| Category | Package | Started | Completed | Duration | Logs | |||||
|---|---|---|---|---|---|---|---|---|---|---|
| FILE | dll | 2026-03-05 00:18:19 | 2026-03-05 00:22:45 | 266s |
|
|||||
| Reports | JSON | |||||||||
2026-03-05 02:28:18,340 [root] INFO: Date set to: 20260305T00:18:34, timeout set to: 200 2026-03-05 00:18:34,138 [root] DEBUG: Starting analyzer from: C:\vrp2u9om 2026-03-05 00:18:34,138 [root] DEBUG: Storing results at: C:\UfnHHQPorU 2026-03-05 00:18:34,138 [root] DEBUG: Pipe server name: \\.\PIPE\kLbvnJYYvB 2026-03-05 00:18:34,138 [root] DEBUG: Python path: C:\Python310 2026-03-05 00:18:34,154 [root] INFO: analysis running as an admin 2026-03-05 00:18:34,154 [root] INFO: analysis package specified: "dll" 2026-03-05 00:18:34,154 [root] DEBUG: importing analysis package module: "modules.packages.dll"... 2026-03-05 00:18:34,154 [root] DEBUG: imported analysis package "dll" 2026-03-05 00:18:34,154 [root] DEBUG: initializing analysis package "dll"... 2026-03-05 00:18:34,154 [lib.common.common] INFO: wrapping 2026-03-05 00:18:34,154 [lib.core.compound] INFO: C:\Users\cape\AppData\Local\Temp already exists, skipping creation 2026-03-05 00:18:34,154 [root] DEBUG: New location of moved file: C:\Users\cape\AppData\Local\Temp\sample.dll 2026-03-05 00:18:34,154 [root] INFO: Analyzer: Package modules.packages.dll does not specify a DLL option 2026-03-05 00:18:34,154 [root] INFO: Analyzer: Package modules.packages.dll does not specify a DLL_64 option 2026-03-05 00:18:34,154 [root] INFO: Analyzer: Package modules.packages.dll does not specify a loader option 2026-03-05 00:18:34,154 [root] INFO: Analyzer: Package modules.packages.dll does not specify a loader_64 option 2026-03-05 00:18:34,326 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser" 2026-03-05 00:18:34,576 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig" 2026-03-05 00:18:34,670 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise" 2026-03-05 00:18:34,748 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human" 2026-03-05 00:18:35,216 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops' 2026-03-05 00:18:35,232 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab' 2026-03-05 00:18:35,263 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw' 2026-03-05 00:18:35,529 [lib.api.screenshot] INFO: Please upgrade Pillow to >= 5.4.1 for best performance 2026-03-05 00:18:35,529 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots" 2026-03-05 00:18:35,560 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump" 2026-03-05 00:18:35,560 [root] DEBUG: Initialized auxiliary module "Browser" 2026-03-05 00:18:35,560 [root] DEBUG: attempting to configure 'Browser' from data 2026-03-05 00:18:35,592 [root] DEBUG: module Browser does not support data configuration, ignoring 2026-03-05 00:18:35,592 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"... 2026-03-05 00:18:35,607 [root] DEBUG: Started auxiliary module modules.auxiliary.browser 2026-03-05 00:18:35,607 [root] DEBUG: Initialized auxiliary module "DigiSig" 2026-03-05 00:18:35,607 [root] DEBUG: attempting to configure 'DigiSig' from data 2026-03-05 00:18:35,607 [root] DEBUG: module DigiSig does not support data configuration, ignoring 2026-03-05 00:18:35,623 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.digisig"... 2026-03-05 00:18:35,623 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature 2026-03-05 00:18:36,169 [modules.auxiliary.digisig] DEBUG: File is not signed 2026-03-05 00:18:36,169 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json 2026-03-05 00:18:36,169 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig 2026-03-05 00:18:36,185 [root] DEBUG: Initialized auxiliary module "Disguise" 2026-03-05 00:18:36,185 [root] DEBUG: attempting to configure 'Disguise' from data 2026-03-05 00:18:36,185 [root] DEBUG: module Disguise does not support data configuration, ignoring 2026-03-05 00:18:36,185 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"... 2026-03-05 00:18:36,185 [modules.auxiliary.disguise] INFO: Disguising GUID to fd7fc618-18f9-47ce-a04f-1a623f9008af 2026-03-05 00:18:36,185 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise 2026-03-05 00:18:36,185 [root] DEBUG: Initialized auxiliary module "Human" 2026-03-05 00:18:36,201 [root] DEBUG: attempting to configure 'Human' from data 2026-03-05 00:18:36,201 [root] DEBUG: module Human does not support data configuration, ignoring 2026-03-05 00:18:36,201 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"... 2026-03-05 00:18:36,201 [root] DEBUG: Started auxiliary module modules.auxiliary.human 2026-03-05 00:18:36,216 [root] DEBUG: Initialized auxiliary module "Screenshots" 2026-03-05 00:18:36,216 [root] DEBUG: attempting to configure 'Screenshots' from data 2026-03-05 00:18:36,216 [root] DEBUG: module Screenshots does not support data configuration, ignoring 2026-03-05 00:18:36,216 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"... 2026-03-05 00:18:36,216 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots 2026-03-05 00:18:36,216 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets" 2026-03-05 00:18:36,216 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data 2026-03-05 00:18:36,232 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring 2026-03-05 00:18:36,232 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"... 2026-03-05 00:18:36,232 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 656 2026-03-05 00:18:36,279 [lib.api.process] INFO: Monitor config for <Process 656 lsass.exe>: C:\vrp2u9om\dll\656.ini 2026-03-05 00:18:36,279 [lib.api.process] INFO: Option 'tlsdump' with value '1' sent to monitor 2026-03-05 00:18:36,388 [lib.api.process] INFO: 64-bit DLL to inject is C:\vrp2u9om\dll\hszJQNBp.dll, loader C:\vrp2u9om\bin\xpQbvRlb.exe 2026-03-05 00:18:38,607 [root] DEBUG: Loader: Injecting process 656 with C:\vrp2u9om\dll\hszJQNBp.dll. 2026-03-05 00:18:42,873 [root] DEBUG: 656: Python path set to 'C:\Python310'. 2026-03-05 00:18:42,873 [root] DEBUG: 656: Disabling sleep skipping. 2026-03-05 00:18:42,888 [root] DEBUG: 656: TLS secret dump mode enabled. 2026-03-05 00:18:43,201 [root] DEBUG: 656: RtlInsertInvertedFunctionTable 0x00007FF97FCC090E, LdrpInvertedFunctionTableSRWLock 0x00007FF97FE1D500 2026-03-05 00:18:43,216 [root] DEBUG: 656: Monitor initialised: 64-bit capemon loaded in process 656 at 0x00007FF95DDB0000, thread 3876, image base 0x00007FF794EB0000, stack from 0x000000A2778F1000-0x000000A277900000 2026-03-05 00:18:43,216 [root] DEBUG: 656: Commandline: C:\Windows\system32\lsass.exe 2026-03-05 00:18:43,498 [root] DEBUG: 656: Hooked 5 out of 5 functions 2026-03-05 00:18:43,498 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread. 2026-03-05 00:18:43,498 [root] DEBUG: Successfully injected DLL C:\vrp2u9om\dll\hszJQNBp.dll. 2026-03-05 00:18:43,607 [lib.api.process] INFO: Injected into 64-bit <Process 656 lsass.exe> 2026-03-05 00:18:43,607 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump 2026-03-05 00:18:49,529 [root] DEBUG: 656: TLS 1.2 secrets logged to: C:\UfnHHQPorU\tlsdump\tlsdump.log 2026-03-05 00:18:54,185 [root] INFO: Restarting WMI Service 2026-03-05 00:18:56,607 [root] DEBUG: package modules.packages.dll does not support configure, ignoring 2026-03-05 00:18:56,607 [root] WARNING: configuration error for package modules.packages.dll: error importing data.packages.dll: No module named 'data.packages' 2026-03-05 00:18:56,607 [lib.core.compound] INFO: C:\Users\cape\AppData\Local\Temp already exists, skipping creation 2026-03-05 00:18:56,873 [lib.api.process] INFO: Successfully executed process from path "C:\Windows\System32\rundll32.exe" with arguments ""C:\Users\cape\AppData\Local\Temp\sample.dll",#1" with pid 352 2026-03-05 00:18:56,888 [lib.api.process] INFO: Monitor config for <Process 352 rundll32.exe>: C:\vrp2u9om\dll\352.ini 2026-03-05 00:18:56,904 [lib.api.process] INFO: 32-bit DLL to inject is C:\vrp2u9om\dll\JcyqnZrz.dll, loader C:\vrp2u9om\bin\SlwveoB.exe 2026-03-05 00:18:57,076 [root] DEBUG: Loader: Injecting process 352 (thread 4516) with C:\vrp2u9om\dll\JcyqnZrz.dll. 2026-03-05 00:18:57,357 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT. 2026-03-05 00:18:57,357 [root] DEBUG: Successfully injected DLL C:\vrp2u9om\dll\JcyqnZrz.dll. 2026-03-05 00:18:57,372 [lib.api.process] INFO: Injected into 32-bit <Process 352 rundll32.exe> 2026-03-05 00:18:59,388 [lib.api.process] INFO: Successfully resumed <Process 352 rundll32.exe> 2026-03-05 00:19:00,091 [root] DEBUG: 352: Python path set to 'C:\Python310'. 