Windows Analysis Report
PO-SINCO-PDF.exe

AI detected suspicious sample

Source: Yara match	File source: 4.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1799111466.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1799357610.0000000005270000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: PO-SINCO-PDF.exe

Joe Sandbox ML: detected

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.1555948913.0000000003073000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO-SINCO-PDF.exe PID: 7460, type: MEMORYSTR

Source: PO-SINCO-PDF.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Windows.Forms.pdb source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdbP source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: mscorlib.pdb source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdbRSDS source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.pdb source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdb source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: wntdll.pdbUGP source: ngen.exe, 00000004.00000002.1799695833.0000000005850000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdb source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: wntdll.pdb source: ngen.exe, ngen.exe, 00000004.00000002.1799695833.0000000005850000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.pdbH source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdb source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: System.pdb source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdb source: WERC63D.tmp.dmp.8.dr

Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe

Code function: 4x nop then jmp 00007FFB4B333F26h

0_2_00007FFB4B333D31

Source: Amcache.hve.8.dr

String found in binary or memory: http://upx.sf.net

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 4.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1799111466.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1799357610.0000000005270000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Source: 4.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 4.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.1799111466.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.1799357610.0000000005270000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0042C353 NtClose,	4_2_0042C353
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C35C0 NtCreateMutant,LdrInitializeThunk,	4_2_058C35C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2DF0 NtQuerySystemInformation,LdrInitializeThunk,	4_2_058C2DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2C70 NtFreeVirtualMemory,LdrInitializeThunk,	4_2_058C2C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2B60 NtClose,LdrInitializeThunk,	4_2_058C2B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C4650 NtSuspendThread,	4_2_058C4650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C3090 NtSetValueKey,	4_2_058C3090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C3010 NtOpenDirectoryObject,	4_2_058C3010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C4340 NtSetContextThread,	4_2_058C4340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2DB0 NtEnumerateKey,	4_2_058C2DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2DD0 NtDelayExecution,	4_2_058C2DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2D00 NtSetInformationFile,	4_2_058C2D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C3D10 NtOpenProcessToken,	4_2_058C3D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2D10 NtMapViewOfSection,	4_2_058C2D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2D30 NtUnmapViewOfSection,	4_2_058C2D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C3D70 NtOpenThread,	4_2_058C3D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2CA0 NtQueryInformationToken,	4_2_058C2CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2CC0 NtQueryVirtualMemory,	4_2_058C2CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2CF0 NtOpenProcess,	4_2_058C2CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2C00 NtQueryInformationProcess,	4_2_058C2C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2C60 NtCreateKey,	4_2_058C2C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2F90 NtProtectVirtualMemory,	4_2_058C2F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2FA0 NtQuerySection,	4_2_058C2FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2FB0 NtResumeThread,	4_2_058C2FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2FE0 NtCreateFile,	4_2_058C2FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2F30 NtCreateSection,	4_2_058C2F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2F60 NtCreateProcessEx,	4_2_058C2F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2E80 NtReadVirtualMemory,	4_2_058C2E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2EA0 NtAdjustPrivilegesToken,	4_2_058C2EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2EE0 NtQueueApcThread,	4_2_058C2EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2E30 NtWriteVirtualMemory,	4_2_058C2E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C39B0 NtGetContextThread,	4_2_058C39B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2B80 NtQueryInformationFile,	4_2_058C2B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2BA0 NtEnumerateValueKey,	4_2_058C2BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2BE0 NtQueryValueKey,	4_2_058C2BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2BF0 NtAllocateVirtualMemory,	4_2_058C2BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2AB0 NtWaitForSingleObject,	4_2_058C2AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2AD0 NtReadFile,	4_2_058C2AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2AF0 NtWriteFile,	4_2_058C2AF0

Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Code function: 0_2_00007FFB4B33CB19	0_2_00007FFB4B33CB19
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Code function: 0_2_00007FFB4B34591A	0_2_00007FFB4B34591A
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Code function: 0_2_00007FFB4B33CFA1	0_2_00007FFB4B33CFA1
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Code function: 0_2_00007FFB4B33A830	0_2_00007FFB4B33A830
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Code function: 0_2_00007FFB4B339708	0_2_00007FFB4B339708
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Code function: 0_2_00007FFB4B335685	0_2_00007FFB4B335685
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Code function: 0_2_00007FFB4B34145A	0_2_00007FFB4B34145A
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Code function: 0_2_00007FFB4B3401E8	0_2_00007FFB4B3401E8
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Code function: 0_2_00007FFB4B33F915	0_2_00007FFB4B33F915
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Code function: 0_2_00007FFB4B400062	0_2_00007FFB4B400062
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_00401AB3	4_2_00401AB3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_00401000	4_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_00402830	4_2_00402830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_004030AA	4_2_004030AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_004030B0	4_2_004030B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0042E993	4_2_0042E993
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0040230D	4_2_0040230D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_00402310	4_2_00402310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0040438F	4_2_0040438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0040FB9A	4_2_0040FB9A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0040FBA3	4_2_0040FBA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_00402C5A	4_2_00402C5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_00402C60	4_2_00402C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_004024C0	4_2_004024C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_004164FE	4_2_004164FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_004024B3	4_2_004024B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_00416503	4_2_00416503
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0040FDC3	4_2_0040FDC3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0040DE43	4_2_0040DE43
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05950591	4_2_05950591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592D5B0	4_2_0592D5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890535	4_2_05890535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05947571	4_2_05947571
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0593E4F6	4_2_0593E4F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594F43F	4_2_0594F43F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05942446	4_2_05942446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05881460	4_2_05881460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594F7B0	4_2_0594F7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588C7C0	4_2_0588C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B4750	4_2_058B4750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890770	4_2_05890770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059416CC	4_2_059416CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AC6E0	4_2_058AC6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589B1B0	4_2_0589B1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059501AA	4_2_059501AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059481CC	4_2_059481CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05880100	4_2_05880100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592A118	4_2_0592A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C516C	4_2_058C516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0595B16B	4_2_0595B16B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0593F0CC	4_2_0593F0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594F0E0	4_2_0594F0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059470E9	4_2_059470E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058D739A	4_2_058D739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059503E6	4_2_059503E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589E3F0	4_2_0589E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594132D	4_2_0594132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594A352	4_2_0594A352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587D34C	4_2_0587D34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058952A0	4_2_058952A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AB2C0	4_2_058AB2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059312ED	4_2_059312ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05930274	4_2_05930274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A8DBF	4_2_058A8DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AFDC0	4_2_058AFDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588ADE0	4_2_0588ADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589AD00	4_2_0589AD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05893D40	4_2_05893D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05941D5A	4_2_05941D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05947D73	4_2_05947D73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05930CB5	4_2_05930CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594FCF2	4_2_0594FCF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05880CF2	4_2_05880CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890C00	4_2_05890C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05909C32	4_2_05909C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05891F92	4_2_05891F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594FFB1	4_2_0594FFB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05882FC8	4_2_05882FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589CFE0	4_2_0589CFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594FF09	4_2_0594FF09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058D2F28	4_2_058D2F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B0F30	4_2_058B0F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05904F40	4_2_05904F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594CE93	4_2_0594CE93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A2E90	4_2_058A2E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05899EB0	4_2_05899EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594EEDB	4_2_0594EEDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594EE26	4_2_0594EE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890E59	4_2_05890E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058929A0	4_2_058929A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0595A9A6	4_2_0595A9A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05899950	4_2_05899950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AB950	4_2_058AB950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A6962	4_2_058A6962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058768B8	4_2_058768B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058938E0	4_2_058938E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BE8F0	4_2_058BE8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05892840	4_2_05892840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589A840	4_2_0589A840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AFB80	4_2_058AFB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05946BD7	4_2_05946BD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058CDBF9	4_2_058CDBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594AB40	4_2_0594AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594FB76	4_2_0594FB76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588EA80	4_2_0588EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058D5AA0	4_2_058D5AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592DAAC	4_2_0592DAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0593DAC6	4_2_0593DAC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05947A46	4_2_05947A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594FA49	4_2_0594FA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05903A6C	4_2_05903A6C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: String function: 0587B970 appears 266 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: String function: 058D7E54 appears 88 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: String function: 058C5130 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: String function: 0590F290 appears 105 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: String function: 058FEA12 appears 84 times

Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7460 -s 896

Source: PO-SINCO-PDF.exe

Static PE information: No import functions for PE file found

Source: PO-SINCO-PDF.exe, 00000000.00000002.1557832040.0000000012DE7000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameOqupufo6 vs PO-SINCO-PDF.exe

Source: 4.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 4.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.1799111466.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.1799357610.0000000005270000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: PO-SINCO-PDF.exe

Static PE information: Section .text

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@10/10@0/0

Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7460
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7604:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mvixqlf4.mpp.ps1

Source: PO-SINCO-PDF.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: PO-SINCO-PDF.exe

ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe

File read: C:\Users\user\Desktop\PO-SINCO-PDF.exe

Source: unknown	Process created: C:\Users\user\Desktop\PO-SINCO-PDF.exe "C:\Users\user\Desktop\PO-SINCO-PDF.exe"
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO-SINCO-PDF.exe" -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7460 -s 896
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO-SINCO-PDF.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Loading BitLocker PowerShell Module

