Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
KRoMX2011.exe

Overview

General Information

Sample name:KRoMX2011.exe
Analysis ID:1562272
MD5:ab4715b9fecfb81df1f1eabfb6fcc2ae
SHA1:0fed69a507959b8d4e53beedc84412ba76618622
SHA256:51a9c8fb452d0037be2fdb423126b58ced8ac23bc43a043afa531d47c69aa21d

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:60%

Signatures

PE file contains sections with non-standard names
Queries keyboard layouts
Uses 32bit PE files

Classification

Process Tree

  • System is w10x64_ra
  • KRoMX2011.exe (PID: 6984 cmdline: "C:\Users\user\Desktop\KRoMX2011.exe" MD5: AB4715B9FECFB81DF1F1EABFB6FCC2AE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: KRoMX2011.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: KRoMX2011.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: classification engineClassification label: clean1.winEXE@1/0@0/0
Source: KRoMX2011.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\KRoMX2011.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeFile read: C:\Windows\win.iniJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE GAZOWANIE SET MAG = 'A03' WHERE MAG = 'A-3';
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO S_CERT (NAZWA) VALUES ('Global Gap');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO SL_WOJEWODZTW (ID, NAZWA) VALUES (16, 'zachodniopomorskie');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE GAZOWANIE SET MAG = 'A10' WHERE MAG = 'A-10';
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO FORMA_WLASN (ID, NAZWA) VALUES ('G', 'Gospodarstwo Rodzinne');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO S_PJ (ID_S_PJ, NAZWA) VALUES ( 6, 'NO3');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE GAZOWANIE SET MAG = 'B09' WHERE MAG = 'B-9';
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE GAZOWANIE SET MAG = 'A09' WHERE MAG = 'A-9';
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE GAZOWANIE SET MAG = 'B03' WHERE MAG = 'B-3';
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO SL_WOJEWODZTW (ID, NAZWA) VALUES (10, 'podlaskie');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO SL_WOJEWODZTW (ID, NAZWA) VALUES (15, 'wielkopolskie');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO S_PJ (ID_S_PJ, NAZWA) VALUES ( 7, 'Obicia');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO S_JAKOSC_DST (ID, NAZWA) VALUES (0, 'Brak wyboru');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO S_PJ (ID_S_PJ, NAZWA) VALUES (12, 'Test');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO S_PJ (ID_S_PJ, NAZWA) VALUES (14, 'UWG');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO S_PJ (ID_S_PJ, NAZWA) VALUES ( 1, 'CUKRY');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE GAZOWANIE SET MAG = 'B06' WHERE MAG = 'B-6';
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE GAZOWANIE SET MAG = 'A06' WHERE MAG = 'A-6';
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO PA_PRD_ZAST (ID_TYP, NAZWA) VALUES (3, 'DW');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE BUNKRY SET NAZWA = 'P1' WHERE ID_BUNKRA = 1;
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE GAZOWANIE SET MAG = 'A07' WHERE MAG = 'A-7';
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO BUNKRY (NAZWA) VALUES ('P4');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE GAZOWANIE SET MAG = 'A04' WHERE MAG = 'A-4';
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE GAZOWANIE SET MAG = 'B04' WHERE MAG = 'B-4';
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE KONTRAH SET NIP_P = ' ' WHERE NIP_P IS NULL;
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE BUNKRY SET NAZWA = 'P2' WHERE ID_BUNKRA = 2;
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO S_PJ (ID_S_PJ, NAZWA) VALUES (15, 'Zanieczyszczenia');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO BUNKRY (NAZWA) VALUES ('B1');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE GAZOWANIE SET MAG = 'B07' WHERE MAG = 'B-7';
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO S_PROD (NAZWA) VALUES ('Przysnacki');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO S_PROD (NAZWA) VALUES ('standard');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO SL_WOJEWODZTW (ID, NAZWA) VALUES (11, 'pomorskie');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO S_CERT (NAZWA) VALUES ('Brak');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE BUNKRY SET NAZWA = 'P3' WHERE ID_BUNKRA = 3;
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO FORMA_WLASN (ID, NAZWA) VALUES ('P', 'Grupa Producencka');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO SL_WOJEWODZTW (ID, NAZWA) VALUES ( 4, 'lubuskie');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO SL_WOJEWODZTW (ID, NAZWA) VALUES ( 7, 'mazowieckie');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO ST_DOCEL(ID_ST_DOCEL, NAZWA, ID_KONTRAH, MAG) VALUES(0, 'BRAK WYBORU', '000', 'NPP');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO PREF_CENNIKI(ID, NAZWA) VALUES (0, 'Kontrahenci preferowani');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO S_PJ (ID_S_PJ, NAZWA) VALUES (11, 'Parch');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO S_PROD (NAZWA) VALUES ('Lidl');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE GAZOWANIE SET MAG = 'B01' WHERE MAG = 'B-1';
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO BUNKRY (NAZWA) VALUES ('B2');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE GAZOWANIE SET MAG = 'A08' WHERE MAG = 'A-8';
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE GAZOWANIE SET MAG = 'A01' WHERE MAG = 'A-1';
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE GAZOWANIE SET MAG = 'B08' WHERE MAG = 'B-8';
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO SL_WOJEWODZTW (ID, NAZWA) VALUES ( 9, 'podkarpackie');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO SL_WOJEWODZTW (ID, NAZWA) VALUES ( 3, 'lubelskie');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE GAZOWANIE SET MAG = 'B10' WHERE MAG = 'B-10';
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO SL_WOJEWODZTW (ID, NAZWA) VALUES ( 8, 'opolskie');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO PA_PRD_ZAST (ID_TYP, NAZWA) VALUES (2, 'O');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO PA_PRD_ZAST (ID_TYP, NAZWA) VALUES (4, 'DW (tylko ryflowane)');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO S_CERT (NAZWA) VALUES ('HACCP');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE GAZOWANIE SET MAG = 'B02' WHERE MAG = 'B-2';
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE GAZOWANIE SET MAG = 'A02' WHERE MAG = 'A-2';
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO S_PJ (ID_S_PJ, NAZWA) VALUES ( 4, 'Mycie');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO SL_WOJEWODZTW (ID, NAZWA) VALUES ( 2, 'kujawsko-pomorskie');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO S_PJ (ID_S_PJ, NAZWA) VALUES ( 8, 'Obite pow 10%');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE GAZOWANIE SET MAG = 'A05' WHERE MAG = 'A-5';
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO BUNKRY (NAZWA) VALUES ('B3');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO PA_PRD_ZAST (ID_TYP, NAZWA) VALUES (1, 'Z');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE GAZOWANIE SET MAG = 'B05' WHERE MAG = 'B-5';
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO S_PROD (NAZWA) VALUES ('Kettle');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO S_PJ (ID_S_PJ, NAZWA) VALUES ( 5, 'NO2');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO TYP_ROL(ID_TYP_ROL, NAZWA) VALUES('V', 'Vatowiec');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO PREF_CENNIKI(ID, NAZWA) VALUES (1, 'Kontrahenci niepreferowani');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO TERM_SKLADOW (ID, NAZWA) VALUES ('1', 'tymczasowe');
Source: KRoMX2011.exe, 00000000.00000000.1176246230.0000000000A9F000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO S_CERT (NAZWA) VALUES ('Euro Gap');
Source: KRoMX2011.exeString found in binary or memory: NATS-SEFI-ADD
Source: KRoMX2011.exeString found in binary or memory: NATS-DANO-ADD
Source: KRoMX2011.exeString found in binary or memory: JIS_C6229-1984-b-add
Source: KRoMX2011.exeString found in binary or memory: jp-ocr-b-add
Source: KRoMX2011.exeString found in binary or memory: JIS_C6229-1984-hand-add
Source: KRoMX2011.exeString found in binary or memory: jp-ocr-hand-add
Source: KRoMX2011.exeString found in binary or memory: ISO_6937-2-add
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: wsock32.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: usp10.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: msdart.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: riched20.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: msls31.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: dataexchange.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: d3d11.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: dcomp.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: duser.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: xmllite.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: atlthunk.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: xmllite.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeSection loaded: dxcore.dllJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000514-0000-0010-8000-00AA006D2EA4}\InprocServer32Jump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeWindow found: window name: TComboBoxJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: KRoMX2011.exeStatic PE information: More than 275 > 100 exports found
Source: KRoMX2011.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
Source: KRoMX2011.exeStatic file information: File size 11163648 > 1048576
Source: KRoMX2011.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x69e000
Source: KRoMX2011.exeStatic PE information: Raw size of .data is bigger than: 0x100000 < 0x11b600
Source: KRoMX2011.exeStatic PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x255a00
Source: KRoMX2011.exeStatic PE information: More than 200 imports for USER32.DLL
Source: KRoMX2011.exeStatic PE information: section name: .didata
Source: C:\Users\user\Desktop\KRoMX2011.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809Jump to behavior
Source: C:\Users\user\Desktop\KRoMX2011.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809Jump to behavior
Source: KRoMX2011.exe, 00000000.00000003.1817661816.000000000124A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Command and Scripting Interpreter		1
DLL Side-Loading		1
DLL Side-Loading		1
DLL Side-Loading		OS Credential Dumping1
Security Software Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS Memory1
File and Directory Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account Manager11
System Information Discovery		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1562272
Start date and time:2024-11-25 12:52:51 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 6s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultwindowsinteractivecookbook.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:11
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:KRoMX2011.exe
Detection:CLEAN
Classification:clean1.winEXE@1/0@0/0
Cookbook Comments:
  • Found application associated with file extension: .exe