2026-03-05 00:19:00,169 [root] DEBUG: 352: Disabling sleep skipping. 2026-03-05 00:19:00,169 [root] DEBUG: 352: Dropped file limit defaulting to 100. 2026-03-05 00:19:00,357 [root] DEBUG: 352: YaraInit: Compiled 44 rule files 2026-03-05 00:19:00,357 [root] DEBUG: 352: YaraInit: Compiled rules saved to file C:\vrp2u9om\data\yara\capemon.yac 2026-03-05 00:19:00,373 [root] DEBUG: 352: YaraScan: Scanning 0x008E0000, size 0x136e8 2026-03-05 00:19:00,373 [root] DEBUG: 352: Monitor initialised: 32-bit capemon loaded in process 352 at 0x736b0000, thread 4516, image base 0x8e0000, stack from 0x7a2000-0x7b0000 2026-03-05 00:19:00,373 [root] DEBUG: 352: Commandline: "C:\Windows\System32\rundll32.exe" "C:\Users\cape\AppData\Local\Temp\sample.dll",#1 2026-03-05 00:19:00,654 [root] DEBUG: 352: hook_api: LdrpCallInitRoutine export address 0x779A2A40 obtained via GetFunctionAddress 2026-03-05 00:19:00,795 [root] DEBUG: 352: hook_api: Warning - CreateProcessA export address 0x760A2D90 differs from GetProcAddress -> 0x73A422A0 (AcLayers.DLL::0xfd9d22a0) 2026-03-05 00:19:00,810 [root] DEBUG: 352: hook_api: Warning - CreateProcessW export address 0x760888E0 differs from GetProcAddress -> 0x73A424E0 (AcLayers.DLL::0xfd9d24e0) 2026-03-05 00:19:00,810 [root] DEBUG: 352: hook_api: Warning - WinExec export address 0x760CCF20 differs from GetProcAddress -> 0x73A427A0 (AcLayers.DLL::0xfd9d27a0) 2026-03-05 00:19:01,014 [root] WARNING: b'Unable to place hook on GetCommandLineA' 2026-03-05 00:19:01,029 [root] DEBUG: 352: set_hooks: Unable to hook GetCommandLineA 2026-03-05 00:19:01,045 [root] WARNING: b'Unable to place hook on GetCommandLineW' 2026-03-05 00:19:01,045 [root] DEBUG: 352: set_hooks: Unable to hook GetCommandLineW 2026-03-05 00:19:01,263 [root] DEBUG: 352: Hooked 630 out of 632 functions 2026-03-05 00:19:01,310 [root] DEBUG: 352: Syscall hook installed, syscall logging level 1 2026-03-05 00:19:01,326 [root] DEBUG: 352: RestoreHeaders: Restored original import table. 2026-03-05 00:19:01,326 [root] INFO: Loaded monitor into process with pid 352 2026-03-05 00:19:01,326 [root] DEBUG: 352: caller_dispatch: Added region at 0x008E0000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x008E5F1A, thread 4516). 2026-03-05 00:19:01,341 [root] DEBUG: 352: YaraScan: Scanning 0x008E0000, size 0x136e8 2026-03-05 00:19:01,341 [root] DEBUG: 352: ProcessImageBase: Main module image at 0x008E0000 unmodified (entropy change 0.000000e+00) 2026-03-05 00:19:01,638 [root] DEBUG: 352: InstrumentationCallback: Added region at 0x760924AC (base 0x76070000) to tracked regions list (thread 4516). 2026-03-05 00:19:01,654 [root] DEBUG: 352: ProcessTrackedRegion: Region at 0x76070000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\kernel32.dll is in known range, skipping 2026-03-05 00:19:02,451 [root] DEBUG: 352: InstrumentationCallback: Added region at 0x75C633EC (base 0x75B30000) to tracked regions list (thread 4516). 2026-03-05 00:19:02,451 [root] DEBUG: 352: ProcessTrackedRegion: Region at 0x75B30000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping 2026-03-05 00:19:02,763 [root] DEBUG: 352: DLL loaded at 0x73610000: C:\Windows\SYSTEM32\TextShaping (0x94000 bytes). 2026-03-05 00:19:04,123 [root] DEBUG: 352: DLL loaded at 0x740C0000: C:\Windows\system32\uxtheme (0x74000 bytes). 2026-03-05 00:19:04,357 [root] DEBUG: 352: DLL loaded at 0x75D50000: C:\Windows\System32\MSCTF (0xd4000 bytes). 2026-03-05 00:19:04,623 [root] DEBUG: 352: set_hooks_by_export_directory: Hooked 0 out of 632 functions 2026-03-05 00:19:04,638 [root] DEBUG: 352: DLL loaded at 0x74D40000: C:\Windows\SYSTEM32\kernel.appcore (0xf000 bytes). 2026-03-05 00:19:04,654 [root] DEBUG: 352: DLL loaded at 0x76C00000: C:\Windows\System32\bcryptPrimitives (0x5f000 bytes). 2026-03-05 00:19:04,716 [root] DEBUG: 352: DLL loaded at 0x73200000: C:\Windows\SYSTEM32\ntmarta (0x29000 bytes). 2026-03-05 00:19:04,732 [root] DEBUG: 352: DLL loaded at 0x73230000: C:\Windows\System32\CoreMessaging (0x9b000 bytes). 2026-03-05 00:19:04,763 [root] DEBUG: 352: DLL loaded at 0x73120000: C:\Windows\SYSTEM32\wintypes (0xdb000 bytes). 2026-03-05 00:19:04,779 [root] DEBUG: 352: DLL loaded at 0x732D0000: C:\Windows\System32\CoreUIComponents (0x27e000 bytes). 2026-03-05 00:19:04,779 [root] DEBUG: 352: DLL loaded at 0x73550000: C:\Windows\SYSTEM32\textinputframework (0xb9000 bytes). 2026-03-05 00:22:19,826 [root] INFO: Analysis timeout hit, terminating analysis 2026-03-05 00:22:19,826 [lib.api.process] INFO: Terminate event set for <Process 352 rundll32.exe> 2026-03-05 00:22:19,826 [root] DEBUG: 352: Terminate Event: Attempting to dump process 352 2026-03-05 00:22:19,826 [root] DEBUG: 352: DoProcessDump: Skipping process dump as code is identical on disk. 2026-03-05 00:22:19,842 [lib.api.process] INFO: Termination confirmed for <Process 352 rundll32.exe> 2026-03-05 00:22:19,842 [root] INFO: Terminate event set for process 352 2026-03-05 00:22:19,857 [root] INFO: Created shutdown mutex 2026-03-05 00:22:19,857 [root] DEBUG: 352: Terminate Event: monitor shutdown complete for process 352 2026-03-05 00:22:20,873 [root] INFO: Shutting down package 2026-03-05 00:22:20,873 [root] INFO: Stopping auxiliary modules 2026-03-05 00:22:20,873 [root] INFO: Stopping auxiliary module: Browser 2026-03-05 00:22:20,873 [root] INFO: Stopping auxiliary module: Human 2026-03-05 00:22:22,888 [root] INFO: Stopping auxiliary module: Screenshots 2026-03-05 00:22:23,435 [root] INFO: Finishing auxiliary modules 2026-03-05 00:22:23,435 [root] INFO: Shutting down pipe server and dumping dropped files 2026-03-05 00:22:23,451 [root] WARNING: Folder at path "C:\UfnHHQPorU\debugger" does not exist, skipping 2026-03-05 00:22:23,451 [root] INFO: Uploading files at path "C:\UfnHHQPorU\tlsdump" 2026-03-05 00:22:23,451 [lib.common.results] INFO: Uploading file C:\UfnHHQPorU\tlsdump\tlsdump.log to tlsdump\tlsdump.log; Size is 6576; Max size: 100000000 2026-03-05 00:22:23,467 [root] INFO: Analysis completed
| Name | Label | Manager | Started On | Shutdown On |
|---|---|---|---|---|
| win10x64 | win10x64 | KVM | 2026-03-05 00:18:19 | 2026-03-05 00:22:45 |
| File Name |
sample.dll
|
|---|---|
| File Type | PE32 executable (DLL) (GUI) Intel 80386, for MS Windows |
| File Size | 159744 bytes |
| MD5 | 0cf6e4d3833971977e610b59cb402522 |
| SHA1 | c226aa908267a64298beebc49f3ad03b18faf91b |
| SHA256 | eb90ab3c6321cbe8ec6763de4b880277b4120b739c8b88ebedea51cd0e097107 VT MWDB Bazaar |
| SHA3-384 | b4d373c5b16fc506f1e1f1a42e5252fccb87a2f00462d39a87b85161db76de3e4e16f53297b28e3c494c9c8879ec747b |
| CRC32 | 9C465382 |
| TLSH | T10DF3F0BBFCCD50A7D1CDE17B2476A90285EE0A1005BFD1AED0E9851A7CDA4E4272C71B |
| Ssdeep | 3072:li407ABdQi4hmUQmlOEz82seijlz9w/OFHPbICBXEEOwa/:wpiw8T5JFjrE3wa/ |
| Yara |
|
no!+d
qw\+H
@Madexcept@SysUtils_LoadPackage
@Madexcept@BcbMemcpy
Y4Sni
k)+Oe0
ShellExecuteExA
wi:!W
@Madexcept@RegisterBugReportPlugin$qqr27System@%AnsiStringT$us$i0$%t1pqqrv$20System@UnicodeStringo
mgkky
vB|fT
3H.k{0
>68:T
W<lGn
('H3vA
@Madexcept@UnregisterHiddenExceptionHandler$qqrpqqrx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v
$AGX0
b{gzr
I!=uMX^
dg6j4b
@Madexcept@RegisterBugReportPlugin$qqr27System@%AnsiStringT$us$i0$%t1pqqrx50System@%DelphiInterface$t22Madexcept@IMEException%$20System@UnicodeStringo
@$xp$23Madexcept@TExceptSource
@Madexcept@BcbExceptionHandler
comdlg32.dll
&iUS\
(e&!~
hhWAs
TextOutA
SqHgQ
fT{h;
TB[mR
@$xp$29Madnvassistant@TNVModalResult
@Madexcept@GetAllocatedMemory$qqrv
@Madexcept@CreateBugReport$qqr21Madexcept@TExceptTypep14System@TObjectpvuiuiuip8_CONTEXTo55System@%DelphiInterface$t27Madexcept@IMEModuleSettings%23Madexcept@TExceptSourcet2uit3
@Madexcept@BcbInitExceptBlockLDTC
}l\v-
@Madexcept@initialization$qqrv
@Madnvassistant@CreateAssistant$qqr27System@%AnsiStringT$us$i0$%px27System@%AnsiStringT$us$i0$%xi45System@%DelphiInterface$t17System@IInterface%
@Madnvbitmap@initialization$qqrv
Hw&YY
@Madstacktrace@StackTrace$qqrooop49System@%DynamicArray$t24Madstacktrace@TStackItem%pvoouiuit5ppvtbtb57System@%DelphiInterface$t29Madnvprgralert@IProgressAlert%uioot5popuitktjp52System@%DynamicArray$t27System@%AnsiStringT$us$i0$%%o
OjbQ=
H0RT8u
@Madexcept@DontReformatExcMsg
zMFX>
aEPW8@
=`g}zLde
X)h{p==
joJa'b
*)q:D
@Madlistprocesses@initialization$qqrv
i3f+%
pOvr`
a|X^K
D"!}Zt
> >0>88
S5Yn_
@$xp$24Madstacktrace@TStackItem
SQs(h
&Tt}!
