popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_9_142644520.xlsm

Malicious Packer Malicious Library PE32 PE File DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Aug. 17, 2021, 9:22 a.m. Aug. 17, 2021, 9:24 a.m.
Size 252.6KB
Type Microsoft Excel 2007+
MD5 fd7075efa74442ec550ba1b0613f0db3
SHA256 56c2a6cd514956d83ac3d9f810ca1d942ba929f29a9af1d37aee3a1ce54a0283
CRC32 7F57AF7A
ssdeep 6144:SWtZbAPPimNA/kjoitk17d3/zIZgddQIMgB0ViWir2Yv6ZtK2BnBkxXpsw:3tZbAPDNAcM5d3bFLKW0ir2YvoU2BnBS
Yara None matched

Name Response Post-Analysis Lookup
beklear.net
A 172.67.197.185
A 104.21.84.227
172.67.197.185
cdn.discordapp.com
A 162.159.135.233
A 162.159.134.233
A 162.159.129.233
A 162.159.130.233
A 162.159.133.233
162.159.129.233
IP Address Status Action
104.21.84.227 Active Moloch
162.159.129.233 Active Moloch
164.124.101.2 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49172 -> 104.21.84.227:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49170 -> 162.159.129.233:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49172
104.21.84.227:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 68:fe:3c:89:1c:a3:9a:1d:fb:03:72:a7:34:6d:57:62:b0:0b:5d:8c
TLSv1
192.168.56.103:49170
162.159.129.233:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74fb374b
CoReleaseServerProcess+0x73 OleSaveToStream-0xad ole32+0x64387 @ 0x761e4387
NdrpMemoryIncrement+0x3d1 NdrComplexStructMarshall-0x2f rpcrt4+0x1ef51 @ 0x74faef51
NdrPointerMarshall+0x30 NdrPointerBufferSize-0xb6 rpcrt4+0x16a9c @ 0x74fa6a9c
NdrPointerMarshall+0xd6 NdrPointerBufferSize-0x10 rpcrt4+0x16b42 @ 0x74fa6b42
NdrPointerMarshall+0x30 NdrPointerBufferSize-0xb6 rpcrt4+0x16a9c @ 0x74fa6a9c
NdrConformantArrayFree+0x8c NdrOleFree-0xa rpcrt4+0x35c3a @ 0x74fc5c3a
NdrStubCall2+0x31d NdrUnmarshallBasetypeInline-0x23a rpcrt4+0xb06b8 @ 0x750406b8
WdtpInterfacePointer_UserUnmarshal+0x256f DllDebugObjectRPCHook-0x1e89 ole32+0x13d7e6 @ 0x762bd7e6
WdtpInterfacePointer_UserUnmarshal+0x25ff DllDebugObjectRPCHook-0x1df9 ole32+0x13d876 @ 0x762bd876
WdtpInterfacePointer_UserUnmarshal+0x2b59 DllDebugObjectRPCHook-0x189f ole32+0x13ddd0 @ 0x762bddd0
CoTaskMemFree+0x1b02 DcomChannelSetHResult-0x1c8 ole32+0x58a43 @ 0x761d8a43
CoTaskMemFree+0x19f7 DcomChannelSetHResult-0x2d3 ole32+0x58938 @ 0x761d8938
DcomChannelSetHResult+0x8ff CoGetObject-0x2183 ole32+0x5950a @ 0x761d950a
WdtpInterfacePointer_UserUnmarshal+0x2a56 DllDebugObjectRPCHook-0x19a2 ole32+0x13dccd @ 0x762bdccd
WdtpInterfacePointer_UserUnmarshal+0x28ca DllDebugObjectRPCHook-0x1b2e ole32+0x13db41 @ 0x762bdb41
WdtpInterfacePointer_UserUnmarshal+0x2f86 DllDebugObjectRPCHook-0x1472 ole32+0x13e1fd @ 0x762be1fd
DcomChannelSetHResult+0x75c CoGetObject-0x2326 ole32+0x59367 @ 0x761d9367
DcomChannelSetHResult+0x71b CoGetObject-0x2367 ole32+0x59326 @ 0x761d9326
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x751762fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75176d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x751777c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x7517788a
CoWaitForMultipleHandles+0x4311 CoRegisterSurrogateEx-0x2fe ole32+0x1a48b @ 0x7619a48b
CoWaitForMultipleHandles+0x23c1 CoRegisterSurrogateEx-0x224e ole32+0x1853b @ 0x7619853b
CoWaitForMultipleHandles+0x4332 CoRegisterSurrogateEx-0x2dd ole32+0x1a4ac @ 0x7619a4ac
CoGetTreatAsClass+0x2619 CoRegisterChannelHook-0x1269 ole32+0x2cd48 @ 0x761acd48
CoGetTreatAsClass+0x314b CoRegisterChannelHook-0x737 ole32+0x2d87a @ 0x761ad87a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x80040155
exception.offset: 46887
exception.address: 0x7677b727
registers.esp: 48100316
registers.edi: 3098540
registers.eax: 48100316
registers.ebp: 48100396
registers.edx: 49
registers.ebx: 48100680
registers.esi: 2147746133
registers.ecx: 2843432
1 0 0