Warnings

  • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
  • Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
  • Not all processes where analyzed, report is missing behavior information
  • VT rate limit hit for: KRoMX2011.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):6.727127180473803
TrID:
  • Win32 Executable (generic) a (10002005/4) 99.83%
  • Windows Screen Saver (13104/52) 0.13%
  • Generic Win/DOS Executable (2004/3) 0.02%
  • DOS Executable Generic (2002/1) 0.02%
  • VXD Driver (31/22) 0.00%
File name:KRoMX2011.exe
File size:11'163'648 bytes
MD5:ab4715b9fecfb81df1f1eabfb6fcc2ae
SHA1:0fed69a507959b8d4e53beedc84412ba76618622
SHA256:51a9c8fb452d0037be2fdb423126b58ced8ac23bc43a043afa531d47c69aa21d
SHA512:1e9fa7d480dbd37c122474b476624505c85bcfa9ef088857b29e12494e5e16e355e6017277a90d501782aec4028155e94a22f4cd52b7507b10c6036a2bf0bda7
SSDEEP:98304:SvaWYwHG/tQ2NbppBvOCsTO0E5vVigWYcE5fAYnsGGj2+Q2qtgqmv4KZNYhqC:FWYwmy0bj5vdW9u9IFqqqRONY
TLSH:26B66C1AB6469435C11A4B328D2BFF59203BB6B5AE318943BBF86F0D4FF16406D36247
File Content Preview:MZP.....................@......Pjr......................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon

Icon Hash:2c0f0909490dced2

Static PE Info

General

Entrypoint:0x402f2c
Entrypoint Section:.text
Digitally signed:false
Imagebase:0x400000
Subsystem:windows gui
Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:0x66AA2AD0 [Wed Jul 31 12:15:12 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:4
OS Version Minor:0
File Version Major:4
File Version Minor:0
Subsystem Version Major:4
Subsystem Version Minor:0
Import Hash:a340ebfe404142c752d716d96a3103da

Entrypoint Preview

Instruction
jmp 00007F69C87EF442h
bound di, dword ptr [edx]
inc ebx
sub ebp, dword ptr [ebx]
dec eax
dec edi
dec edi
dec ebx
nop
jmp 00007F69C928E4E1h
mov eax, dword ptr [00A9F09Fh]
shl eax, 02h
mov dword ptr [00A9F0A3h], eax
push edx
push 00000000h
call 00007F69C8E8A260h
mov edx, eax
call 00007F69C8E77C1Bh
pop edx
call 00007F69C8E77B3Dh
call 00007F69C8E77D6Ch
push 00000000h
call 00007F69C8E79ACDh
pop ecx
push 00A9F048h
push 00000000h
call 00007F69C8E8A23Ah
mov dword ptr [00A9F0A7h], eax
push 00000000h
jmp 00007F69C8E84628h
jmp 00007F69C8E79AFFh
xor eax, eax
mov al, byte ptr [00A9F091h]
ret
mov eax, dword ptr [00A9F0A7h]
ret
pushad
mov ebx, BCB05000h
push ebx
push 00000BADh
ret
mov ecx, 00000140h
or ecx, ecx
je 00007F69C87EF47Fh
cmp dword ptr [00A9F09Fh], 00000000h
jnc 00007F69C87EF43Ch
mov eax, 000000FEh
call 00007F69C87EF40Ch
mov ecx, 00000140h
push ecx
push 00000008h
call 00007F69C8E8A203h
push eax
call 00007F69C8E8A2C3h
or eax, eax
jne 00007F69C87EF43Ch
mov eax, 000000FDh
call 00007F69C87EF3EBh
push eax
push eax
push dword ptr [00A9F09Fh]
call 00007F69C8E84816h
push dword ptr [00A9F09Fh]

Data Directories

NameVirtual AddressVirtual Size Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT0x7e40000x1f8f.edata
IMAGE_DIRECTORY_ENTRY_IMPORT0x7df0000x3f89.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE0x7e60000x255a00.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
IMAGE_DIRECTORY_ENTRY_BASERELOC0xa3c0000x8f3c4.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
IMAGE_DIRECTORY_ENTRY_TLS0x7de0000x18.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IAT0x00x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x7e30000x9ff.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

Sections

NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
.text0x10000x69e0000x69e000dcf63415f8bacd9e7f418028ff6a219eunknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data0x69f0000x13e0000x11b6008269dfbca368bc7a07b1b16ff4672cfeFalse0.21815122546316718data5.584003321197942IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls0x7dd0000x10000x200bf619eac0cdf3f68d496ea9344137e8bFalse0.02734375data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata0x7de0000x10000x2000246e50196a7598e27a8f97aa6b23612False0.056640625data0.2147325177871819IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.idata0x7df0000x40000x40003933eb4a186f7ab38d0df1f90ced2234False0.31146240234375COM executable for DOS5.291034282785684IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didata0x7e30000x10000xa0079982fd1cc5b371d07a9133ce664b535False0.4046875data4.742187595087048IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata0x7e40000x20000x200082ddd38f7af6426b8c1a5c6e26d3c130False0.353759765625data5.610243176084246IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc0x7e60000x2560000x255a00f54e5093a80e2e92f5991880bd9d720cunknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc0xa3c0000x900000x8f400063610dbb3b33d8d29eb9c4d5b599b1fFalse0.6000559009598604data6.678681194083161IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