IoorH4
N]i(F
kTUj2g
CI3'fC
,]P@k
@Madexcept@DetectConsole
@Madexcept@UnregisterExceptActionHandler$qqrynpqqr23Madexcept@TExceptActionx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v
@Madnvassistant@HandleContactFormProc
_xLIG
Gr3sW
@Madexcept@System_ExceptionHandler
MG%/V
"$32e
8%!^v
&OnhE
B)dR9I
@System@initialization$qqrv
@Madexcept@CheckExceptParams$qqrrp14System@TObjectrpvt2rp8_CONTEXT
XD4~`
)y:he
I,`\z9
,;F0s
x=6@D
ib)8G
@Madexcept@GetThreadName$qqrui
cQ)Rl
\K"]R#
4+5:mN
]>/eDr
/vN\S
@Madnvassistant@Finalization$qqrv
UWLh0)
-HRhlK
e^(D1
.rdata
pkCnT
@Madexcept@HiddenAutoMailing
_xhm,i>
USWXMTKV[\YZ]
/e!y{Ay
@Madexcept@Forms_TApplication_HandleException
@Madexcept@RegWriteStr$qqrui27System@%AnsiStringT$us$i0$%t2t2
4Z8sJ
@Madlistprocesses@GetProcessList$qqrv
@Madexcept@SaveBugReport$qqr27System@%AnsiStringT$us$i0$%ui49System@%DelphiInterface$t21Madexcept@IMESettings%
B\&p>
->:;m--9
@Madexcept@NewFields$qqrv
{SY8[
Hj* DTC
<v xp
I}V-/
@Madexcept@RegisterHiddenExceptionHandler$qqrynpqqrx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v19Madexcept@TSyncType
yEuJiC
=c,h[:
maddisasm_.bpl
@Madexcept@CGIApp_TCGIApplication_CGIHandleException
@Madexcept@ExpandVars$qqruir27System@%AnsiStringT$us$i0$%27System@%AnsiStringT$us$i0$%t3t3
R,BII
@Madexcept@HandleContactForm$qqr50System@%DelphiInterface$t22Madnvassistant@INVForm%24Madnvassistant@TNVAction50System@%DelphiInterface$t22Madnvassistant@INVItem%50System@%DelphiInterface$t22Madexcept@IMEException%
I%>F<GQA
;L|Jf VkIUW;s,/
@Madexcept@SendMapiMail$qqr27System@%AnsiStringT$us$i0$%t1t152System@%DelphiInterface$t24Madexcept@IMEAttachments%uioo49System@%DelphiInterface$t21Madexcept@IMESettings%
CreateWindowExA
wG)7m
>"ICr
?sG5sG
h|,CZ
V}"=j
M)No;
W@3iG
Y> jx
@Maddumpobj@DumpObj$qqrp14System@TObject
e!=?b
@Madexcept@Get9xResourceReport$qqrv
`jinmfe@D
<(tHW
@Madexcept@GetProgramUpTime$qqrv
@Madlistmodules@initialization$qqrv
e%a"pJ
@Madexcept@UnregisterBugReportPlugin$qqr27System@%AnsiStringT$us$i0$%
JuUOa
@\>bt!7
NN>?%
ls]se
EWlr(
[1]<{
7RQTaTt
]|0cb
0tm!z
~_"T\
L}b2#
@Madexcept@ResetFpuMode
Initialize
Oc2Xi
!"4(m
jT1}X
@Madexcept@MxLookup$qqr27System@%AnsiStringT$us$i0$%
P\nDMrL_
ksp0u
sWB<y
%~!2ZO
@Madexcept_@@GetPackageInfoTable$qqrv
|Ql|DIf
comctl32.dll
D365m
PB,<+*
[e|C2!
@$xp$22Madexcept@Madexcept__2
@Madmapfile@GetMyProcName$qqro
X~RH?l
3^^B/
wJ"h,5
}#}Bd
-Zr&UkN)O|E
4zMlj
>k<^L
CALIBRATE
%y+$=J
\1a^.
@Madexcept@ShowBugReportKey
I|/\(
]4|S[
@$xp$26Madnvassistant@INVCheckBox
@Madexcept@HyperJumpCallstack$qqr27System@%AnsiStringT$us$i0$%
U#4Nn
BBuo@
^P,}Q
~T0&z
@Madmapfile@TMapFile@FindSegment$qqropv
H_,f;
uB$<t
ElR0M6
qn}?|
[XPi+
P]E'@N
@Madexcept@CalibrateCode$qqrv
KGB-!
@$xp$26Madnvassistant@TOutputType
&U[Wv/
%:9%]
"G7w<zd6Cy
@$xp$23Madmapfile@_TMapFile@_2
@Maddisasm@initialization$qqrv
;n&3
@Madexcept@BcbThrowExceptionLDTC
Qe0ji
p^LGk
cWGBy
@Madexcept@AutoSendBugReport$qqr27System@%AnsiStringT$us$i0$%49System@%DelphiInterface$t21Madnvbitmap@INVBitmap%49System@%DelphiInterface$t21Madexcept@IMESettings%
@Madexcept@ImNotFrozen$qqrv
user32.dll
@$xp$24Madexcept@IMEAttachments
@Madexcept@ForceUtf8
N,(t&3%>
*'<4b}
@Madexcept@BcbPTerminate
@$xp$21Madnvbitmap@INVBitmap
!7#"5>
@$xp$23Madnvassistant@INVImage
XCtz*
G5*$n
>,?eL
@Madexcept@GetThreadList$qqrv
@Madlinkdisasm@initialization$qqrv
;y n}
@Madexcept@System_FinalizeUnits
@Madmapfile@TMapFile@FindLine$qqrpv
-_q_uY!
@Madexcept@System_InitUnits
@Madexcept@Qforms_TApplication_ShowException
@4v~a
@Madmapfile@Finalization$qqrv
R8I%(0
$MP(p
C/][zj
@Madexcept@CloseApplication$qqrv
@Madexcept@UnregisterHiddenExceptionHandler$qqrynpqqrx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v
LoadLibraryA
@Madexcept@DontHookThreads$qqrv
@Madexcept@MESettings$qqrpv
SHGetPathFromIDListA
ma$L{
-x.][
@3_By
H+`03
V,4Bc
/swa/t
7Lu,G
c(u4`
11-:$
AEy,(
B@!y`
.rsrc
mXURv&
@$xp$22Madnvassistant@INVItem
@Madmapfile@LoadMapFileEx$qqr27System@%AnsiStringT$us$i0$%o
wsprintfA
~M2!> z
F;M-\/
#W}N
xgtIv
P_PRn
@Madexcept@DecryptPassword$qqr27System@%AnsiStringT$us$i0$%t1t1
GDi%`Q
I"e}TS'pz
@Madnvprgralert@Finalization$qqrv
^)*<%
ZiL~8
@Madexcept@GetMemoryStatus$qqrv
@Madexcept@GetTSClientName$qqrv
rd)yj
@Madexcept@HttpUpload$qqr27System@%AnsiStringT$us$i0$%52System@%DelphiInterface$t24Madexcept@IMEAttachments%47System@%DelphiInterface$t19Madexcept@IMEFields%t1t1uit1uioo49System@%DelphiInterface$t21Madexcept@IMESettings%
@Madmapfile@CMapFileStreamDescriptor
mm*Mi5
mtoKS;
#dB-5
psgWh
B7Xs"
%F"I,
8ZTu(
drU#f
}6F$yA
XP.YQW
3`\n)
"+^b<(
Kq^~Q
gT}e=
p'mLHWI
B/^ep2
Iz0w4M
@Madexcept@MESettings$qqrv
9XRGX
t\%47A
ei}_9
@Madexcept@ProcessMainThreadId
v@YU#'
)=}i1g
:ftxO
madExcept_.bpl
LNl/t
b[pf,_|'m
T\Iu#
;>H>mfat
@$xp$27Madexcept@IMEModuleSettings
@Madexcept@RegisterExceptActionHandler$qqrynpqqr23Madexcept@TExceptActionx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v19Madexcept@TSyncType
bEY)XH
1sD(a
fA9)-
@$xp$24Madnvassistant@TNVAction
+BK9~
KUX y
@Madexcept@GetOsVersionString$qqrv
@Madlistprocesses@Finalization$qqrv
=yw-.