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x74fb374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x762bf725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x74fc414b
ObjectStublessClient25+0x65c CoImpersonateClient-0xbc ole32+0xfe14 @ 0x7618fe14
StgGetIFillLockBytesOnFile+0x16ab5 WdtpInterfacePointer_UserSize-0xe21 ole32+0x13a338 @ 0x762ba338
IsValidURL+0x4b8c MkParseDisplayNameEx-0x1c6a4 urlmon+0x4e99f @ 0x76b8e99f
IntlPercentEncodeNormalize+0x1ff8 CoInternetCombineIUri-0x940 urlmon+0x272ed @ 0x76b672ed
RegisterBindStatusCallback+0x40d9 CopyBindInfo-0xbe4 urlmon+0x1ab0d @ 0x76b5ab0d
IsValidURL+0x2235 MkParseDisplayNameEx-0x1effb urlmon+0x4c048 @ 0x76b8c048
RegisterBindStatusCallback+0x1dc3 CopyBindInfo-0x2efa urlmon+0x187f7 @ 0x76b587f7
RegisterBindStatusCallback+0x1ef2 CopyBindInfo-0x2dcb urlmon+0x18926 @ 0x76b58926
RevokeBindStatusCallback+0x13ad CreateURLMoniker-0x4b1 urlmon+0x1d55e @ 0x76b5d55e
IsValidURL+0x2638 MkParseDisplayNameEx-0x1ebf8 urlmon+0x4c44b @ 0x76b8c44b
RevokeBindStatusCallback+0x1045 CreateURLMoniker-0x819 urlmon+0x1d1f6 @ 0x76b5d1f6
RevokeBindStatusCallback+0xffb CreateURLMoniker-0x863 urlmon+0x1d1ac @ 0x76b5d1ac
RevokeBindStatusCallback+0x125a CreateURLMoniker-0x604 urlmon+0x1d40b @ 0x76b5d40b
RegisterBindStatusCallback+0x2ee7 CopyBindInfo-0x1dd6 urlmon+0x1991b @ 0x76b5991b
RegisterBindStatusCallback+0x2333 CopyBindInfo-0x298a urlmon+0x18d67 @ 0x76b58d67
RegisterBindStatusCallback+0x36a4 CopyBindInfo-0x1619 urlmon+0x1a0d8 @ 0x76b5a0d8
RegisterBindStatusCallback+0x3151 CopyBindInfo-0x1b6c urlmon+0x19b85 @ 0x76b59b85
RegisterBindStatusCallback+0x3074 CopyBindInfo-0x1c49 urlmon+0x19aa8 @ 0x76b59aa8
DllRegisterServer+0x14b2 msxml3+0x46f4f @ 0x6a8f6f4f
DllRegisterServer+0x13a3 msxml3+0x46e40 @ 0x6a8f6e40
DllGetClassObject+0x3536b DllCanUnloadNow-0x1017 msxml3+0x427a4 @ 0x6a8f27a4
DllGetClassObject+0x35219 DllCanUnloadNow-0x1169 msxml3+0x42652 @ 0x6a8f2652
DllGetClassObject+0x35104 DllCanUnloadNow-0x127e msxml3+0x4253d @ 0x6a8f253d
DllGetClassObject+0x34fd8 DllCanUnloadNow-0x13aa msxml3+0x42411 @ 0x6a8f2411
DllGetClassObject+0x35172 DllCanUnloadNow-0x1210 msxml3+0x425ab @ 0x6a8f25ab
wmic+0x39c80 @ 0x9b9c80
wmic+0x3b06a @ 0x9bb06a
wmic+0x3b1f8 @ 0x9bb1f8
wmic+0x36fcd @ 0x9b6fcd
wmic+0x3d6e9 @ 0x9bd6e9
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x80040155
exception.offset: 46887
exception.address: 0x7677b727
registers.esp: 2614944
registers.edi: 1981610512
registers.eax: 2614944
registers.ebp: 2615024
registers.edx: 1
registers.ebx: 2812756
registers.esi: 2147746133
registers.ecx: 3263141590
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bd whjqtvztnnfa+0x7201
exception.address: 0x6aa17201
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 1
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bc whjqtvztnnfa+0x7202
exception.address: 0x6aa17202
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 1
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4 08
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bb whjqtvztnnfa+0x7203
exception.address: 0x6aa17203
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 1
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4 08 eb
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1ba whjqtvztnnfa+0x7204
exception.address: 0x6aa17204
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 1
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bd whjqtvztnnfa+0x7201
exception.address: 0x6aa17201
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 2
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bc whjqtvztnnfa+0x7202
exception.address: 0x6aa17202
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 2
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4 08
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bb whjqtvztnnfa+0x7203
exception.address: 0x6aa17203
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 2
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4 08 eb
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1ba whjqtvztnnfa+0x7204
exception.address: 0x6aa17204
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 2
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bd whjqtvztnnfa+0x7201
exception.address: 0x6aa17201
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 3
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bc whjqtvztnnfa+0x7202
exception.address: 0x6aa17202
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 3
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4 08
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bb whjqtvztnnfa+0x7203
exception.address: 0x6aa17203
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 3
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4 08 eb
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1ba whjqtvztnnfa+0x7204
exception.address: 0x6aa17204
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 3
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bd whjqtvztnnfa+0x7201
exception.address: 0x6aa17201
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 4
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bc whjqtvztnnfa+0x7202
exception.address: 0x6aa17202
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 4
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4 08
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bb whjqtvztnnfa+0x7203
exception.address: 0x6aa17203
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 4
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4 08 eb
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1ba whjqtvztnnfa+0x7204
exception.address: 0x6aa17204
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 4
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bd whjqtvztnnfa+0x7201
exception.address: 0x6aa17201
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 5