NameRVASizeTypeLanguageCountryZLIB Complexity
RT_CURSOR0x7e9ae80x134dataEnglishUnited States0.43506493506493504
RT_CURSOR0x7e9c1c0x134dataEnglishUnited States0.4642857142857143
RT_CURSOR0x7e9d500x134dataEnglishUnited States0.4805194805194805
RT_CURSOR0x7e9e840x134dataEnglishUnited States0.38311688311688313
RT_CURSOR0x7e9fb80x134dataEnglishUnited States0.36038961038961037
RT_CURSOR0x7ea0ec0x134dataEnglishUnited States0.4090909090909091
RT_CURSOR0x7ea2200x134Targa image data - RGB 64 x 65536 x 1 +32 "\001"EnglishUnited States0.4967532467532468
RT_CURSOR0x7ea3540x134dataRussianRussia0.38311688311688313
RT_CURSOR0x7ea4880x134dataRussianRussia0.3961038961038961
RT_CURSOR0x7ea5bc0x134dataRussianRussia0.3181818181818182
RT_CURSOR0x7ea6f00x134Targa image data - Map 64 x 65536 x 1 +32 "\001"EnglishUnited States0.38636363636363635
RT_BITMAP0x7ea8240x1d0Device independent bitmap graphic, 36 x 18 x 4, image size 360EnglishUnited States0.43103448275862066
RT_BITMAP0x7ea9f40x1e4Device independent bitmap graphic, 36 x 19 x 4, image size 380EnglishUnited States0.46487603305785125
RT_BITMAP0x7eabd80x1d0Device independent bitmap graphic, 36 x 18 x 4, image size 360EnglishUnited States0.43103448275862066
RT_BITMAP0x7eada80x1d0Device independent bitmap graphic, 36 x 18 x 4, image size 360EnglishUnited States0.39870689655172414
RT_BITMAP0x7eaf780x1d0Device independent bitmap graphic, 36 x 18 x 4, image size 360EnglishUnited States0.4245689655172414
RT_BITMAP0x7eb1480x1d0Device independent bitmap graphic, 36 x 18 x 4, image size 360EnglishUnited States0.5021551724137931
RT_BITMAP0x7eb3180x1d0Device independent bitmap graphic, 36 x 18 x 4, image size 360EnglishUnited States0.5064655172413793
RT_BITMAP0x7eb4e80x1d0Device independent bitmap graphic, 36 x 18 x 4, image size 360EnglishUnited States0.39655172413793105
RT_BITMAP0x7eb6b80x1d0Device independent bitmap graphic, 36 x 18 x 4, image size 360EnglishUnited States0.5344827586206896
RT_BITMAP0x7eb8880x1d0Device independent bitmap graphic, 36 x 18 x 4, image size 360EnglishUnited States0.39655172413793105
RT_BITMAP0x7eba580xc0Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colorsEnglishUnited States0.5208333333333334
RT_BITMAP0x7ebb180xe0Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colorsEnglishUnited States0.42857142857142855
RT_BITMAP0x7ebbf80xe0Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colorsEnglishUnited States0.4955357142857143
RT_BITMAP0x7ebcd80x5cDevice independent bitmap graphic, 6 x 11 x 1, image size 44EnglishUnited States0.391304347826087
RT_BITMAP0x7ebd340x5cDevice independent bitmap graphic, 6 x 11 x 1, image size 44EnglishUnited States0.532608695652174
RT_BITMAP0x7ebd900x5cDevice independent bitmap graphic, 6 x 11 x 1, image size 44EnglishUnited States0.4782608695652174
RT_BITMAP0x7ebdec0x5cDevice independent bitmap graphic, 6 x 11 x 1, image size 44EnglishUnited States0.5543478260869565
RT_BITMAP0x7ebe480x5cDevice independent bitmap graphic, 6 x 11 x 1, image size 44EnglishUnited States0.4673913043478261
RT_BITMAP0x7ebea40x46eDevice independent bitmap graphic, 28 x 13 x 24, image size 1094, resolution 2834 x 2834 px/mEnglishUnited States0.328042328042328
RT_BITMAP0x7ec3140x46eDevice independent bitmap graphic, 28 x 13 x 24, image size 1094, resolution 2834 x 2834 px/mEnglishUnited States0.3289241622574956
RT_BITMAP0x7ec7840x46eDevice independent bitmap graphic, 28 x 13 x 24, image size 1094, resolution 2834 x 2834 px/mEnglishUnited States0.40476190476190477
RT_BITMAP0x7ecbf40x46eDevice independent bitmap graphic, 28 x 13 x 24, image size 1094, resolution 2834 x 2834 px/mEnglishUnited States0.09435626102292768
RT_BITMAP0x7ed0640x46eDevice independent bitmap graphic, 28 x 13 x 24, image size 1094, resolution 2834 x 2834 px/mEnglishUnited States0.23721340388007053
RT_BITMAP0x7ed4d40x46eDevice independent bitmap graphic, 28 x 13 x 24, image size 1094, resolution 2834 x 2834 px/mEnglishUnited States0.29188712522045857
RT_BITMAP0x7ed9440x46eDevice independent bitmap graphic, 28 x 13 x 24, image size 1094, resolution 2834 x 2834 px/mEnglishUnited States0.1675485008818342
RT_BITMAP0x7eddb40x46eDevice independent bitmap graphic, 28 x 13 x 24, image size 1094, resolution 2834 x 2834 px/mEnglishUnited States0.2892416225749559
RT_BITMAP0x7ee2240x46eDevice independent bitmap graphic, 28 x 13 x 24, image size 1094, resolution 2834 x 2834 px/mEnglishUnited States0.2751322751322751
RT_BITMAP0x7ee6940x46eDevice independent bitmap graphic, 28 x 13 x 24, image size 1094, resolution 2834 x 2834 px/mEnglishUnited States0.30776014109347444
RT_BITMAP0x7eeb040x46eDevice independent bitmap graphic, 28 x 13 x 24, image size 1094, resolution 2834 x 2834 px/mEnglishUnited States0.2777777777777778
RT_BITMAP0x7eef740x46eDevice independent bitmap graphic, 28 x 13 x 24, image size 1094, resolution 2834 x 2834 px/mEnglishUnited States0.41887125220458554
RT_BITMAP0x7ef3e40xe0Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colorsEnglishUnited States0.38392857142857145
RT_BITMAP0x7ef4c40xc0Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colorsEnglishUnited States0.4947916666666667
RT_BITMAP0x7ef5840xc8Device independent bitmap graphic, 15 x 12 x 4, image size 960.48
RT_BITMAP0x7ef64c0x268Device independent bitmap graphic, 32 x 32 x 4, image size 512RussianRussia0.12012987012987013
RT_BITMAP0x7ef8b40xc8Device independent bitmap graphic, 15 x 12 x 4, image size 960.5
RT_BITMAP0x7ef97c0xc0Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colorsEnglishUnited States0.484375
RT_BITMAP0x7efa3c0xe0Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colorsEnglishUnited States0.42410714285714285
RT_BITMAP0x7efb1c0xc0Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colorsEnglishUnited States0.5104166666666666
RT_BITMAP0x7efbdc0xe0Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colorsEnglishUnited States0.5
RT_BITMAP0x7efcbc0xe8Device independent bitmap graphic, 16 x 16 x 4, image size 128EnglishUnited States0.4870689655172414
RT_BITMAP0x7efda40xc0Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colorsEnglishUnited States0.4895833333333333