YGP'~
#!V@_$
@Madexcept@SetTopmost$qqruio
@Variants@initialization$qqrv
jl$3:
h}!>!G<B
^|YQ^W
A"3@J
>c0F.o
c*RBG
:jhty
ysjpM
(?k%b
(* K7
@Madstacktrace@Finalization$qqrv
=+<.?V
>;%"[
+z1^0
Pr;,>MT
D4l|M
vFQS:<
nd~Od6
@Maddumpobj@Finalization$qqrv
,p2?aX
7^zWU3l;
PACKAGEOPTIONS
PrintDlgW
9i#(h
@Madexcept@GetDisplayModeString$qqrv
&+,WA
@Madexcept@PauseFreezeCheck$qqro
8pKUV
dbxsW
}_u393:x
1/3204.)+*(
"YQ2]
D$$W3
"Uw!H!8
>9#dc[
.edata
Gm;z28:F
@Madexcept@MESettings$qqrui
@Madexcept@BcbCallTerminate
apt9E
X%h?^+
&X88Z
@Madexcept@OnExceptBoxCreate
m9riV`s
kc|`b
@Madexcept@SendBugReport$qqr27System@%AnsiStringT$us$i0$%49System@%DelphiInterface$t21Madnvbitmap@INVBitmap%ui49System@%DelphiInterface$t21Madexcept@IMESettings%
\W`0
4g,,8qGF
Ptn45E
@Madnvbitmap@LoadBitmap$qqr27System@%AnsiStringT$us$i0$%
k#U?0km:{;~
@$xp$30Madexcept@TExceptActionEventOO
@Madexcept@HttpExtensionProcNext
@Madexcept@RegisterExceptionHandler$qqrpqqrx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v19Madexcept@TSyncType22Madexcept@TExceptPhase
!+V] o
b]|{O
"LHklH
)Th*M
@+E/=
^WBWy
n'2C\q
3?dkh=
Yc |W
&0Gx|
@Madexcept@Plugins
7-7/#
-r`P+X
iw7;}.H
a,b%P
>2v^N
lnU8jZss/F
@xpZI1
r+v;V
XW&1]
@Madexcept@CloseAntiFreeze$qqrv
kernel32.dll
@Madexcept@InitAntiFreeze$qqrv
(08@P`p
&u;w{
jxz0p_
@Madexcept@Finalization$qqrv
@Madexcept@SmtpMailFrom
9{F9z
.adata
S8U[*
~0h=UP
GetModuleHandleA
3)b/I3
}+`S3
qf{E9
3wb,-
smX6/F"
ML<Nt
@Madexcept_@@PackageUnload$qqrv
@*)]U9
@Madexcept@OpenThread$qqruiui
\)$-PO
^rK$s
.)$O4
,K6+2
iS/{M~Fd
GWwh{O3
f7!O6e
yd=7aH
C65ge
H]u~j
ENvKH
EXCEPT
q~`H
=!G]r.
877,.)9
[=cJ"
VirtualAlloc
6M)>I
-oFYz
%$A(0e
t"VF t
.y#<<s
R~C[2
-$/L!
yw4?>vt
@Madmapfile@TMapFile@FindLine$qqrpvrpv
?+3mZI
-F_=$
l8ocaQ$1!
@Madexcept@GetThreadStackTrace$qqruiooop49System@%DynamicArray$t24Madstacktrace@TStackItem%57System@%DelphiInterface$t29Madnvprgralert@IProgressAlert%opuit8pop52System@%DynamicArray$t27System@%AnsiStringT$us$i0$%%
KrnpB
6}Bq.5
@Madexcept@PrintBugReport$qqr27System@%AnsiStringT$us$i0$%ui49System@%DelphiInterface$t21Madexcept@IMESettings%
m72y
@Madmapfile@TMapFile@Export$qqrooo
@Madstrings@initialization$qqrv
@Madcrypt@Decode$qqr27System@%AnsiStringT$us$i0$%
ltM:f&
TvGl$/i
@Madmapfile@TMapFile@FindPublic$qqri
@Madnvprgralert@NewProgressAlert$qqr27System@%AnsiStringT$us$i0$%uit1
W`$i#
@g~Yi
.data
@Madexcept@SysUtils_ShowException
,oB7&Q6
PABqXW
\T]EX>
{=TM=
c0.}0+
GWm#9GR
V[T^N
dM.kn
@Madexcept_@@PackageLoad$qqrv
zU=jz
@Sysconst@_SModuleAccessViolation
@Madstacktrace@BcbTermination@
=L? K
@Madexcept@PauseMadExcept$qqro
Q-or.
j55)+o
.text
V3_,^
vmImOS
Es!n[
7gfZK|M
WSACleanup
8"fqP3
@Madexcept@HookThreads$qqrv
.3)_kHI:
@Madexcept@SendSmtpMail$qqr27System@%AnsiStringT$us$i0$%t1t1t152System@%DelphiInterface$t24Madexcept@IMEAttachments%t1t1t1uiuioo49System@%DelphiInterface$t21Madexcept@IMESettings%
*@D<{o
RSMJ{BTA
QE-HbN
'-G+Z
\_1rI
mW%Q|
iPW4>
Ja=2z
U8][S
a#L|T"r$%
GetProcAddress
@Madstacktrace@initialization$qqrv
mEN'=
L"d\(-[
@$xp$27Madnvassistant@INVAssistant
@$xp$19Madmapfile@TMapFile
dna<6
@Madexcept@RegisterBugReportPlugin$qqr27System@%AnsiStringT$us$i0$%t1pqqrx50System@%DelphiInterface$t22Madexcept@IMEException%$27System@%AnsiStringT$us$i0$%o
F7uR+
$]icR
TWpMzjL
;T#{#
_a7g?
madbasic_.bpl
0H16L
<C)]o
@Madexcept@Classes_CheckSynchronize
@Madexcept@HttpUploadTimeout
+?f|z
@Madexcept@RegisterHiddenExceptionHandler$qqrpqqrx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v19Madexcept@TSyncType
\`j-Nk
eda][
@Madexcept@CloseAppExitCode
6'_lD
@Madexcept@ProxyServer
.>xL-9
@Madexcept@GetThreadCreatorAddr$qqrui
@Madexcept@DumbStackTrace
B!7bFb
Ll"o[
GaE6^
@Madexcept@BcbOrgMalloc
7<}O#
rG88Gj@
lb!!4
@Madexcept@SetFreezeTimeout$qqrui
;;F,s
shell32.dll
@Madexcept@FillClipboard$qqr27System@%AnsiStringT$us$i0$%
B3bjh
O>9sU
;9f>/
@$xp$23Madnvassistant@INVLabel
JU-jZ
u?2}-/
@Madnvprgralert@initialization$qqrv
@Madnvbitmap@ScreenShot$qqro
({zs4
z&BT}
ju6x2O
dszx\^
$#o4?
@Madmapfile@TMapFile@$bctr$qqro27System@%AnsiStringT$us$i0$%uioo
@Madmapfile@FindMapFile$qqrpv
q3>':
aDq64P
)OeB@R6
aJvkz
QOil,
xC=}[
qDodI
@Madexcept@madTraceProcess$qqsi
@Madmapfile@TMapFile@
rVn_98
bR5?n
nAau=
@Madexcept@CalibrateData
SetSecurityDescriptorDacl
|fTQ8K
H<7l1
{^2qsJ
@Madexcept@RegisterExceptActionHandler$qqrpqqr23Madexcept@TExceptActionx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v19Madexcept@TSyncType
K,?|o
\S?o&
@Madnvassistant@OnAssistantCreate
@Madexcept@GetCpuCount$qqrv
6uTN\
wwf'x
The ordinal %u could not be located in the dynamic link library %s
ohNgc
X}"6H
V?j{%hh=
r QSw
Y.9Y]]
otg,:
.reloc
<k`b9P
@Madnvassistant@LoadAssistant$qqrui27System@%AnsiStringT$us$i0$%px27System@%AnsiStringT$us$i0$%xi45System@%DelphiInterface$t17System@IInterface%
:v/5(l
B`p-ay
IK%dO
_p}lwJ
P*0AF
#!k`Aky
6}?./
EMQ#e=k
@$xp$28Madstacktrace@BcbTermination
"oXqL
;F4s
PACKAGEINFO
<RNSI&
z%96W}Z
MessageBoxA
@$xp$19Madexcept@TMEDupDef
@'lHr*
*KnAB
x]~D#
The procedure entry point %s could not be located in the dynamic link library %s
pPV0Y
`2\ko
@GetPackageInfoTable
+f}t]
Yze+j{
@Madexcept@RestartApplication$qqrv
`z!~Fz
ExitProcess
@$xp$24Madexcept@TMEShowSetting
yV^X2
+./b*
@Madexcept@GetOsLanguageString$qqrv
cl8s1
UA(u+JX
8>w{,
ck4)1J
rtl120.bpl
33333K
:XDI!8T:-
@Madexcept@DisAsmFunc
JL"UEl
t*wlc
madExcept 3.0k - www.madshi.net
Au@D{
E!m"yq!
S6.'3
0G>4?
@$xp$22Madexcept@TExceptPhase
@Madexcept@AmHttpServer
=7'&:?