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bc whjqtvztnnfa+0x7202
exception.address: 0x6aa17202
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 5
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4 08
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bb whjqtvztnnfa+0x7203
exception.address: 0x6aa17203
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 5
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4 08 eb
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1ba whjqtvztnnfa+0x7204
exception.address: 0x6aa17204
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 5
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bd whjqtvztnnfa+0x7201
exception.address: 0x6aa17201
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 6
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bc whjqtvztnnfa+0x7202
exception.address: 0x6aa17202
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 6
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4 08
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bb whjqtvztnnfa+0x7203
exception.address: 0x6aa17203
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 6
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4 08 eb
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1ba whjqtvztnnfa+0x7204
exception.address: 0x6aa17204
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 6
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bd whjqtvztnnfa+0x7201
exception.address: 0x6aa17201
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 7
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bc whjqtvztnnfa+0x7202
exception.address: 0x6aa17202
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 7
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4 08
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bb whjqtvztnnfa+0x7203
exception.address: 0x6aa17203
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 7
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4 08 eb
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1ba whjqtvztnnfa+0x7204
exception.address: 0x6aa17204
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 7
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bd whjqtvztnnfa+0x7201
exception.address: 0x6aa17201
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 8
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bc whjqtvztnnfa+0x7202
exception.address: 0x6aa17202
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 8
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4 08
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bb whjqtvztnnfa+0x7203
exception.address: 0x6aa17203
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 8
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4 08 eb
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1ba whjqtvztnnfa+0x7204
exception.address: 0x6aa17204
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 8
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bd whjqtvztnnfa+0x7201
exception.address: 0x6aa17201
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 9
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bc whjqtvztnnfa+0x7202
exception.address: 0x6aa17202
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 9
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4 08
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bb whjqtvztnnfa+0x7203
exception.address: 0x6aa17203
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 9
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4 08 eb
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1ba whjqtvztnnfa+0x7204
exception.address: 0x6aa17204
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 9
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bd whjqtvztnnfa+0x7201
exception.address: 0x6aa17201
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 10
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bc whjqtvztnnfa+0x7202
exception.address: 0x6aa17202
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 10
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4 08
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bb whjqtvztnnfa+0x7203
exception.address: 0x6aa17203
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 10
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4 08 eb
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1ba whjqtvztnnfa+0x7204
exception.address: 0x6aa17204
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 10
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bd whjqtvztnnfa+0x7201
exception.address: 0x6aa17201
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 11
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bc whjqtvztnnfa+0x7202
exception.address: 0x6aa17202
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 11
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4 08
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bb whjqtvztnnfa+0x7203
exception.address: 0x6aa17203
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 11
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4 08 eb
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1ba whjqtvztnnfa+0x7204
exception.address: 0x6aa17204
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 11
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bd whjqtvztnnfa+0x7201
exception.address: 0x6aa17201
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 12
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bc whjqtvztnnfa+0x7202
exception.address: 0x6aa17202
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 12
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4 08
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1bb whjqtvztnnfa+0x7203
exception.address: 0x6aa17203
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 12
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0

