
$+,V%y,$Rp
@8v7=x
{_r=ZT
QO/yRa+
,s>Ck;
4tpZ|)ka
>47;X~
A9i9Yy
0@_HD6
008]~q
7~KeC"z
 YiE \
G_yt_}4
-z,V4&
8Yxd4h
UJ}	i4(
iFrQWkP
3&Xa,e
zd?wU}E
qu2k}CY
0Ac-WxUvy
^;KO|J
=8Fy[R 
Bv&2yq
{n\7ye
1Fz%n5
mFVGeM
t)bD	"$("
'*Sdgu
4e;Bl'
r_kEx8
k'/s(P
L@6vNb&j'C
6mbD8>X"FP
UIcYXS
QvMxql
4U)|:c
Q:_W18
d^	RDF
oqNsi#[
)g^q]8
j|FuAu1
MDi	w(f
h_:'t%
}auaNc8{Q
wj7uT>w
Je3@W-
H{o),?
_HT(ZQ@
g@e[+u
4%yA0Vz5
$[lCbA
sV1s?a
L_AE88-Q
I2RGNHU
*giO`EtC
j51SkE
Jy!yKf
h}E9S}
k~*E6J
#4EH`]U
Tzj\2x
-/a?BV
_y^#(l
a,))nr
kUeAqfJ
3zX1*R
yg6V:8
thzBf^(
GzijcF
ry?2]7
j:fZP#
-Tnf()
-z#bb\
F*nQBn
}#q7iw}
#215,5fc
qsYhhob$Y
O{W)W)S
?sx4;BJ
I>B0U+7
kernel32.dll
GetProcAddress
GetModuleHandleA
LoadLibraryA
user32.dll
advapi32.dll
oleaut32.dll
advapi32.dll
version.dll
gdi32.dll
user32.dll
oleaut32.dll
comctl32.dll
winspool.drv
comdlg32.dll
shfolder.dll
oleaut32.dll
kernel32.dll
GetKeyboardType
RegQueryValueExA
SysFreeString
RegQueryValueExA
VerQueryValueA
UnrealizeObject
CreateWindowExA
SafeArrayPtrOfIndex
ImageList_SetIconSize
OpenPrinterA
PrintDlgA
SHGetFolderPathA
VariantChangeTypeEx
RaiseException
y/!WG&
LKogwP
...-.-..-..-..-..-..-..-..-..-...-..-..-..-..-..-..-..-..-.-
$4CR\_____0
"2?P\___________2
/>N\__\______________0
:NZ_______________________2
$__________________________2
QQPPPPPPPPPPPPPPPP0
$__________________________2
__________________>
$__________________________2
__________________?
$__________________________2
$__________________________2
$__________________________2
$__________________________2
$__________________________2
$__________________________2
__________________?
$_______________K:58_______2
$_______W
2_______2
$________"
	W_______2
$________K
-________2
$_________
S________2
$_________G
&_________2
__________________?
$__________
Q_________2
$$$$$$AW$$$$$$$8__?
$__________C
"__________2
$___________
K__________2
$__________Y	
?__________2
$__________8
__________2
$__________
F_________2
WZYYYY__ZZZYYYZ\__?
$_________A
_________2
-----+FW--+-+-+?__?
$_________
I________2
$________K
"________2
$________)
Q_______2
$________>5/Q___-		)_______2
$_________________ZY_______2
QNQNQQW_QQQQNQNW__?
$__________________________2
444443HW3333444C__?
$__________________________2
$__________________________2
$__________________________2
$__________________________2
$__________________________2
GGGGGGP\HGHGHGGQ__?
$__________________________2
____\_____________?
$__________________________2
KKKKKHLKKKKKKKKKKK-
6FT_______________________2
)8GT_________________2
+9GW___________2
-:KZ_____2
v&&/bbbbbbbo&&&&&&&/o
bbbbbo/
o&&&&/
&/bbbb
bbbbbo/
&&&&&/bbb
rbbo&&&
&&&&&&&&&&&&&&&&bbbbbbbbbbbbbbbb&&&&&&&&&&&&&&&&bbbbbbbbbbbbbbbb&&&&&&&&&&&&&&&&bbbbbbbbbbbbbbbb&&&&&&(
&&&&&&&bbbbh
bbbbbbb&&&
&&&bbb
bbb&&&
&&&bbb
bbb&&&
&&&bbb
bbb&&&
&&&bbb
bbb&&&
&&&bbb
bbb&&&
&&&bbb
bbb&&&
&&&bbb
bbb&&&
&&&bbb
bbb&&&&(
&&&&&&&bbbbbbh
bbbbbbb&&&&&&&&&&&&&&&&bbbbbbbbbbbbbbbb&&&&&&&&&&&&&&&&bbbbbbbbbbbbbbbb&&&&&&&&&&&&&&&&bbbbbbbbbbbbbbbb
!H&1<B
XZ}l|y
&~W?$J
RE\Bor	la<n
UMaskV
uXez$Y
X#1L]'!