@Madexcept@RegDelVal$qqrui27System@%AnsiStringT$us$i0$%t2
j,{oBO
CC>jp
LEqHk
#`QO}
@Madexcept@RegisterBugReportPlugin$qqr27System@%AnsiStringT$us$i0$%t1pqqrv$27System@%AnsiStringT$us$i0$%o
SGo/"
02(<!
jXM6%t
0>h}
gdi32.dll
(c2#'
@$xp$23Madmapfile@_TMapFile@_1
IuD&%
UJ&De*
AO+:f},
/.p35
N-@O_
pf'.!+qb3
2M,H)
f5H5n5
kxD'%
247QN
@$xp$19Madexcept@IMEFields
fN1>v
MlOZ&#
5@bq>\6am
@Madmapfile@TMapFile@FindPublic$qqro27System@%AnsiStringT$us$i0$%t2o
O!O=LR
@Madexcept@AddCmdLineToBugRep
DESCRIPTION
}JU>!
pvm2C
&]w4r
>6b)J
pR?~;
S_6 b
@Madexcept@SendShellMail$qqr27System@%AnsiStringT$us$i0$%t1t1
@Madnvassistant@HandleScreenshotFormProc
TMADEXCEPT
/+5h^
rn'ScLly
D=x;{cM
@$xp$24Madnvassistant@INVButton
@Madexcept@UnregisterExceptActionHandler$qqrpqqr23Madexcept@TExceptActionx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v
y=r{7!Z
@$xp$29Madnvprgralert@IProgressAlert
Pll<b)
\WwzV
3mj!g
+K1M,@
F1b#bN
advapi32.dll
c5}H^
@Madexcept@NoOnlineCheck
.itext
v=umX?SN
lrHW`$
zylBA
xH4tW
@Madexcept@SysUtils_InitializePackage
\%~dF
<T,A'
N8T<#"
Rq5s_
@Madstacktrace@InternalError$qqr27System@%AnsiStringT$us$i0$%oo
y\A[?vUi
@Madnvassistant@initialization$qqrv
Ycd3cch
x'@({
@Madstacktrace@StackAddrToStr$qqrpvoo
avHB`
6qx9Z
%/wxr#j
@$xp$19Madexcept@TSyncType
@$xp$21Madexcept@TExceptType
@Madmapfile@TMapFile@FindSegment$qqri
LOADER ERROR
,sRA~k]
cZ`l@
Ecp'HgU
|(Ri9
@$xp$22Madnvassistant@INVEdit
@$xp$30Madexcept@TBugReportCallbackOO
`5!`$
OAPvKn59
@$xp$22Madexcept@IMEException
@Madexcept@GetExceptBoxHandle$qqrv
qVJmq
uA,>\
?0rtv
@Madexcept@Ebp$qqrv
@Madexcept@HandleException$qqr21Madexcept@TExceptTypep14System@TObjectpvouiuip8_CONTEXT23Madexcept@TExceptSourcet2uip27System@%AnsiStringT$us$i0$%
>R:f{
n6pnT
EUmy0OO
]8pu,
/+J1e
@Madexcept@GetCpuName$qqrv
@Madexcept@NewException$qqr21Madexcept@TExceptTypep14System@TObjectpvouiuiuip8_CONTEXT55System@%DelphiInterface$t27Madexcept@IMEModuleSettings%23Madexcept@TExceptSourcet2uit3o
@Madtools@initialization$qqrv
@Madzip@Zip$qqr20System@UnicodeStringpx20System@UnicodeStringxix45System@%DynamicArray$t20System@UnicodeString%
@$xp$25Madstacktrace@TStackTrace
RY9x,
Up^']
>J{{{
h!y}>xi
;h1kZ
@Madexcept@GetCrashStackTrace$qqrooop49System@%DynamicArray$t24Madstacktrace@TStackItem%57System@%DelphiInterface$t29Madnvprgralert@IProgressAlert%opuit7pop52System@%DynamicArray$t27System@%AnsiStringT$us$i0$%%
aUo1M
@Madexcept@ISAPIApp_TISAPIApplication_ISAPIHandleException
=w`y<
@Madstacktrace@FastMM_LogStackTrace$qqrpvipcoooo
f*N82!
jolZeXk
JlXPj
3O'fk
m8vl+
4#}gGtc
fx.HJ
@Madlisthardware@GetHardwareList$qqrv
@Madexcept@Esp$qqrv
nvaAR]
Finalize
{ `&[
@Madexcept@Qforms_TApplication_HandleException
IFB3J
vMlNZ
99Vg6
@Madexcept@RegisterExceptionHandler$qqrynpqqrx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v19Madexcept@TSyncType22Madexcept@TExceptPhase
@$xp$23Madexcept@TExceptAction
HtzBo;C<
@Madexcept@PutAssisIntoBugReport$qqr55System@%DelphiInterface$t27Madnvassistant@INVAssistant%50System@%DelphiInterface$t22Madexcept@IMEException%
@Madmapfile@initialization$qqrv
@Madnvbitmap@Finalization$qqrv
h8KQGr
B.K0)
@$xp$24Madexcept@TExceptEventOO
$NjPZ6
a0KaI
@Madlistmodules@GetModuleList$qqrv
ZaNt|I,t
@Madexcept@Forms_TApplication_ShowException
}MaI:
@$xp$20Madmapfile@TMfPublic
K&4#d}
NCq7~;1
cdablkpohg
"0J:b
@Madexcept@DontUseProxy
ZLR.\
@Typinfo@initialization$qqrv
,$27\8
^|nl2
y+:P|
I{jME
@Maddumpobj@initialization$qqrv
itz-+
@Madexcept@BcbHelper_GetIntraWebVersion$qqrpv
nX3/&
.idata
@Madlisthardware@initialization$qqrv
1GbQ9
qacTn
@Madexcept@NewAttachments$qqrv
\~pY?
Nz"@G
R({Cv
1$W_~
@Madexcept@IsUserAdmin$qqrv
@Madexcept@BugReportHtml
RWG>_M-
d[wvj
%/sn|
@Madexcept@UnregisterExceptionHandler$qqrpqqrx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v
mE1;E
}Nks>
{C.K~
@$xp$21Madexcept@IMESettings
|ItkI
]@41U
This program must be run under Win32
@Madexcept@AmOnline$qqro
V|KP&
lNR7E
c;pSa
q+DX:
onZrB
@Madmapfile@TMapFile@FindPublic$qqrpv
h)~/.
Smb_n
%i#fe
@Madstacktrace@PrepareStackTrace$qqruiuiuipvor52System@%DynamicArray$t27Madstacktrace@TPreStackItem%
.:Bj.2Bi
x]wvN
N.?v=
@Varutils@initialization$qqrv
@Madmapfile@LoadMapFile$qqr27System@%AnsiStringT$us$i0$%o
@Madexcept@RegReadStr$qqrui27System@%AnsiStringT$us$i0$%t2
;;%uh
@Sysutils@initialization$qqrv
B-5lr6
^iFO*
^6KSV
fx{mn_
@Madlinkdisasm@Finalization$qqrv
:p;c$
jVTO_
HaDOpG7/
<d~$yh
7S;2(\
@Madexcept@IsThreadSuspended$qqruiui
Z{b{m
@Madexcept@NameThread$qqrui27System@%AnsiStringT$us$i0$%
h<6}t
@$xp$19Madexcept@TMEButton
;ZPc&
@Madmapfile@GetMapFileInfos$qqrpvr27System@%AnsiStringT$us$i0$%t2t2rpvri
UW*;}E
@Madexcept@AutoSaveBugReport$qqr27System@%AnsiStringT$us$i0$%49System@%DelphiInterface$t21Madexcept@IMESettings%
rH=L*
_JoK`u
:cV}c
@Madexcept@FormatExceptMessage$qqr27System@%AnsiStringT$us$i0$%
b7qGP
pH=aHMk
@Madexcept@PauseMeEventually$qqrv
6_(UK
3n>b7
*W1Ws
@$xp$22Madexcept@Madexcept__1
tbCnZ
(a"gydU
#_rwL*E
l,tqq
E8@gR
x-#S(
ImageList_Destroy
Hv\>M
62GSL
#(dCYP
E2'_N
T9Z'j
-~81N
7E,[F
D}ePi
@$xp$22Madnvbitmap@TPngFormat
@Madexcept@GetSystemUpTime$qqrv
|VA]&
@$xp$23Madmapfile@_TMapFile@_3
d}z/;
^}=OCd
1#@mg
VirtualFree
EJj&e
g=JJ_
@Madexcept@PatchInt$qqrpvi
Jah"T
PP&`Ey
bDkns
a?O[%
T@2ky
C|'Jo
@Madexcept@GetThreadInfos$qqruiruit2t2t2riro
]Ok4dJ
: Xmy
@Madexcept@UnregisterExceptionHandler$qqrynpqqrx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v
)8QYf
=eN[^b
Wdu,0
oaZa\
?z?CU~
H"GIs
!\ 5C
@Madlisthardware@Finalization$qqrv
V\_Y.H
/}p9rWX
@$xp$21Madmapfile@TMfSegment
@$xp$22Madnvassistant@INVForm
@Madexcept@OnExceptBoxDestroy
@Madexcept_@initialization$qqrv
@Madlistmodules@Finalization$qqrv
(#Foc
.aspack
@Madtypes@MadException@$bctr$qqrx20System@UnicodeString
@$xp$29Madstacktrace@TDAPreStackItem
3Ucu>y
1^C%.