__exception__

 stacktrace: 
WeprmcFosller-0x217f5 whjqtvztnnfa+0x4bc9 @ 0x6aa14bc9
WeprmcFosller-0x23e18 whjqtvztnnfa+0x25a6 @ 0x6aa125a6
WeprmcFosller-0x1f52d whjqtvztnnfa+0x6e91 @ 0x6aa16e91
LdrResSearchResource+0xb4d LdrResFindResourceDirectory-0x16c ntdll+0x3d8a9 @ 0x7757d8a9
LdrResSearchResource+0xa10 LdrResFindResourceDirectory-0x2a9 ntdll+0x3d76c @ 0x7757d76c
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x7757c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x73fdd4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x76781d2a
rundll32+0x14ed @ 0xf614ed
rundll32+0x1baf @ 0xf61baf
rundll32+0x12e8 @ 0xf612e8
rundll32+0x1901 @ 0xf61901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: cc eb f0 8b 04 24 64 a3 00 00 00 00 83 c4 08 eb
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol: WeprmcFosller-0x1f1ba whjqtvztnnfa+0x7204
exception.address: 0x6aa17204
registers.esp: 2617572
registers.edi: 647665898
registers.eax: 12
registers.ebp: 2617648
registers.edx: 603409
registers.ebx: 1789092700
registers.esi: 1983352698
registers.ecx: 1483859337
1 0 0
request GET https://cdn.discordapp.com/attachments/876792192524501045/876810977381847040/222_mod.dll
request GET https://cdn.discordapp.com/attachments/876792192524501045/876811276905480202/222_mod.dll
request GET https://beklear.net/wp-content/plugins/nhpakbigch/9YfqVdDVOAG.php
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2416
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6bfa2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2116
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05290000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x052a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6a8a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2832
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6aa41000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2832
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6a9d1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2832
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75271000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2832
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x768e1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2832
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76551000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2832
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76511000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2832
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76b21000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2832
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c001000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\~$Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_9_142644520.xlsm
file C:\ProgramData\whjqTVzTnnFa.dll
Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 2 (FILE_CREATE)
file_handle: 0x00000470
filepath: C:\Users\test22\AppData\Local\Temp\~$Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_9_142644520.xlsm
desired_access: 0xc0110080 (FILE_READ_ATTRIBUTES|DELETE|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_9_142644520.xlsm
create_options: 4198496 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_DELETE_ON_CLOSE)
status_info: 2 (FILE_CREATED)
share_access: 1 (FILE_SHARE_READ)
1 0 0
cmdline wmic process call create "rundll32.exe C:\ProgramData\whjqTVzTnnFa.dll FindSheet"
cmdline MSHTA C:\ProgramData\OyIGHoID.sct
CAT-QuickHeal XLS4.IcedID.42146
Alibaba TrojanDownloader:VBA/MalDoc.ali1000101
Kaspersky HEUR:Trojan.Script.Generic
Avira W97M/Dldr.IcedId.AL
ZoneAlarm HEUR:Trojan.Script.Generic
Cynet Malicious (score: 99)
Zoner Probably Heur.W97ShellN
Tencent Trojan.Win32.XmlMacroSheet.11008470
Qihoo-360 macro.office.07defname.gen
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2416
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x7ef70000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

InternetReadFile

 buffer: MZÿÿ¸@˜º´ Í!¸LÍ!This program cannot be run in DOS mode. $É»-ލÚCÚCÚCª9‹ÚC“ˆÐOÚC_CŒ\ÛCÚBRÛCŽ¢¢uÚC“ˆÖÏÚCg¾AŒáÛCg¾@Œ\ÚCë4ŽªÛCg¾¼ÐÛCg¾AŒ ÚCð£œ²ÛCð£œxÚCg¾BŒîÚC“ˆÒsÚC/ŽbÛCRichÚCPELdvaà!  pÀ€n€@pc]Ldðàðü‚€8€|.text6ip `.rdataç€ð€@@.dataDop`p@À.rsrcàÐ@@.relocý ðàDB
request_handle: 0x00cc000c
1 1 0
cmdline wmic process call create "rundll32.exe C:\ProgramData\whjqTVzTnnFa.dll FindSheet"
parent_process excel.exe martian_process MSHTA C:\ProgramData\OyIGHoID.sct
Time & API Arguments Status Return Repeated

__anomaly__

 tid: 2864
message: Encountered 65537 exceptions, quitting.
subcategory: exception
function_name:
1 0 0
Time & API Arguments Status Return Repeated

IWbemServices_ExecMethod

 inargs.CurrentDirectory: None
inargs.CommandLine: rundll32.exe C:\ProgramData\whjqTVzTnnFa.dll FindSheet
inargs.ProcessStartupInformation: None
outargs.ProcessId: 1104
outargs.ReturnValue: 0
flags: 0
method: Create
class: Win32_Process
1 0 0