RT_BITMAP0x7efe640xe0Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colorsEnglishUnited States0.3794642857142857
RT_ICON0x7eff440x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 640EnglishUnited States0.42473118279569894
RT_DIALOG0x7f022c0x52data0.7682926829268293
RT_DIALOG0x7f02800x52data0.7560975609756098
RT_STRING0x7f02d40x40cdata0.38706563706563707
RT_STRING0x7f06e00x43cdata0.4086715867158672
RT_STRING0x7f0b1c0x360data0.40625
RT_STRING0x7f0e7c0x3bcdata0.33472803347280333
RT_STRING0x7f12380x284data0.4798136645962733
RT_STRING0x7f14bc0x434data0.39776951672862454
RT_STRING0x7f18f00x3fcdata0.4068627450980392
RT_STRING0x7f1cec0x424data0.37169811320754714
RT_STRING0x7f21100x870data0.2986111111111111
RT_STRING0x7f29800x430data0.37033582089552236
RT_STRING0x7f2db00x43cdata0.3662361623616236
RT_STRING0x7f31ec0x338data0.4211165048543689
RT_STRING0x7f35240x4a4data0.4132996632996633
RT_STRING0x7f39c80x3f8data0.35236220472440943
RT_STRING0x7f3dc00x388data0.37831858407079644
RT_STRING0x7f41480x438data0.32314814814814813
RT_STRING0x7f45800x4a8data0.33053691275167785
RT_STRING0x7f4a280x284data0.4782608695652174
RT_STRING0x7f4cac0x238data0.40669014084507044
RT_STRING0x7f4ee40x48cdata0.36769759450171824
RT_STRING0x7f53700xb28data0.2706582633053221
RT_STRING0x7f5e980x7e4data0.2881188118811881
RT_STRING0x7f667c0x58cdata0.4070422535211268
RT_STRING0x7f6c080x41cdata0.3602661596958175
RT_STRING0x7f70240x530data0.2748493975903614
RT_STRING0x7f75540x448data0.3302919708029197
RT_STRING0x7f799c0x470data0.3653169014084507
RT_STRING0x7f7e0c0x3e0data0.31048387096774194
RT_STRING0x7f81ec0x350data0.39622641509433965
RT_STRING0x7f853c0x380Targa image data - Color 99 x 107 x 32 +68 +111 "z"0.43080357142857145
RT_STRING0x7f88bc0x34cdata0.4431279620853081
RT_STRING0x7f8c080xbcdata0.6170212765957447
RT_STRING0x7f8cc40x16cdata0.5384615384615384
RT_STRING0x7f8e300x2b8data0.4224137931034483
RT_STRING0x7f90e80x308data0.42396907216494845
RT_STRING0x7f93f00x438data0.36018518518518516
RT_STRING0x7f98280x370data0.37727272727272726
RT_STRING0x7f9b980x304data0.3393782383419689
RT_STRING0x7f9e9c0xe0data0.5535714285714286
RT_STRING0x7f9f7c0xbcdata0.526595744680851
RT_STRING0x7fa0380x370data0.42045454545454547
RT_STRING0x7fa3a80x4c8data0.27532679738562094
RT_STRING0x7fa8700x330data0.4227941176470588
RT_STRING0x7faba00x2e0data0.37907608695652173
RT_STRING0x7fae800x4d0data0.273538961038961
RT_STRING0x7fb3500x328data0.375
RT_STRING0x7fb6780x410data0.3971153846153846
RT_STRING0x7fba880x6f8data0.32230941704035876
RT_STRING0x7fc1800x478AmigaOS bitmap font "t", fc_YSize 29184, 21248 elements, 2nd "r", 3rd " "0.3269230769230769
RT_STRING0x7fc5f80x388data0.39601769911504425
RT_STRING0x7fc9800x330data0.36764705882352944
RT_STRING0x7fccb00x48cdata0.38917525773195877
RT_RCDATA0x7fd13c0x10data1.5
RT_RCDATA0x7fd14c0x2dataEnglishUnited States5.0
RT_RCDATA0x7fd1500x1601gzip compressed data, was "1", last modified: Fri May 12 13:25:59 2006, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 19254RussianRussia1.0019527782709037
RT_RCDATA0x7fe7540x801Delphi compiled form 'TADOParamFrm'0.3411420204978038
RT_RCDATA0x7fef580x219fDelphi compiled form 'TAUAccessFrm'0.32276054374346463
RT_RCDATA0x8010f80x295eDelphi compiled form 'TBOFrm'0.30056657223796035
RT_RCDATA0x803a580x9aaDelphi compiled form 'TDMFrm'0.26475343573160875
RT_RCDATA0x8044040x31e6Delphi compiled form 'TDMMagFrm'0.23602630342883982
RT_RCDATA0x8075ec0x7283Delphi compiled form 'TDMRozladFrm'0.21807948149411563
RT_RCDATA0x80e8700x3d24Delphi compiled form 'TDostawaFrm'0.23223869154101712
RT_RCDATA0x8125940x130Delphi compiled form 'TfrxDialogForm'0.7730263157894737
RT_RCDATA0x8126c40x46a2Delphi compiled form 'TfrxInheritErrorForm'0.14130074106846588
RT_RCDATA0x816d680x1162Delphi compiled form 'TfrxPageSettingsForm'0.3195505617977528
RT_RCDATA0x817ecc0x1c06Delphi compiled form 'TfrxPasswordForm'0.3826317256760524
RT_RCDATA0x819ad40x13cdDelphi compiled form 'TfrxPDFExportDialog'0.3355691457881239
RT_RCDATA0x81aea40xe44Delphi compiled form 'TfrxPreviewForm'0.37349397590361444
RT_RCDATA0x81bce80x1aca8Delphi compiled form 'TfrxPrintDialog'0.025406429977400308
RT_RCDATA0x8369900x3c5Delphi compiled form 'TfrxProgress'0.49844559585492226
RT_RCDATA0x836d580x8c6Delphi compiled form 'TfrxRTFExportDialog'0.4536954585930543
RT_RCDATA0x8376200x5fbDelphi compiled form 'TfrxSearchDialog'0.44546048334421945
RT_RCDATA0x837c1c0x1f1fDelphi compiled form 'TGazNaglSzFrm'0.2967239864440818
RT_RCDATA0x839b3c0x2945Delphi compiled form 'TGazSzFrm'0.29417889256980595
RT_RCDATA0x83c4840x4b0Delphi compiled form 'TGetDTFrm'0.49
RT_RCDATA0x83c9340x2d9dDelphi compiled form 'TKontrahHDZDstOLstFrm'0.36267877023208017
RT_RCDATA0x83f6d40x156f0Delphi compiled form 'TKontrahHDZFrm'0.18188445416438856
RT_RCDATA0x854dc40x239dDelphi compiled form 'TKontrahHDZPomLstFrm'0.41724251398486345
RT_RCDATA0x8571640x3fecDelphi compiled form 'TKontrahHDZPowielFrm'0.26515521877291615
RT_RCDATA0x85b1500x4e4bDelphi compiled form 'TKontrahHDZSzFrm'0.22681235344010378
RT_RCDATA0x85ff9c0x1a036Delphi compiled form 'TKontrahKDOFrm'0.1532238385734397
RT_RCDATA0x879fd40xdd29Delphi compiled form 'TKontrahMagFrm'0.18886553508663476
RT_RCDATA0x887d000x8424Delphi compiled form 'TKontrahOCNFrm'0.2523944661227386
RT_RCDATA0x8901240xd334Delphi compiled form 'TKontrahPolaFrm'0.1892061848043205
RT_RCDATA0x89d4580x8ab2Delphi compiled form 'TKontrahRDJFrm'0.2681518616571847
RT_RCDATA0x8a5f0c0xb7e6Delphi compiled form 'TKontraktacjaFrm'0.20559497004970476
RT_RCDATA0x8b16f40x494Delphi compiled form 'TLoginDialog'0.48976109215017066
RT_RCDATA0x8b1b880x23b75Delphi compiled form 'TMagFrm'0.14520175264708496
RT_RCDATA0x8d57000x20eeDelphi compiled form 'TMainDPSzFrm'0.2908659549228944
RT_RCDATA0x8d77f00x2c57Delphi compiled form 'TMainFrm'0.32164566998502336
RT_RCDATA0x8da4480xb18aDelphi compiled form 'TMainRapFrm'0.20433443344334434
RT_RCDATA0x8e55d40x5b9dDelphi compiled form 'TMenuRapFrm'0.2699015051379354
RT_RCDATA0x8eb1740x48f6Delphi compiled form 'TOProgramieFrm'0.6100760252703715
RT_RCDATA0x8efa6c0x3c4Delphi compiled form 'TPasswordDialog'0.4678423236514523