Uw 4:
;O\LF
GYdBX
_C;z h
@Madexcept@InstallUnhandledExceptionFilter$qqrv
wsock32.dll
fdpDQ
*pU'!*
W.ml1
@Madexcept@CMadExceptVersionString
eJ^(O
U1#Wfr
dyjWb
{Ng&=
lfQVm
>2B58u
/r{aOm
@Madexcept@PatchJmp$qqrpvt1
madTraceProcess
Q"nE|
%We5l
@Madexcept@HandleScreenshotForm$qqr50System@%DelphiInterface$t22Madnvassistant@INVForm%24Madnvassistant@TNVAction50System@%DelphiInterface$t22Madnvassistant@INVItem%50System@%DelphiInterface$t22Madexcept@IMEException%
Ai&'2keV
@Madexcept@System_runErrMsg
@Madexcept@DefaultBugReportHtml$qqr27System@%AnsiStringT$us$i0$%49System@%DelphiInterface$t21Madexcept@IMESettings%
| Name | RAW Addr | Virt Addr | Virt Size | Raw Size | Characteristics | Entropy |
|---|---|---|---|---|---|---|
| .text | 0x00000400 | 0x00001000 | 0x00043000 | 0x00019a00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 8.00 |
| .itext | 0x00019e00 | 0x00044000 | 0x00001000 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 6.49 |
| .data | 0x0001a000 | 0x00045000 | 0x00001000 | 0x00000400 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 6.45 |
| .bss | 0x0001a400 | 0x00046000 | 0x00001000 | 0x00000000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 0.00 |
| .idata | 0x0001a400 | 0x00047000 | 0x00006000 | 0x00001800 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 7.77 |
| .edata | 0x0001bc00 | 0x0004d000 | 0x00004000 | 0x00003c00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 5.60 |
| .rdata | 0x0001f800 | 0x00051000 | 0x00001000 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 0.61 |
| .reloc | 0x0001fa00 | 0x00052000 | 0x00004000 | 0x00002a00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 7.87 |
| .rsrc | 0x00022400 | 0x00056000 | 0x00004000 | 0x00003600 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 7.93 |
| .aspack | 0x00025a00 | 0x0005a000 | 0x00002000 | 0x00001600 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 5.95 |
| .adata | 0x00027000 | 0x0005c000 | 0x00001000 | 0x00000000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 0.00 |
| Name | Offset | Size | Language | Entropy | Type |
|---|---|---|---|---|---|
| MAD | 0x000561f0 | 0x00000014 | LANG_NEUTRAL | 3.54 | None |
| MAD | 0x00056204 | 0x000031ac | LANG_NEUTRAL | 7.98 | None |
| RT_RCDATA | 0x000593b0 | 0x00000044 | LANG_NEUTRAL | 5.72 | None |
| RT_RCDATA | 0x000593f4 | 0x000000ec | LANG_NEUTRAL | 7.00 | None |
| RT_RCDATA | 0x000594e0 | 0x0000009c | LANG_NEUTRAL | 6.40 | None |
| RT_RCDATA | 0x0005957c | 0x00000030 | LANG_NEUTRAL | 5.16 | None |
| Address | Name |
|---|---|
| 0x5985af5c | GetProcAddress |
| 0x5985af60 | GetModuleHandleA |
| 0x5985af64 | LoadLibraryA |
| Address | Name |
|---|---|
| 0x5985b25b | @System@initialization$qqrv |
| 0x5985b2c3 | @Sysconst@_SModuleAccessViolation |
| 0x5985b2db | @Typinfo@initialization$qqrv |
| 0x5985b2e3 | @Sysutils@initialization$qqrv |
| 0x5985b2eb | @Variants@initialization$qqrv |
| 0x5985b2f3 | @Varutils@initialization$qqrv |
| Address | Name |
|---|---|
| 0x5985b263 | CreateWindowExA |
| Address | Name |
|---|---|
| 0x5985b26b | TextOutA |
| Address | Name |
|---|---|
| 0x5985b273 | SetSecurityDescriptorDacl |
| Address | Name |
|---|---|
| 0x5985b27b | @Madtypes@MadException@$bctr$qqrx20System@UnicodeString |
| 0x5985b283 | @Madstrings@initialization$qqrv |
| 0x5985b293 | @Madtools@initialization$qqrv |
| Address | Name |
|---|---|
| 0x5985b28b | @Maddisasm@initialization$qqrv |
| Address | Name |
|---|---|
| 0x5985b2ab | ImageList_Destroy |
| Address | Name |
|---|---|
| 0x5985b2b3 | PrintDlgW |
| Address | Name |
|---|---|
| 0x5985b2bb | ShellExecuteExA |
| 0x5985b2d3 | SHGetPathFromIDListA |
| Address | Name |
|---|---|
| 0x5985b2cb | WSACleanup |
| Ordinal | Address | Name |
|---|---|---|
| 213 | 0x59816910 | @$xp$19Madexcept@IMEFields |
| 219 | 0x598166fc | @$xp$19Madexcept@TMEButton |
| 218 | 0x5981679c | @$xp$19Madexcept@TMEDupDef |
| 205 | 0x59816c1c | @$xp$19Madexcept@TSyncType |
| 18 | 0x59802448 | @$xp$19Madmapfile@TMapFile |
| 23 | 0x598022fc | @$xp$20Madmapfile@TMfPublic |
| 216 | 0x59816868 | @$xp$21Madexcept@IMESettings |
| 212 | 0x59816944 | @$xp$21Madexcept@TExceptType |
| 24 | 0x598022dc | @$xp$21Madmapfile@TMfSegment |
| 45 | 0x5980cf78 | @$xp$21Madnvbitmap@INVBitmap |
| 208 | 0x59816be4 | @$xp$22Madexcept@IMEException |
| 185 | 0x59816e14 | @$xp$22Madexcept@Madexcept__1 |
| 184 | 0x59816e34 | @$xp$22Madexcept@Madexcept__2 |
| 210 | 0x59816b00 | @$xp$22Madexcept@TExceptPhase |
| 60 | 0x5980fc28 | @$xp$22Madnvassistant@INVEdit |
| 55 | 0x5980fd88 | @$xp$22Madnvassistant@INVForm |
| 63 | 0x5980fb80 | @$xp$22Madnvassistant@INVItem |
| 46 | 0x5980cf18 | @$xp$22Madnvbitmap@TPngFormat |
| 203 | 0x59816cc4 | @$xp$23Madexcept@TExceptAction |
| 211 | 0x59816988 | @$xp$23Madexcept@TExceptSource |
| 22 | 0x5980231c | @$xp$23Madmapfile@_TMapFile@_1 |
| 21 | 0x5980234c | @$xp$23Madmapfile@_TMapFile@_2 |
| 20 | 0x5980237c | @$xp$23Madmapfile@_TMapFile@_3 |
| 58 | 0x5980fc9c | @$xp$23Madnvassistant@INVImage |
| 61 | 0x5980fbf0 | @$xp$23Madnvassistant@INVLabel |
| 214 | 0x598168d8 | @$xp$24Madexcept@IMEAttachments |
| 204 | 0x59816c78 | @$xp$24Madexcept@TExceptEventOO |
| 217 | 0x59816804 | @$xp$24Madexcept@TMEShowSetting |
| 62 | 0x5980fbb8 | @$xp$24Madnvassistant@INVButton |
| 56 | 0x5980fd28 | @$xp$24Madnvassistant@TNVAction |
| 40 | 0x59808500 | @$xp$24Madstacktrace@TStackItem |
| 39 | 0x59808530 | @$xp$25Madstacktrace@TStackTrace |
| 59 | 0x5980fc60 | @$xp$26Madnvassistant@INVCheckBox |
| 64 | 0x5980fb3c | @$xp$26Madnvassistant@TOutputType |
| 215 | 0x5981689c | @$xp$27Madexcept@IMEModuleSettings |
| 54 | 0x5980fdc0 | @$xp$27Madnvassistant@INVAssistant |
| 36 | 0x598085fc | @$xp$28Madstacktrace@BcbTermination |
| 57 | 0x5980fcd4 | @$xp$29Madnvassistant@TNVModalResult |
| 28 | 0x59807550 | @$xp$29Madnvprgralert@IProgressAlert |
| 38 | 0x59808560 | @$xp$29Madstacktrace@TDAPreStackItem |
| 209 | 0x59816b78 | @$xp$30Madexcept@TBugReportCallbackOO |
| 202 | 0x59816da8 | @$xp$30Madexcept@TExceptActionEventOO |
| 242 | 0x598435c0 | @GetPackageInfoTable |
| 235 | 0x598433d4 | @Maddumpobj@DumpObj$qqrp14System@TObject |
| 234 | 0x59843438 | @Maddumpobj@Finalization$qqrv |
| 233 | 0x5984423c | @Maddumpobj@initialization$qqrv |
| 200 | 0x59845054 | @Madexcept@AddCmdLineToBugRep |
| 182 | 0x59845090 | @Madexcept@AmHttpServer |
| 129 | 0x598267e8 | @Madexcept@AmOnline$qqro |
| 121 | 0x5982ba7c | @Madexcept@AutoSaveBugReport$qqr27System@%AnsiStringT$us$i0$%49System@%DelphiInterface$t21Madexcept@IMESettings% |
| 119 | 0x5982c850 | @Madexcept@AutoSendBugReport$qqr27System@%AnsiStringT$us$i0$%49System@%DelphiInterface$t21Madnvbitmap@INVBitmap%49System@%DelphiInterface$t21Madexcept@IMESettings% |
| 159 | 0x598450ec | @Madexcept@BcbCallTerminate |
| 164 | 0x598450d8 | @Madexcept@BcbExceptionHandler |
| 151 | 0x59817ea8 | @Madexcept@BcbHelper_GetIntraWebVersion$qqrpv |
| 162 | 0x598450e0 | @Madexcept@BcbInitExceptBlockLDTC |
| 160 | 0x598450e8 | @Madexcept@BcbMemcpy |
| 161 | 0x598450e4 | @Madexcept@BcbOrgMalloc |
| 158 | 0x598450f0 | @Madexcept@BcbPTerminate |
| 163 | 0x598450dc | @Madexcept@BcbThrowExceptionLDTC |
| 181 | 0x59845094 | @Madexcept@BugReportHtml |
| 171 | 0x598450bc | @Madexcept@CGIApp_TCGIApplication_CGIHandleException |
| 220 | 0x59845044 | @Madexcept@CMadExceptVersionString |
| 157 | 0x59816e54 | @Madexcept@CalibrateCode$qqrv |