Tx^B 4
Por:ti
7W0`yw
", 8@A
jX{O%(l
*"^Yh1
!TDM-B
a=2\lf
kern0l32
LongPa
QH}B^D
0)\~Y{
d-4|s=
prlH9X0d"`#\
`4"0#,
Memory:
EDivB(
DpHtk;9l
BFaHod
c[D#2m)
=K{cXu
).c?'a
QJz};oi
,(t$N@
 !Rec_
L'<TQ$
Nz1=Jt
Y?={W5
m0),Wt
$	jA(5
h	mTg,
'Y$aCl
B'-"}N
E`f6u)
omIniF
jZ^S_0V
ansd@r
p& $i S
q'YQTh
@4vNX@*
#/P!~f
JKLMNOP.Q
yz0123
	u_~QX?m
h0 %2{
7=;%	}
HJ=|n_
C?PY$]
t4!8;UQ
@_*eoL
	xL@^/
vrn=;L
a'tc.|-
o?kb}xW
lo#pyt
.Cache 
Obta1{
 <7ACY
256ToM
Int: L8
?S r}9x<c
sk#C}:
M\"Hd$
VBC`~%
l:-	np
egist\
GCOpot
Hbp\^RaIrX
_K{>}B
Bxy4 v,z
10:Bhm
&'00@K
 s3w%rq)
PActiNv
`I|#uZ
u(IfFN
\Z$M;EX
t*#@q1B~x<
fes8-al
9rhHE%
\ "	'D0	9
(R) 9or
ouwi q\W
ansm;etg
RX1u<Ix
adp*H$
Z_Yz[PX
u7r2yS
|$WN42x
'RDC45
(8P'QR
GgL0"tM
kbq%eip
LO Us>
.With[
	!Sub*
fqrm@`Vg
uEip@)%
ZtCh#6
{s|J?.
 H@ce9fA
~,H0G8:`5
trgpC;	bw
uzgi{pU
'R[Q$&
sN3 {H
\3'sSY
&"P( U
U/&u7{
^ Y\Ps
T'he~@
SI"`J_
qCan-'t
f~HRq%
?RB>@=
${)Tk9
:CK=u)
jlQ]Z@^
VskHM7
(h=V,.
>RHAxL
R}8|^a
K>`+pB
3l]| tL
!)Q5r0
xC0>RQ
%@sFNJ
%2z	f$
-@\Zh	
@A/!>[
 !tGPb
Runtim
~~(&0"
wx(zv 
 dsi.Xkl
"05p`)
00"4NZ
Cri^Gca
]EBoxSH
IsB9"R
L'PGTgb
B'JGRgZ
z/|P~X
(0rBtl
!5r't/vR
#16AX9
x"z*L2
0'4GDgd
' G$g(
T'8<t{
r=tAvExI
zM|Q~U
@<T: :
VLV]3[
rTtX]`a
f:q;{<
wSt[He
J^V	=ro	
jr/tObq?
	@X\Oo
V|i~{]
f2jCg3k
R]@?/C
D|r9t=]
U4^'iD
wI}\?r
~:+;_<c}=
>k?o@s'wa
'0Ah8c(
<69_H-
FK[c0"
4r#t`]B
/?r;^*
*,n/,=
[^YjXbH
e%P`=[B
@8zyjS
s5E<uj
CfM)?ag
?brmuhSQo
G=C;^Y
+H~Mle
%a`FC/9
f4|4U11
438<W`+
5(	2p#
d{<&qR
*%D2pI
#z$X{8
('>	0)b
]Ns4%T(St
o-VAJ5
P={(9M
]9:_@##F
J@&uq)J
iP~Rr#
8\J"']y
0@Vq9]W
MT_ZY(F
,@a\?k
4 pXpS
n ~a,%	}
3Xe|0H
0;T/sfW
*}0Jcw
Iy!A	8
^Uw`=d$
|z{|tw
jYY-{O*
XI#[8l
p3;_WO
K<6.;@
UIbxlJ
T--~7[_
PzUj@4W$
\#SR;D