RT_RCDATA0x8efe300x33c68Delphi compiled form 'TRaportViewFrm'0.12260458712135501
RT_RCDATA0x923a980x9b3bDelphi compiled form 'TRDJLabSzFrm'0.2603991041546088
RT_RCDATA0x92d5d40x514cDelphi compiled form 'TRealizKontrRapFrm'0.2769556025369979
RT_RCDATA0x9327200x539fDelphi compiled form 'TRKontrahFrm'0.2953706731442986
RT_RCDATA0x937ac00x294dcDelphi compiled form 'TRKontrahRepFrm'0.10573353824329117
RT_RCDATA0x960f9c0x7c60Delphi compiled form 'TRKontrahSzFrm'0.23222361809045225
RT_RCDATA0x968bfc0x28c1Delphi compiled form 'TRolDstOdPJSzFrm'0.25860251126234063
RT_RCDATA0x96b4c00x68ddDelphi compiled form 'TRolDstOdSzFrm'0.2692493946731235
RT_RCDATA0x971da00x256dDelphi compiled form 'TRolKtrDodSzFrm'0.2807640121072957
RT_RCDATA0x9743100x31f7Delphi compiled form 'TRolKtrPozSzFrm'0.2521304041904464
RT_RCDATA0x9775080x2980Delphi compiled form 'TRolKtrSzFrm'0.28557981927710846
RT_RCDATA0x979e880x5f6cDelphi compiled form 'TRolMagKtrSzFrm'0.25257900769608643
RT_RCDATA0x97fdf40x3a8eDelphi compiled form 'TRolMagSzFrm'0.2541694462975317
RT_RCDATA0x9838840x3b03Delphi compiled form 'TRolOcenaSzFrm'0.24604487985701992
RT_RCDATA0x9873880x630eDelphi compiled form 'TRolPolaKtrSzFrm'0.2758103951415727
RT_RCDATA0x98d6980x27d5Delphi compiled form 'TRolPolaSzFrm'0.28939884279690103
RT_RCDATA0x98fe700xa3c0Delphi compiled form 'TRozladFrm'0.18556774809160306
RT_RCDATA0x99a2300x2608Delphi compiled form 'TRozladKatPDSzFrm'0.3146055875102712
RT_RCDATA0x99c8380x2264Delphi compiled form 'TRozladKLstFrm'0.43866424352567013
RT_RCDATA0x99ea9c0x14291Delphi compiled form 'TRozladSzFrm'0.15764680237838624
RT_RCDATA0x9b2d300x7233Delphi compiled form 'TRParJakNFrm'0.2590046177526937
RT_RCDATA0x9b9f640x2521Delphi compiled form 'TRParJakNSzFrm'0.2905839032088375
RT_RCDATA0x9bc4880x1fa3Delphi compiled form 'TRParJakPCSzFrm'0.29596246450179037
RT_RCDATA0x9be42c0xa6b7Delphi compiled form 'TRParJakPFrm'0.16994306333325523
RT_RCDATA0x9c8ae40x2d96Delphi compiled form 'TRParJakPPSzFrm'0.2686375321336761
RT_RCDATA0x9cb87c0x3525Delphi compiled form 'TRSrGazFrm'0.3298787210584344
RT_RCDATA0x9ceda40x1dc2Delphi compiled form 'TRSrGazSzFrm'0.30598582305066946
RT_RCDATA0x9d0b680xe4fDelphi compiled form 'TRUpdateFrm'0.6464646464646465
RT_RCDATA0x9d19b80x2354Delphi compiled form 'TSCenPrzechFrm'0.44803184431667403
RT_RCDATA0x9d3d0c0x4736Delphi compiled form 'TSDodOpFrm'0.30235874931431705
RT_RCDATA0x9d84440x2680Delphi compiled form 'TSDodOpSzFrm'0.27617694805194803
RT_RCDATA0x9daac40x41dbDelphi compiled form 'TSKatWarPFrm'0.3153805089269826
RT_RCDATA0x9deca00x1da9Delphi compiled form 'TSKatWarPSzFrm'0.30212037402871067
RT_RCDATA0x9e0a4c0x5f2bDelphi compiled form 'TSKodyTowFrm'0.2601485859705291
RT_RCDATA0x9e69780x33c3Delphi compiled form 'TSKodyTowSzFrm'0.2495660704852464
RT_RCDATA0x9e9d3c0x1b21Delphi compiled form 'TSLogFrm'0.36688264938804893
RT_RCDATA0x9eb8600x3545Delphi compiled form 'TSMcaDostFrm'0.3289579819608418
RT_RCDATA0x9eeda80x1d98Delphi compiled form 'TSMcaDostSzFrm'0.30174234424498414
RT_RCDATA0x9f0b400x4e24Delphi compiled form 'TSNazwPJFrm'0.29154169166166766
RT_RCDATA0x9f59640x2abeDelphi compiled form 'TSNazwPJSzFrm'0.27472125753975507
RT_RCDATA0x9f84240x2bfdDelphi compiled form 'TSplashFrm'0.9561317822573484
RT_RCDATA0x9fb0240x42d6Delphi compiled form 'TSPrefCenFrm'0.3108708357685564
RT_RCDATA0x9ff2fc0x1cfbDelphi compiled form 'TSPrefCenSzFrm'0.3154063890012131
RT_RCDATA0xa00ff80x41b1Delphi compiled form 'TSRGlebFrm'0.3133139085449248
RT_RCDATA0xa051ac0x1db9Delphi compiled form 'TSRGlebSzFrm'0.30555920620318044
RT_RCDATA0xa06f680x4192Delphi compiled form 'TSRKlasFrm'0.3129989276778268
RT_RCDATA0xa0b0fc0x1db3Delphi compiled form 'TSRKlasSzFrm'0.30606339602788374
RT_RCDATA0xa0ceb00x4206Delphi compiled form 'TSRolKlasaFrm'0.31339486451307536
RT_RCDATA0xa110b80x1dcbDelphi compiled form 'TSRolKlasaSzFrm'0.3057558673134915
RT_RCDATA0xa12e840x3695Delphi compiled form 'TSRRyzykFrm'0.334573820940385
RT_RCDATA0xa1651c0x1bbaDelphi compiled form 'TSRRyzykSzFrm'0.31882220343758805
RT_RCDATA0xa180d80x4422Delphi compiled form 'TSStDocelFrm'0.30673087948629746
RT_RCDATA0xa1c4fc0x1ffeDelphi compiled form 'TSStDocelSzFrm'0.2937728937728938
RT_RCDATA0xa1e4fc0x41c1Delphi compiled form 'TSTypProdFrm'0.3149171270718232
RT_RCDATA0xa226c00x1bb8Delphi compiled form 'TSTypProdSzFrm'0.318489289740699
RT_RCDATA0xa242780x2cc7Delphi compiled form 'TSZrodelFrm'0.39038646078687955
RT_RCDATA0xa26f400x1cf7Delphi compiled form 'TSZrodelSzFrm'0.3122049898853675
RT_RCDATA0xa28c380x78bbDelphi compiled form 'TUsersFrm'0.22234445271297765
RT_RCDATA0xa304f40x2865Delphi compiled form 'TUsersSzFrm'0.24968571704864134
RT_RCDATA0xa32d5c0x1fe9Delphi compiled form 'TWprMaseFrm'0.41963520626759704
RT_RCDATA0xa34d480xebcDelphi compiled form 'TWprNrDokFrm'0.4217921527041357
RT_RCDATA0xa35c040x1a70Delphi compiled form 'TWprNumKDOFrm'0.2575354609929078
RT_RCDATA0xa376740x385dDelphi compiled form 'TWprUbytkiFrm'0.3417423244854113
RT_GROUP_CURSOR0xa3aed40x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.25
RT_GROUP_CURSOR0xa3aee80x14Lotus unknown worksheet or configuration, revision 0x1RussianRussia1.3
RT_GROUP_CURSOR0xa3aefc0x14Lotus unknown worksheet or configuration, revision 0x1RussianRussia1.3
RT_GROUP_CURSOR0xa3af100x14Lotus unknown worksheet or configuration, revision 0x1RussianRussia1.3
RT_GROUP_CURSOR0xa3af240x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.3
RT_GROUP_CURSOR0xa3af380x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.25
RT_GROUP_CURSOR0xa3af4c0x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.3
RT_GROUP_CURSOR0xa3af600x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.3
RT_GROUP_CURSOR0xa3af740x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.3
RT_GROUP_CURSOR0xa3af880x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.3
RT_GROUP_CURSOR0xa3af9c0x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.3
RT_GROUP_ICON0xa3afb00x14dataEnglishUnited States1.2
RT_VERSION0xa3afc40x59cdataEnglishUnited States0.4192200557103064
RT_MANIFEST0xa3b5600x2caXML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.5028011204481793