| 183 | 0x5984508c | @Madexcept@CalibrateData |
| 144 | 0x5981a598 | @Madexcept@CheckExceptParams$qqrrp14System@TObjectrpvt2rp8_CONTEXT |
| 172 | 0x598450b8 | @Madexcept@Classes_CheckSynchronize |
| 140 | 0x5981f744 | @Madexcept@CloseAntiFreeze$qqrv |
| 198 | 0x5984505c | @Madexcept@CloseAppExitCode |
| 116 | 0x5982ce44 | @Madexcept@CloseApplication$qqrv |
| 96 | 0x598351cc | @Madexcept@CreateBugReport$qqr21Madexcept@TExceptTypep14System@TObjectpvuiuiuip8_CONTEXTo55System@%DelphiInterface$t27Madexcept@IMEModuleSettings%23Madexcept@TExceptSourcet2uit3 |
| 124 | 0x5982a944 | @Madexcept@DecryptPassword$qqr27System@%AnsiStringT$us$i0$%t1t1 |
| 115 | 0x59832e78 | @Madexcept@DefaultBugReportHtml$qqr27System@%AnsiStringT$us$i0$%49System@%DelphiInterface$t21Madexcept@IMESettings% |
| 199 | 0x59845058 | @Madexcept@DetectConsole |
| 180 | 0x59845098 | @Madexcept@DisAsmFunc |
| 70 | 0x5983e05c | @Madexcept@DontHookThreads$qqrv |
| 189 | 0x59845080 | @Madexcept@DontReformatExcMsg |
| 194 | 0x5984506c | @Madexcept@DontUseProxy |
| 196 | 0x59845064 | @Madexcept@DumbStackTrace |
| 72 | 0x5983bed0 | @Madexcept@Ebp$qqrv |
| 73 | 0x5983bec8 | @Madexcept@Esp$qqrv |
| 147 | 0x59818ff0 | @Madexcept@ExpandVars$qqruir27System@%AnsiStringT$us$i0$%27System@%AnsiStringT$us$i0$%t3t3 |
| 145 | 0x598199b4 | @Madexcept@FillClipboard$qqr27System@%AnsiStringT$us$i0$% |
| 66 | 0x598406fc | @Madexcept@Finalization$qqrv |
| 191 | 0x59845078 | @Madexcept@ForceUtf8 |
| 146 | 0x59819908 | @Madexcept@FormatExceptMessage$qqr27System@%AnsiStringT$us$i0$% |
| 179 | 0x5984509c | @Madexcept@Forms_TApplication_HandleException |
| 178 | 0x598450a0 | @Madexcept@Forms_TApplication_ShowException |
| 86 | 0x59835c3c | @Madexcept@Get9xResourceReport$qqrv |
| 84 | 0x59835ed4 | @Madexcept@GetAllocatedMemory$qqrv |
| 88 | 0x598359c8 | @Madexcept@GetCpuCount$qqrv |
| 89 | 0x59835918 | @Madexcept@GetCpuName$qqrv |
| 78 | 0x59839334 | @Madexcept@GetCrashStackTrace$qqrooop49System@%DynamicArray$t24Madstacktrace@TStackItem%57System@%DelphiInterface$t29Madnvprgralert@IProgressAlert%opuit7pop52System@%DynamicArray$t27System@%AnsiStringT$us$i0$%% |
| 85 | 0x59835cf8 | @Madexcept@GetDisplayModeString$qqrv |
| 76 | 0x5983b920 | @Madexcept@GetExceptBoxHandle$qqrv |
| 87 | 0x59835abc | @Madexcept@GetMemoryStatus$qqrv |
| 92 | 0x59835774 | @Madexcept@GetOsLanguageString$qqrv |
| 93 | 0x598356c4 | @Madexcept@GetOsVersionString$qqrv |
| 90 | 0x59835814 | @Madexcept@GetProgramUpTime$qqrv |
| 91 | 0x598357bc | @Madexcept@GetSystemUpTime$qqrv |
| 94 | 0x59835344 | @Madexcept@GetTSClientName$qqrv |
| 148 | 0x598189b8 | @Madexcept@GetThreadCreatorAddr$qqrui |
| 79 | 0x5983921c | @Madexcept@GetThreadInfos$qqruiruit2t2t2riro |
| 156 | 0x59816f58 | @Madexcept@GetThreadList$qqrv |
| 149 | 0x5981898c | @Madexcept@GetThreadName$qqrui |
| 77 | 0x598394a4 | @Madexcept@GetThreadStackTrace$qqruiooop49System@%DynamicArray$t24Madstacktrace@TStackItem%57System@%DelphiInterface$t29Madnvprgralert@IProgressAlert%opuit8pop52System@%DynamicArray$t27System@%AnsiStringT$us$i0$%% |
| 136 | 0x5981f9b8 | @Madexcept@HandleContactForm$qqr50System@%DelphiInterface$t22Madnvassistant@INVForm%24Madnvassistant@TNVAction50System@%DelphiInterface$t22Madnvassistant@INVItem%50System@%DelphiInterface$t22Madexcept@IMEException% |
| 114 | 0x598344f4 | @Madexcept@HandleException$qqr21Madexcept@TExceptTypep14System@TObjectpvouiuip8_CONTEXT23Madexcept@TExceptSourcet2uip27System@%AnsiStringT$us$i0$% |
| 135 | 0x5981ff1c | @Madexcept@HandleScreenshotForm$qqr50System@%DelphiInterface$t22Madnvassistant@INVForm%24Madnvassistant@TNVAction50System@%DelphiInterface$t22Madnvassistant@INVItem%50System@%DelphiInterface$t22Madexcept@IMEException% |
| 190 | 0x5984507c | @Madexcept@HiddenAutoMailing |
| 71 | 0x5983e008 | @Madexcept@HookThreads$qqrv |
| 169 | 0x598450c4 | @Madexcept@HttpExtensionProcNext |
| 123 | 0x5982a9d4 | @Madexcept@HttpUpload$qqr27System@%AnsiStringT$us$i0$%52System@%DelphiInterface$t24Madexcept@IMEAttachments%47System@%DelphiInterface$t19Madexcept@IMEFields%t1t1uit1uioo49System@%DelphiInterface$t21Madexcept@IMESettings% |
| 195 | 0x59845068 | @Madexcept@HttpUploadTimeout |
| 68 | 0x5983e5ac | @Madexcept@HyperJumpCallstack$qqr27System@%AnsiStringT$us$i0$% |
| 170 | 0x598450c0 | @Madexcept@ISAPIApp_TISAPIApplication_ISAPIHandleException |
| 138 | 0x5981f848 | @Madexcept@ImNotFrozen$qqrv |
| 141 | 0x5981f6b4 | @Madexcept@InitAntiFreeze$qqrv |
| 67 | 0x5983e818 | @Madexcept@InstallUnhandledExceptionFilter$qqrv |
| 80 | 0x598391ec | @Madexcept@IsThreadSuspended$qqruiui |
| 95 | 0x59835284 | @Madexcept@IsUserAdmin$qqrv |
| 133 | 0x59824adc | @Madexcept@MESettings$qqrpv |
| 134 | 0x59824a18 | @Madexcept@MESettings$qqrui |
| 132 | 0x59824bfc | @Madexcept@MESettings$qqrv |
| 126 | 0x59827cb0 | @Madexcept@MxLookup$qqr27System@%AnsiStringT$us$i0$% |
| 150 | 0x598185ac | @Madexcept@NameThread$qqrui27System@%AnsiStringT$us$i0$% |
| 130 | 0x59825d10 | @Madexcept@NewAttachments$qqrv |
| 74 | 0x5983baf4 | @Madexcept@NewException$qqr21Madexcept@TExceptTypep14System@TObjectpvouiuiuip8_CONTEXT55System@%DelphiInterface$t27Madexcept@IMEModuleSettings%23Madexcept@TExceptSourcet2uit3o |
| 131 | 0x59825628 | @Madexcept@NewFields$qqrv |
| 192 | 0x59845074 | @Madexcept@NoOnlineCheck |
| 207 | 0x59845048 | @Madexcept@OnExceptBoxCreate |
| 206 | 0x5984504c | @Madexcept@OnExceptBoxDestroy |
| 155 | 0x598172e0 | @Madexcept@OpenThread$qqruiui |
| 82 | 0x59836300 | @Madexcept@PatchInt$qqrpvi |
| 83 | 0x598362b0 | @Madexcept@PatchJmp$qqrpvt1 |
| 139 | 0x5981f7c4 | @Madexcept@PauseFreezeCheck$qqro |
| 81 | 0x59836314 | @Madexcept@PauseMadExcept$qqro |
| 142 | 0x5981f404 | @Madexcept@PauseMeEventually$qqrv |
| 186 | 0x5984603c | @Madexcept@Plugins |
| 118 | 0x5982c8f0 | @Madexcept@PrintBugReport$qqr27System@%AnsiStringT$us$i0$%ui49System@%DelphiInterface$t21Madexcept@IMESettings% |
| 201 | 0x59845050 | @Madexcept@ProcessMainThreadId |
| 193 | 0x59845070 | @Madexcept@ProxyServer |
| 143 | 0x5981e7cc | @Madexcept@PutAssisIntoBugReport$qqr55System@%DelphiInterface$t27Madnvassistant@INVAssistant%50System@%DelphiInterface$t22Madexcept@IMEException% |
| 177 | 0x598450a4 | @Madexcept@Qforms_TApplication_HandleException |
| 176 | 0x598450a8 | @Madexcept@Qforms_TApplication_ShowException |
| 152 | 0x59817da4 | @Madexcept@RegDelVal$qqrui27System@%AnsiStringT$us$i0$%t2 |
| 154 | 0x59817bc0 | @Madexcept@RegReadStr$qqrui27System@%AnsiStringT$us$i0$%t2 |
| 153 | 0x59817cd0 | @Madexcept@RegWriteStr$qqrui27System@%AnsiStringT$us$i0$%t2t2 |
| 100 | 0x59834e8c | @Madexcept@RegisterBugReportPlugin$qqr27System@%AnsiStringT$us$i0$%t1pqqrv$20System@UnicodeStringo |
| 101 | 0x59834dc8 | @Madexcept@RegisterBugReportPlugin$qqr27System@%AnsiStringT$us$i0$%t1pqqrv$27System@%AnsiStringT$us$i0$%o |
| 98 | 0x59835014 | @Madexcept@RegisterBugReportPlugin$qqr27System@%AnsiStringT$us$i0$%t1pqqrx50System@%DelphiInterface$t22Madexcept@IMEException%$20System@UnicodeStringo |
| 99 | 0x59834f50 | @Madexcept@RegisterBugReportPlugin$qqr27System@%AnsiStringT$us$i0$%t1pqqrx50System@%DelphiInterface$t22Madexcept@IMEException%$27System@%AnsiStringT$us$i0$%o |
| 109 | 0x59834c74 | @Madexcept@RegisterExceptActionHandler$qqrpqqr23Madexcept@TExceptActionx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v19Madexcept@TSyncType |
| 108 | 0x59834c84 | @Madexcept@RegisterExceptActionHandler$qqrynpqqr23Madexcept@TExceptActionx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v19Madexcept@TSyncType |
| 113 | 0x59834c24 | @Madexcept@RegisterExceptionHandler$qqrpqqrx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v19Madexcept@TSyncType22Madexcept@TExceptPhase |
| 112 | 0x59834c34 | @Madexcept@RegisterExceptionHandler$qqrynpqqrx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v19Madexcept@TSyncType22Madexcept@TExceptPhase |
| 105 | 0x59834cc4 | @Madexcept@RegisterHiddenExceptionHandler$qqrpqqrx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v19Madexcept@TSyncType |
| 104 | 0x59834cd4 | @Madexcept@RegisterHiddenExceptionHandler$qqrynpqqrx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v19Madexcept@TSyncType |
| 197 | 0x59845060 | @Madexcept@ResetFpuMode |
| 117 | 0x5982ccf4 | @Madexcept@RestartApplication$qqrv |
| 122 | 0x5982b9fc | @Madexcept@SaveBugReport$qqr27System@%AnsiStringT$us$i0$%ui49System@%DelphiInterface$t21Madexcept@IMESettings% |
| 120 | 0x5982c7ac | @Madexcept@SendBugReport$qqr27System@%AnsiStringT$us$i0$%49System@%DelphiInterface$t21Madnvbitmap@INVBitmap%ui49System@%DelphiInterface$t21Madexcept@IMESettings% |
| 128 | 0x59826d0c | @Madexcept@SendMapiMail$qqr27System@%AnsiStringT$us$i0$%t1t152System@%DelphiInterface$t24Madexcept@IMEAttachments%uioo49System@%DelphiInterface$t21Madexcept@IMESettings% |
| 127 | 0x59826f74 | @Madexcept@SendShellMail$qqr27System@%AnsiStringT$us$i0$%t1t1 |
| 125 | 0x5982a7f0 | @Madexcept@SendSmtpMail$qqr27System@%AnsiStringT$us$i0$%t1t1t152System@%DelphiInterface$t24Madexcept@IMEAttachments%t1t1t1uiuioo49System@%DelphiInterface$t21Madexcept@IMESettings% |
| 137 | 0x5981f868 | @Madexcept@SetFreezeTimeout$qqrui |
| 75 | 0x5983b938 | @Madexcept@SetTopmost$qqruio |
| 187 | 0x59845088 | @Madexcept@ShowBugReportKey |
| 188 | 0x59845084 | @Madexcept@SmtpMailFrom |
| 173 | 0x598450b4 | @Madexcept@SysUtils_InitializePackage |
| 174 | 0x598450b0 | @Madexcept@SysUtils_LoadPackage |
| 175 | 0x598450ac | @Madexcept@SysUtils_ShowException |
| 166 | 0x598450d0 | @Madexcept@System_ExceptionHandler |
| 167 | 0x598450cc | @Madexcept@System_FinalizeUnits |
| 168 | 0x598450c8 | @Madexcept@System_InitUnits |
| 165 | 0x598450d4 | @Madexcept@System_runErrMsg |
| 97 | 0x598350d8 | @Madexcept@UnregisterBugReportPlugin$qqr27System@%AnsiStringT$us$i0$% |
| 107 | 0x59834ca0 | @Madexcept@UnregisterExceptActionHandler$qqrpqqr23Madexcept@TExceptActionx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v |
| 106 | 0x59834cac | @Madexcept@UnregisterExceptActionHandler$qqrynpqqr23Madexcept@TExceptActionx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v |
| 111 | 0x59834c50 | @Madexcept@UnregisterExceptionHandler$qqrpqqrx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v |
| 110 | 0x59834c5c | @Madexcept@UnregisterExceptionHandler$qqrynpqqrx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v |
| 103 | 0x59834cf0 | @Madexcept@UnregisterHiddenExceptionHandler$qqrpqqrx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v |
| 102 | 0x59834cfc | @Madexcept@UnregisterHiddenExceptionHandler$qqrynpqqrx50System@%DelphiInterface$t22Madexcept@IMEException%ro$v |
| 65 | 0x5984409c | @Madexcept@initialization$qqrv |
| 69 | 0x5983e2f0 | @Madexcept@madTraceProcess$qqsi |
| 239 | 0x598435c0 | @Madexcept_@@GetPackageInfoTable$qqrv |
| 238 | 0x598435c8 | @Madexcept_@@PackageLoad$qqrv |
| 237 | 0x598435d4 | @Madexcept_@@PackageUnload$qqrv |
| 236 | 0x59844244 | @Madexcept_@initialization$qqrv |
| 223 | 0x59840828 | @Madlinkdisasm@Finalization$qqrv |
| 222 | 0x598440ec | @Madlinkdisasm@initialization$qqrv |
| 231 | 0x5984295c | @Madlisthardware@Finalization$qqrv |
| 232 | 0x598426c8 | @Madlisthardware@GetHardwareList$qqrv |
| 230 | 0x598441bc | @Madlisthardware@initialization$qqrv |
| 225 | 0x59840cec | @Madlistmodules@Finalization$qqrv |
| 226 | 0x598408a8 | @Madlistmodules@GetModuleList$qqrv |
| 224 | 0x59844104 | @Madlistmodules@initialization$qqrv |
| 228 | 0x59841aac | @Madlistprocesses@Finalization$qqrv |
| 229 | 0x59841690 | @Madlistprocesses@GetProcessList$qqrv |
| 227 | 0x5984415c | @Madlistprocesses@initialization$qqrv |
| 17 | 0x59845030 | @Madmapfile@CMapFileStreamDescriptor |
| 2 | 0x59807504 | @Madmapfile@Finalization$qqrv |
| 7 | 0x59806e18 | @Madmapfile@FindMapFile$qqrpv |
| 4 | 0x59807048 | @Madmapfile@GetMapFileInfos$qqrpvr27System@%AnsiStringT$us$i0$%t2t2rpvri |
| 3 | 0x59807158 | @Madmapfile@GetMyProcName$qqro |
| 6 | 0x59806f90 | @Madmapfile@LoadMapFile$qqr27System@%AnsiStringT$us$i0$%o |
| 5 | 0x59806fec | @Madmapfile@LoadMapFileEx$qqr27System@%AnsiStringT$us$i0$%o |
| 19 | 0x59802400 | @Madmapfile@TMapFile@ |
| 16 | 0x59805c48 | @Madmapfile@TMapFile@$bctr$qqro27System@%AnsiStringT$us$i0$%uioo |
| 8 | 0x598068fc | @Madmapfile@TMapFile@Export$qqrooo |
| 10 | 0x59806358 | @Madmapfile@TMapFile@FindLine$qqrpv |
| 9 | 0x59806364 | @Madmapfile@TMapFile@FindLine$qqrpvrpv |
| 11 | 0x5980631c | @Madmapfile@TMapFile@FindPublic$qqri |
| 12 | 0x598060c4 | @Madmapfile@TMapFile@FindPublic$qqro27System@%AnsiStringT$us$i0$%t2o |
| 13 | 0x59805fcc | @Madmapfile@TMapFile@FindPublic$qqrpv |
| 14 | 0x59805f90 | @Madmapfile@TMapFile@FindSegment$qqri |
| 15 | 0x59805e7c | @Madmapfile@TMapFile@FindSegment$qqropv |
| 1 | 0x59844034 | @Madmapfile@initialization$qqrv |
| 50 | 0x59816408 | @Madnvassistant@CreateAssistant$qqr27System@%AnsiStringT$us$i0$%px27System@%AnsiStringT$us$i0$%xi45System@%DelphiInterface$t17System@IInterface% |
| 48 | 0x59816610 | @Madnvassistant@Finalization$qqrv |
| 52 | 0x5984503c | @Madnvassistant@HandleContactFormProc |
| 51 | 0x59845040 | @Madnvassistant@HandleScreenshotFormProc |
| 49 | 0x598164a0 | @Madnvassistant@LoadAssistant$qqrui27System@%AnsiStringT$us$i0$%px27System@%AnsiStringT$us$i0$%xi45System@%DelphiInterface$t17System@IInterface% |
| 53 | 0x59845038 | @Madnvassistant@OnAssistantCreate |
| 47 | 0x59844094 | @Madnvassistant@initialization$qqrv |
| 42 | 0x5980fb08 | @Madnvbitmap@Finalization$qqrv |
| 44 | 0x5980f954 | @Madnvbitmap@LoadBitmap$qqr27System@%AnsiStringT$us$i0$% |
| 43 | 0x5980fa50 | @Madnvbitmap@ScreenShot$qqro |
| 41 | 0x5984408c | @Madnvbitmap@initialization$qqrv |
| 26 | 0x598084cc | @Madnvprgralert@Finalization$qqrv |
| 27 | 0x59808450 | @Madnvprgralert@NewProgressAlert$qqr27System@%AnsiStringT$us$i0$%uit1 |
| 25 | 0x5984407c | @Madnvprgralert@initialization$qqrv |
| 37 | 0x598085e8 | @Madstacktrace@BcbTermination@ |
| 32 | 0x5980c914 | @Madstacktrace@FastMM_LogStackTrace$qqrpvipcoooo |
| 30 | 0x5980cec4 | @Madstacktrace@Finalization$qqrv |
| 34 | 0x598095cc | @Madstacktrace@InternalError$qqr27System@%AnsiStringT$us$i0$%oo |
| 31 | 0x5980cdd8 | @Madstacktrace@PrepareStackTrace$qqruiuiuipvor52System@%DynamicArray$t27Madstacktrace@TPreStackItem% |
| 35 | 0x59809308 | @Madstacktrace@StackAddrToStr$qqrpvoo |
| 33 | 0x5980c2a8 | @Madstacktrace@StackTrace$qqrooop49System@%DynamicArray$t24Madstacktrace@TStackItem%pvoouiuit5ppvtbtb57System@%DelphiInterface$t29Madnvprgralert@IProgressAlert%uioot5popuitktjp52System@%DynamicArray$t27System@%AnsiStringT$us$i0$%%o |
| 29 | 0x59844084 | @Madstacktrace@initialization$qqrv |
| 240 | 0x598435d4 | Finalize |
| 241 | 0x598435c8 | Initialize |
| 221 | 0x5983e2f0 | madTraceProcess |
No results found.
No behavioral analysis data available.
No dropped files found.