Imports

DLLImport
ADVAPI32.DLLInitializeSecurityDescriptor, RegCloseKey, RegConnectRegistryW, RegCreateKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumKeyExW, RegEnumValueW, RegFlushKey, RegLoadKeyW, RegOpenKeyExW, RegQueryInfoKeyW, RegQueryValueExW, RegReplaceKeyW, RegRestoreKeyW, RegSaveKeyW, RegSetValueExW, RegUnLoadKeyW, SetSecurityDescriptorDacl
KERNEL32.DLLCloseHandle, CompareStringA, CompareStringW, CopyFileW, CreateEventW, CreateFileA, CreateFileMappingW, CreateFileW, CreateMutexW, CreateThread, DeleteCriticalSection, DeleteFileA, DeleteFileW, EnterCriticalSection, EnumCalendarInfoW, EnumResourceNamesW, EnumSystemLocalesW, ExitProcess, ExitThread, FileTimeToDosDateTime, FileTimeToLocalFileTime, FileTimeToSystemTime, FindClose, FindFirstFileW, FindNextFileW, FindResourceW, FormatMessageW, FreeLibrary, FreeResource, GetACP, GetCPInfo, GetCPInfoExW, GetCommandLineW, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetDateFormatW, GetDiskFreeSpaceW, GetDriveTypeW, GetEnvironmentStrings, GetEnvironmentStringsW, GetExitCodeThread, GetFileAttributesA, GetFileAttributesW, GetFileSize, GetFileType, GetFullPathNameW, GetLastError, GetLocalTime, GetLocaleInfoA, GetLocaleInfoW, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleW, GetOEMCP, GetPrivateProfileStringW, GetProcAddress, GetProcessHeap, GetProfileStringW, GetStartupInfoA, GetStartupInfoW, GetStdHandle, GetStringTypeA, GetStringTypeW, GetSystemDefaultLangID, GetSystemDefaultUILanguage, GetSystemInfo, GetSystemTimes, GetTempFileNameW, GetTempPathW, GetThreadLocale, GetThreadPriority, GetTickCount, GetTimeZoneInformation, GetUserDefaultLCID, GetUserDefaultUILanguage, GetVersion, GetVersionExA, GetVersionExW, GetVolumeInformationW, GlobalAddAtomW, GlobalAlloc, GlobalDeleteAtom, GlobalFindAtomW, GlobalFree, GlobalHandle, GlobalLock, GlobalSize, GlobalUnlock, HeapAlloc, HeapCreate, HeapDestroy, HeapFree, HeapSize, InitializeCriticalSection, InterlockedCompareExchange, InterlockedDecrement, InterlockedExchange, InterlockedIncrement, IsDBCSLeadByte, IsDBCSLeadByteEx, IsDebuggerPresent, IsValidLocale, LCMapStringA, LeaveCriticalSection, LoadLibraryA, LoadLibraryExW, LoadLibraryW, LoadResource, LocalAlloc, LocalFree, LockResource, MapViewOfFile, MoveFileW, MulDiv, MultiByteToWideChar, OpenEventW, OpenFileMappingW, OpenMutexW, QueryPerformanceCounter, RaiseException, ReadFile, ReleaseMutex, RemoveDirectoryW, ResetEvent, ResumeThread, RtlUnwind, SetConsoleCtrlHandler, SetCurrentDirectoryW, SetEndOfFile, SetErrorMode, SetEvent, SetFilePointer, SetHandleCount, SetLastError, SetThreadLocale, SetThreadPriority, SizeofResource, Sleep, SuspendThread, SwitchToThread, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryEnterCriticalSection, UnhandledExceptionFilter, UnmapViewOfFile, VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery, VirtualQueryEx, WaitForMultipleObjectsEx, WaitForSingleObject, WideCharToMultiByte, WriteFile, WritePrivateProfileStringW, lstrcmpW, lstrlenW
VERSION.DLLGetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW
WSOCK32.DLLWSACleanup, WSAStartup, gethostbyname, gethostname, inet_addr
WINSPOOL.DRVClosePrinter, DeviceCapabilitiesW, DocumentPropertiesW, EndDocPrinter, EndPagePrinter, EnumPrintersW, OpenPrinterW, StartDocPrinterW, StartPagePrinter, WritePrinter
COMCTL32.DLLFlatSB_GetScrollInfo, FlatSB_GetScrollPos, FlatSB_SetScrollInfo, FlatSB_SetScrollPos, FlatSB_SetScrollProp, ImageList_Add, ImageList_BeginDrag, ImageList_Copy, ImageList_Create, ImageList_Destroy, ImageList_DragEnter, ImageList_DragLeave, ImageList_DragMove, ImageList_DragShowNolock, ImageList_Draw, ImageList_DrawEx, ImageList_EndDrag, ImageList_GetBkColor, ImageList_GetDragImage, ImageList_GetIcon, ImageList_GetIconSize, ImageList_GetImageCount, ImageList_GetImageInfo, ImageList_LoadImageW, ImageList_Read, ImageList_Remove, ImageList_Replace, ImageList_ReplaceIcon, ImageList_SetBkColor, ImageList_SetIconSize, ImageList_SetImageCount, ImageList_SetOverlayImage, ImageList_Write, InitializeFlatSB, _TrackMouseEvent
COMDLG32.DLLChooseColorW, ChooseFontW, GetSaveFileNameW, PrintDlgW, GetOpenFileNameW
GDI32.DLLAbortDoc, AngleArc, Arc, ArcTo, BitBlt, Chord, CloseEnhMetaFile, CombineRgn, CopyEnhMetaFileW, CreateBitmap, CreateBrushIndirect, CreateCompatibleBitmap, CreateCompatibleDC, CreateDCW, CreateDIBSection, CreateDIBitmap, CreateEnhMetaFileW, CreateFontIndirectW, CreateHalftonePalette, CreateHatchBrush, CreateICW, CreatePalette, CreatePen, CreatePenIndirect, CreateRectRgn, CreateRoundRectRgn, CreateSolidBrush, DeleteDC, DeleteEnhMetaFile, DeleteObject, Ellipse, EndDoc, EndPage, EnumEnhMetaFile, EnumFontFamiliesExW, EnumFontsW, ExcludeClipRect, ExtCreatePen, ExtCreateRegion, ExtFloodFill, ExtTextOutA, ExtTextOutW, FrameRgn, GdiFlush, GetBitmapBits, GetBrushOrgEx, GetClipBox, GetClipRgn, GetCurrentObject, GetCurrentPositionEx, GetDIBColorTable, GetDIBits, GetDeviceCaps, GetEnhMetaFileBits, GetEnhMetaFileDescriptionW, GetEnhMetaFileHeader, GetEnhMetaFilePaletteEntries, GetFontData, GetNearestColor, GetNearestPaletteIndex, GetObjectW, GetOutlineTextMetricsA, GetOutlineTextMetricsW, GetPaletteEntries, GetPixel, GetRgnBox, GetStockObject, GetSystemPaletteEntries, GetTextColor, GetTextExtentExPointA, GetTextExtentExPointW, GetTextExtentPoint32A, GetTextExtentPoint32W, GetTextExtentPointW, GetTextMetricsW, GetViewportOrgEx, GetWinMetaFileBits, GetWindowOrgEx, IntersectClipRect, LineTo, MaskBlt, MoveToEx, PatBlt, Pie, PlayEnhMetaFile, PolyBezier, PolyBezierTo, PolyPolyline, Polygon, Polyline, RealizePalette, RectVisible, Rectangle, ResetDCW, ResizePalette, RestoreDC, RoundRect, SaveDC, SelectClipRgn, SelectObject, SelectPalette, SetAbortProc, SetBkColor, SetBkMode, SetBrushOrgEx, SetDIBColorTable, SetDIBits, SetEnhMetaFileBits, SetMapMode, SetMetaRgn, SetPixel, SetROP2, SetStretchBltMode, SetTextColor, SetViewportExtEx, SetViewportOrgEx, SetWinMetaFileBits, SetWindowExtEx, SetWindowOrgEx, StartDocW, StartPage, StretchBlt, StretchDIBits, TranslateCharsetInfo, UnrealizeObject
SHELL32.DLLShellExecuteExW, ShellExecuteW, Shell_NotifyIconW
USER32.DLLActivateKeyboardLayout, AdjustWindowRectEx, BeginPaint, CallNextHookEx, CallWindowProcW, CharLowerBuffW, CharLowerW, CharNextW, CharUpperBuffA, CharUpperBuffW, CharUpperW, CheckMenuItem, ChildWindowFromPoint, ClientToScreen, CloseClipboard, CopyIcon, CopyImage, CountClipboardFormats, CreateAcceleratorTableW, CreateCaret, CreateIcon, CreateMenu, CreatePopupMenu, CreateWindowExW, DefFrameProcW, DefMDIChildProcW, DefWindowProcW, DeleteMenu, DestroyCaret, DestroyCursor, DestroyIcon, DestroyMenu, DestroyWindow, DispatchMessageA, DispatchMessageW, DrawEdge, DrawFocusRect, DrawFrameControl, DrawIcon, DrawIconEx, DrawMenuBar, DrawTextExW, DrawTextW, EmptyClipboard, EnableMenuItem, EnableScrollBar, EnableWindow, EndMenu, EndPaint, EnumChildWindows, EnumClipboardFormats, EnumDisplayMonitors, EnumThreadWindows, EnumWindows, FillRect, FindWindowExW, FindWindowW, FrameRect, GetActiveWindow, GetCapture, GetCaretPos, GetClassInfoExW, GetClassInfoW, GetClassLongW, GetClassNameW, GetClientRect, GetClipboardData, GetCursor, GetCursorPos, GetDC, GetDCEx, GetDesktopWindow, GetDlgCtrlID, GetDlgItem, GetDoubleClickTime, GetFocus, GetForegroundWindow, GetIconInfo, GetKeyNameTextW, GetKeyState, GetKeyboardLayout, GetKeyboardLayoutList, GetKeyboardLayoutNameW, GetKeyboardState, GetLastActivePopup, GetMenu, GetMenuItemCount, GetMenuItemID, GetMenuItemInfoW, GetMenuState, GetMenuStringW, GetMessageExtraInfo, GetMessagePos, GetMessageTime, GetMonitorInfoW, GetParent, GetPropW, GetScrollBarInfo, GetScrollInfo, GetScrollPos, GetScrollRange, GetSubMenu, GetSysColor, GetSysColorBrush, GetSystemMenu, GetSystemMetrics, GetTopWindow, GetUpdateRect, GetWindow, GetWindowDC, GetWindowLongW, GetWindowPlacement, GetWindowRect, GetWindowTextW, GetWindowThreadProcessId, HideCaret, InflateRect, InsertMenuItemW, InsertMenuW, InvalidateRect, IsCharAlphaNumericW, IsCharAlphaW, IsChild, IsClipboardFormatAvailable, IsDialogMessageA, IsDialogMessageW, IsIconic, IsWindow, IsWindowEnabled, IsWindowUnicode, IsWindowVisible, IsZoomed, KillTimer, LoadBitmapW, LoadCursorW, LoadIconW, LoadKeyboardLayoutW, LoadStringW, LockWindowUpdate, MapVirtualKeyW, MapWindowPoints, MessageBeep, MessageBoxA, MessageBoxW, MonitorFromPoint, MonitorFromRect, MonitorFromWindow, MoveWindow, MsgWaitForMultipleObjects, MsgWaitForMultipleObjectsEx, OemToCharBuffA, OffsetRect, OpenClipboard, PeekMessageA, PeekMessageW, PostMessageW, PostQuitMessage, PtInRect, RedrawWindow, RegisterClassW, RegisterClipboardFormatW, RegisterWindowMessageW, ReleaseCapture, ReleaseDC, RemoveMenu, RemovePropW, ScreenToClient, ScrollWindow, ScrollWindowEx, SendDlgItemMessageW, SendMessageA, SendMessageW, SetActiveWindow, SetCapture, SetCaretPos, SetClassLongW, SetClipboardData, SetCursor, SetCursorPos, SetFocus, SetForegroundWindow, SetKeyboardState, SetMenu, SetMenuItemInfoW, SetParent, SetPropW, SetRect, SetScrollInfo, SetScrollPos, SetScrollRange, SetTimer, SetWindowLongW, SetWindowPlacement, SetWindowPos, SetWindowRgn, SetWindowTextW, SetWindowsHookExW, ShowCaret, ShowOwnedPopups, ShowScrollBar, ShowWindow, SystemParametersInfoW, TrackMouseEvent, TrackPopupMenu, TranslateMDISysAccel, TranslateMessage, UnhookWindowsHookEx, UnregisterClassW, UpdateWindow, ValidateRect, WaitMessage, WindowFromPoint, wsprintfA
OLE32.DLLCLSIDFromProgID, CoCreateGuid, CoCreateInstance, CoGetMalloc, CoInitialize, CoTaskMemAlloc, CoTaskMemFree, CoUninitialize, IsEqualGUID, OleInitialize, OleUninitialize, StringFromCLSID, StringFromGUID2
OLEAUT32.DLLCreateErrorInfo, GetErrorInfo, SafeArrayAccessData, SafeArrayCreate, SafeArrayGetElement, SafeArrayGetLBound, SafeArrayGetUBound, SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayRedim, SafeArrayUnaccessData, SetErrorInfo, SysAllocStringLen, SysFreeString, SysReAllocStringLen, SysStringLen, VariantChangeType, VariantClear, VariantCopy, VariantCopyInd, VariantInit

Exports

NameOrdinalAddress
@@Adoparam@Finalize30x4089bc
@@Adoparam@Initialize20x4089ac
@@Auaccess@Finalize50x40a1a4
@@Auaccess@Initialize40x40a194
@@Bo@Finalize70x40b0f0
@@Bo@Initialize60x40b0e0
@@Dm@Finalize90x40b2a4
@@Dm@Initialize80x40b294
@@Dmmag@Finalize110x40b3fc
@@Dmmag@Initialize100x40b3ec
@@Dmrozlad@Finalize130x40b560
@@Dmrozlad@Initialize120x40b550
@@Dostawa@Finalize150x40f7cc
@@Dostawa@Initialize140x40f7bc
@@Gaznaglsz@Finalize170x41003c
@@Gaznaglsz@Initialize160x41002c
@@Gazsz@Finalize190x411164
@@Gazsz@Initialize180x411154
@@Getdt@Finalize210x411a28
@@Getdt@Initialize200x411a18
@@Kontrahhdz@Finalize230x4168e4
@@Kontrahhdz@Initialize220x4168d4
@@Kontrahhdzdstolst@Finalize250x416ecc
@@Kontrahhdzdstolst@Initialize240x416ebc
@@Kontrahhdzpomlst@Finalize270x4178c4
@@Kontrahhdzpomlst@Initialize260x4178b4
@@Kontrahhdzpowiel@Finalize290x4183cc
@@Kontrahhdzpowiel@Initialize280x4183bc
@@Kontrahhdzsz@Finalize310x41b18c
@@Kontrahhdzsz@Initialize300x41b17c
@@Kontrahkdo@Finalize330x4207ec
@@Kontrahkdo@Initialize320x4207dc
@@Kontrahmag@Finalize350x424f60
@@Kontrahmag@Initialize340x424f50
@@Kontrahocn@Finalize370x42715c
@@Kontrahocn@Initialize360x42714c
@@Kontrahpola@Finalize390x42b618
@@Kontrahpola@Initialize380x42b608
@@Kontrahrdj@Finalize410x42d728
@@Kontrahrdj@Initialize400x42d718
@@Kontraktacja@Finalize430x4303d4
@@Kontraktacja@Initialize420x4303c4
@@Magazyny@Finalize450x445b0c
@@Magazyny@Initialize440x445afc
@@Main@Finalize470x44a638
@@Main@Initialize460x44a628
@@Maindpsz@Finalize490x44ac14
@@Maindpsz@Initialize480x44ac04
@@Mainrap@Finalize510x4566c0
@@Mainrap@Initialize500x4566b0
@@Menurap@Finalize530x47b328
@@Menurap@Initialize520x47b318
@@Oprogramiew@Finalize550x47b500
@@Oprogramiew@Initialize540x47b4f0
@@Raportview@Finalize570x48895c
@@Raportview@Initialize560x48894c
@@Rdjlabsz@Finalize590x48e188
@@Rdjlabsz@Initialize580x48e178
@@Realizkontrrap@Finalize610x49209c
@@Realizkontrrap@Initialize600x49208c
@@Rkontrah@Finalize630x493fd8
@@Rkontrah@Initialize620x493fc8
@@Rkontrahrep@Finalize650x497664
@@Rkontrahrep@Initialize640x497654
@@Rkontrahsz@Finalize670x498ad4
@@Rkontrahsz@Initialize660x498ac4
@@Roldstodpjsz@Finalize690x498f48
@@Roldstodpjsz@Initialize680x498f38
@@Roldstodsz@Finalize710x49a8f8
@@Roldstodsz@Initialize700x49a8e8
@@Rolktrdodsz@Finalize730x49b420
@@Rolktrdodsz@Initialize720x49b410
@@Rolktrpozsz@Finalize750x49c088
@@Rolktrpozsz@Initialize740x49c078
@@Rolktrsz@Finalize770x49de50
@@Rolktrsz@Initialize760x49de40
@@Rolmagktrsz@Finalize790x4a11b4
@@Rolmagktrsz@Initialize780x4a11a4
@@Rolmagsz@Finalize810x4a2a84
@@Rolmagsz@Initialize800x4a2a74
@@Rolocenasz@Finalize830x4a45b0
@@Rolocenasz@Initialize820x4a45a0
@@Rolpolaktrsz@Finalize850x4a715c
@@Rolpolaktrsz@Initialize840x4a714c
@@Rolpolasz@Finalize870x4a7bf4
@@Rolpolasz@Initialize860x4a7be4
@@Rozlad@Finalize890x4b5a3c
@@Rozlad@Initialize880x4b5a2c
@@Rozladkatpdsz@Finalize910x4b5f14
@@Rozladkatpdsz@Initialize900x4b5f04
@@Rozladklst@Finalize930x4b6d24
@@Rozladklst@Initialize920x4b6d14
@@Rozladsz@Finalize950x4c8f04
@@Rozladsz@Initialize940x4c8ef4
@@Rparjakn@Finalize970x4cb800
@@Rparjakn@Initialize960x4cb7f0
@@Rparjaknsz@Finalize990x4cc06c
@@Rparjaknsz@Initialize980x4cc05c
@@Rparjakp@Finalize1010x4cea9c
@@Rparjakp@Initialize1000x4cea8c
@@Rparjakpcsz@Finalize1030x4cef10
@@Rparjakpcsz@Initialize1020x4cef00
@@Rparjakppsz@Finalize1050x4cf4c0
@@Rparjakppsz@Initialize1040x4cf4b0
@@Rsrgaz@Finalize1070x4cfb30
@@Rsrgaz@Initialize1060x4cfb20
@@Rsrgazsz@Finalize1090x4cff98
@@Rsrgazsz@Initialize1080x4cff88
@@Rupdate@Finalize1110x4d0168
@@Rupdate@Initialize1100x4d0158
@@Scenprzech@Finalize1130x4d192c
@@Scenprzech@Initialize1120x4d191c
@@Sdodop@Finalize1150x4d2c78
@@Sdodop@Initialize1140x4d2c68
@@Sdodopsz@Finalize1170x4d37bc
@@Sdodopsz@Initialize1160x4d37ac
@@Skatwarp@Finalize1190x4d46ac
@@Skatwarp@Initialize1180x4d469c
@@Skatwarpsz@Finalize1210x4d4b1c
@@Skatwarpsz@Initialize1200x4d4b0c
@@Skodytow@Finalize1230x4d58f8
@@Skodytow@Initialize1220x4d58e8
@@Skodytowsz@Finalize1250x4d624c
@@Skodytowsz@Initialize1240x4d623c
@@Slog@Finalize1270x4d65b8
@@Slog@Initialize1260x4d65a8
@@Smcadost@Finalize1290x4d6c30
@@Smcadost@Initialize1280x4d6c20
@@Smcadostsz@Finalize1310x4d70a0
@@Smcadostsz@Initialize1300x4d7090
@@Snazwpj@Finalize1330x4d8148
@@Snazwpj@Initialize1320x4d8138
@@Snazwpjsz@Finalize1350x4d8640
@@Snazwpjsz@Initialize1340x4d8630
@@Splash@Finalize1370x4d86f8
@@Splash@Initialize1360x4d86e8
@@Sprefcen@Finalize1390x4d96c4
@@Sprefcen@Initialize1380x4d96b4
@@Sprefcensz@Finalize1410x4d9c34
@@Sprefcensz@Initialize1400x4d9c24
@@Srgleb@Finalize1430x4daa50
@@Srgleb@Initialize1420x4daa40
@@Srglebsz@Finalize1450x4daeb8
@@Srglebsz@Initialize1440x4daea8
@@Srklas@Finalize1470x4dbeb4
@@Srklas@Initialize1460x4dbea4
@@Srklassz@Finalize1490x4dc31c
@@Srklassz@Initialize1480x4dc30c
@@Srolklasa@Finalize1510x4dd34c
@@Srolklasa@Initialize1500x4dd33c
@@Srolklasasz@Finalize1530x4dd7c0
@@Srolklasasz@Initialize1520x4dd7b0
@@Srryzyk@Finalize1550x4de4c0
@@Srryzyk@Initialize1540x4de4b0
@@Srryzyksz@Finalize1570x4de92c
@@Srryzyksz@Initialize1560x4de91c
@@Sstdocel@Finalize1590x4df814
@@Sstdocel@Initialize1580x4df804
@@Sstdocelsz@Finalize1610x4dfc84
@@Sstdocelsz@Initialize1600x4dfc74
@@Stypprod@Finalize1630x4e08bc
@@Stypprod@Initialize1620x4e08ac
@@Stypprodsz@Finalize1650x4e0d2c
@@Stypprodsz@Initialize1640x4e0d1c
@@Szrodel@Finalize1670x4e1338
@@Szrodel@Initialize1660x4e1328
@@Szrodelsz@Finalize1690x4e17a4
@@Szrodelsz@Initialize1680x4e1794
@@Upddb@Finalize1710x52bfd4
@@Upddb@Initialize1700x52bfc4
@@Users@Finalize1730x52ea94
@@Users@Initialize1720x52ea84
@@Userssz@Finalize1750x52f9d8
@@Userssz@Initialize1740x52f9c8
@@Wprmase@Finalize1770x52ff90
@@Wprmase@Initialize1760x52ff80
@@Wprnrdok@Finalize1790x530434
@@Wprnrdok@Initialize1780x530424
@@Wprnumkdo@Finalize1810x530628
@@Wprnumkdo@Initialize1800x530618
@@Wprubytki@Finalize1830x532e40
@@Wprubytki@Initialize1820x532e30
@@Wspolne@Finalize1850x54b16c
@@Wspolne@Initialize1840x54b154
_ADOParamFrm1870xbba594
_AUAccessFrm1880xbba59c
_BOFrm1890xbba5a4
_DMFrm1900xbba5ac
_DMMagFrm1910xbba5b4
_DMRozladFrm1920xbba5bc
_DostawaFrm1930xbba5c4
_GazNaglSzFrm1940xbba5cc
_GazSzFrm1950xbba5d4
_GetDTFrm1960xbba5dc
_KontrahHDZDstOLstFrm1980xbba5ec
_KontrahHDZFrm1970xbba5e4
_KontrahHDZPomLstFrm1990xbba5f4
_KontrahHDZPowielFrm2000xbba5fc
_KontrahHDZSzFrm2010xbba604
_KontrahKDOFrm2020xbba60c
_KontrahMagFrm2030xbba614
_KontrahOCNFrm2040xbba61c
_KontrahPolaFrm2050xbba624
_KontrahRDJFrm2060xbba62c
_KontraktacjaFrm2070xbba634
_MagFrm2080xbba63c
_MainDPSzFrm2100xbba64c
_MainFrm2090xbba644
_MainRapFrm2110xbba654
_MenuRapFrm2120xbba65c
_OProgramieFrm2130xbba664
_RDJLabSzFrm2150xbba674
_RKontrahFrm2170xbba684
_RKontrahRepFrm2180xbba68c
_RKontrahSzFrm2190xbba694
_RParJakNFrm2340xbba70c
_RParJakNSzFrm2350xbba714
_RParJakPCSzFrm2370xbba724
_RParJakPFrm2360xbba71c
_RParJakPPSzFrm2380xbba72c
_RSrGazFrm2390xbba734
_RSrGazSzFrm2400xbba73c
_RUpdateFrm2410xbba744
_RaportViewFrm2140xbba66c
_RealizKontrRapFrm2160xbba67c
_RolDstOdPJSzFrm2200xbba69c
_RolDstOdSzFrm2210xbba6a4
_RolKtrDodSzFrm2220xbba6ac
_RolKtrPozSzFrm2230xbba6b4
_RolKtrSzFrm2240xbba6bc
_RolMagKtrSzFrm2250xbba6c4
_RolMagSzFrm2260xbba6cc
_RolOcenaSzFrm2270xbba6d4
_RolPolaKtrSzFrm2280xbba6dc
_RolPolaSzFrm2290xbba6e4
_RozladFrm2300xbba6ec
_RozladKLstFrm2320xbba6fc
_RozladKatPDSzFrm2310xbba6f4
_RozladSzFrm2330xbba704
_SCenPrzechFrm2420xbba74c
_SDodOpFrm2430xbba754
_SDodOpSzFrm2440xbba75c
_SKatWarPFrm2450xbba764
_SKatWarPSzFrm2460xbba76c
_SKodyTowFrm2470xbba774
_SKodyTowSzFrm2480xbba77c
_SLogFrm2490xbba784
_SMcaDostFrm2500xbba78c
_SMcaDostSzFrm2510xbba794
_SNazwPJFrm2520xbba79c
_SNazwPJSzFrm2530xbba7a4
_SPrefCenFrm2550xbba7b4
_SPrefCenSzFrm2560xbba7bc
_SRGlebFrm2570xbba7c4
_SRGlebSzFrm2580xbba7cc
_SRKlasFrm2590xbba7d4
_SRKlasSzFrm2600xbba7dc
_SRRyzykFrm2630xbba7f4
_SRRyzykSzFrm2640xbba7fc
_SRolKlasaFrm2610xbba7e4
_SRolKlasaSzFrm2620xbba7ec
_SStDocelFrm2650xbba804
_SStDocelSzFrm2660xbba80c
_STypProdFrm2670xbba814
_STypProdSzFrm2680xbba81c
_SZrodelFrm2690xbba824
_SZrodelSzFrm2700xbba82c
_SplashFrm2540xbba7ac
_UsersFrm2710xbba838
_UsersSzFrm2720xbba840
_WprMaseFrm2730xbba848
_WprNrDokFrm2740xbba850
_WprNumKDOFrm2750xbba858
_WprUbytkiFrm2760xbba860
__GetExceptDLLinfo10x402f85
___CPPdebugHook1860xa9f0ac

Possible Origin

Language of compilation systemCountry where language is spokenMap
EnglishUnited States
RussianRussia

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

General

Target ID:0
Start time:06:53:20
Start date:25/11/2024
Path:C:\Users\user\Desktop\KRoMX2011.exe
Wow64 process (32bit):true
Commandline:"C:\Users\user\Desktop\KRoMX2011.exe"
Imagebase:0x400000
File size:11'163'648 bytes
MD5 hash:AB4715B9FECFB81DF1F1EABFB6FCC2AE
Has elevated privileges:true
Has administrator privileges:true
Programmed in:Borland Delphi
Reputation:low
Has exited:true

Disassembly

⊘No disassembly