Source: PO-SINCO-PDF.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PO-SINCO-PDF.exe

Static file information: File size 1394775 > 1048576

Source: PO-SINCO-PDF.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Windows.Forms.pdb source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdbP source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: mscorlib.pdb source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdbRSDS source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.pdb source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdb source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: wntdll.pdbUGP source: ngen.exe, 00000004.00000002.1799695833.0000000005850000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdb source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: wntdll.pdb source: ngen.exe, ngen.exe, 00000004.00000002.1799695833.0000000005850000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.pdbH source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdb source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: System.pdb source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERC63D.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdb source: WERC63D.tmp.dmp.8.dr

Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Code function: 0_2_00007FFB4B3300BD pushad ; iretd	0_2_00007FFB4B3300C1
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Code function: 0_2_00007FFB4B33469D pushad ; ret	0_2_00007FFB4B3346B9
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Code function: 0_2_00007FFB4B400062 push esp; retf 4810h	0_2_00007FFB4B400312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_00413063 push esi; retf	4_2_0041306E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0040C18A push 00000045h; iretd	4_2_0040C18C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0041EA00 push ebp; ret	4_2_0041EA03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0040AA21 push ss; retf	4_2_0040AA22
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_00403340 push eax; ret	4_2_00403342
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_00418BA1 pushad ; iretd	4_2_00418BA2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_00423452 push FFFFFFE2h; retf	4_2_004235B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0040D51E push 00000066h; ret	4_2_0040D523
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0040D534 push eax; iretd	4_2_0040D556
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_00418DEE push ds; ret	4_2_00418DEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0041A5A4 push cs; iretd	4_2_0041A5A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0041E627 pushfd ; ret	4_2_0041E628
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_00411FB5 push ecx; iretd	4_2_00411FB6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_004147BF push ebp; iretd	4_2_004147DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058809AD push ecx; mov dword ptr [esp], ecx	4_2_058809B6

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: PO-SINCO-PDF.exe PID: 7460, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: PO-SINCO-PDF.exe, 00000000.00000002.1555948913.0000000003073000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: PO-SINCO-PDF.exe, 00000000.00000002.1555948913.0000000003073000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Memory allocated: 11C0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Memory allocated: 1ADE0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe

Code function: 4_2_058ABD30 rdtscp

4_2_058ABD30

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7239			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2493			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe

API coverage: 0.8 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7860	Thread sleep time: -4611686018427385s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe TID: 7656	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: PO-SINCO-PDF.exe, 00000000.00000002.1555948913.0000000003073000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: PO-SINCO-PDF.exe, 00000000.00000002.1555948913.0000000003073000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: PO-SINCO-PDF.exe, 00000000.00000002.1555948913.0000000003073000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: PO-SINCO-PDF.exe, 00000000.00000002.1555948913.0000000003073000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: PO-SINCO-PDF.exe, 00000000.00000002.1555948913.0000000003073000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: PO-SINCO-PDF.exe, 00000000.00000002.1555948913.0000000003073000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: PO-SINCO-PDF.exe, 00000000.00000002.1555948913.0000000003073000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: PO-SINCO-PDF.exe, 00000000.00000002.1555948913.0000000003073000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: PO-SINCO-PDF.exe, 00000000.00000002.1555948913.0000000003073000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: PO-SINCO-PDF.exe, 00000000.00000002.1555948913.0000000003073000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: PO-SINCO-PDF.exe, 00000000.00000002.1555948913.0000000003073000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe

Code function: 4_2_058ABD30 rdtscp

4_2_058ABD30

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe

Code function: 4_2_004174B3 LdrLoadDll,

4_2_004174B3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B4588 mov eax, dword ptr fs:[00000030h]	4_2_058B4588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590B594 mov eax, dword ptr fs:[00000030h]	4_2_0590B594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590B594 mov eax, dword ptr fs:[00000030h]	4_2_0590B594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587758F mov eax, dword ptr fs:[00000030h]	4_2_0587758F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587758F mov eax, dword ptr fs:[00000030h]	4_2_0587758F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587758F mov eax, dword ptr fs:[00000030h]	4_2_0587758F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05882582 mov eax, dword ptr fs:[00000030h]	4_2_05882582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05882582 mov ecx, dword ptr fs:[00000030h]	4_2_05882582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BE59C mov eax, dword ptr fs:[00000030h]	4_2_058BE59C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A15A9 mov eax, dword ptr fs:[00000030h]	4_2_058A15A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A15A9 mov eax, dword ptr fs:[00000030h]	4_2_058A15A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A15A9 mov eax, dword ptr fs:[00000030h]	4_2_058A15A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A15A9 mov eax, dword ptr fs:[00000030h]	4_2_058A15A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A15A9 mov eax, dword ptr fs:[00000030h]	4_2_058A15A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059135BA mov eax, dword ptr fs:[00000030h]	4_2_059135BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059135BA mov eax, dword ptr fs:[00000030h]	4_2_059135BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059135BA mov eax, dword ptr fs:[00000030h]	4_2_059135BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059135BA mov eax, dword ptr fs:[00000030h]	4_2_059135BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0593F5BE mov eax, dword ptr fs:[00000030h]	4_2_0593F5BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059005A7 mov eax, dword ptr fs:[00000030h]	4_2_059005A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059005A7 mov eax, dword ptr fs:[00000030h]	4_2_059005A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059005A7 mov eax, dword ptr fs:[00000030h]	4_2_059005A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AF5B0 mov eax, dword ptr fs:[00000030h]	4_2_058AF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AF5B0 mov eax, dword ptr fs:[00000030h]	4_2_058AF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AF5B0 mov eax, dword ptr fs:[00000030h]	4_2_058AF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AF5B0 mov eax, dword ptr fs:[00000030h]	4_2_058AF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AF5B0 mov eax, dword ptr fs:[00000030h]	4_2_058AF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AF5B0 mov eax, dword ptr fs:[00000030h]	4_2_058AF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AF5B0 mov eax, dword ptr fs:[00000030h]	4_2_058AF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AF5B0 mov eax, dword ptr fs:[00000030h]	4_2_058AF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AF5B0 mov eax, dword ptr fs:[00000030h]	4_2_058AF5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A45B1 mov eax, dword ptr fs:[00000030h]	4_2_058A45B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A45B1 mov eax, dword ptr fs:[00000030h]	4_2_058A45B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059535D7 mov eax, dword ptr fs:[00000030h]	4_2_059535D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059535D7 mov eax, dword ptr fs:[00000030h]	4_2_059535D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059535D7 mov eax, dword ptr fs:[00000030h]	4_2_059535D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BE5CF mov eax, dword ptr fs:[00000030h]	4_2_058BE5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BE5CF mov eax, dword ptr fs:[00000030h]	4_2_058BE5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B55C0 mov eax, dword ptr fs:[00000030h]	4_2_058B55C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A95DA mov eax, dword ptr fs:[00000030h]	4_2_058A95DA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058865D0 mov eax, dword ptr fs:[00000030h]	4_2_058865D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BA5D0 mov eax, dword ptr fs:[00000030h]	4_2_058BA5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BA5D0 mov eax, dword ptr fs:[00000030h]	4_2_058BA5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059555C9 mov eax, dword ptr fs:[00000030h]	4_2_059555C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BC5ED mov eax, dword ptr fs:[00000030h]	4_2_058BC5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BC5ED mov eax, dword ptr fs:[00000030h]	4_2_058BC5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058825E0 mov eax, dword ptr fs:[00000030h]	4_2_058825E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AE5E7 mov eax, dword ptr fs:[00000030h]	4_2_058AE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AE5E7 mov eax, dword ptr fs:[00000030h]	4_2_058AE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AE5E7 mov eax, dword ptr fs:[00000030h]	4_2_058AE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AE5E7 mov eax, dword ptr fs:[00000030h]	4_2_058AE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AE5E7 mov eax, dword ptr fs:[00000030h]	4_2_058AE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AE5E7 mov eax, dword ptr fs:[00000030h]	4_2_058AE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AE5E7 mov eax, dword ptr fs:[00000030h]	4_2_058AE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AE5E7 mov eax, dword ptr fs:[00000030h]	4_2_058AE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A15F4 mov eax, dword ptr fs:[00000030h]	4_2_058A15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A15F4 mov eax, dword ptr fs:[00000030h]	4_2_058A15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A15F4 mov eax, dword ptr fs:[00000030h]	4_2_058A15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A15F4 mov eax, dword ptr fs:[00000030h]	4_2_058A15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A15F4 mov eax, dword ptr fs:[00000030h]	4_2_058A15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A15F4 mov eax, dword ptr fs:[00000030h]	4_2_058A15F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B7505 mov eax, dword ptr fs:[00000030h]	4_2_058B7505
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B7505 mov ecx, dword ptr fs:[00000030h]	4_2_058B7505
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05954500 mov eax, dword ptr fs:[00000030h]	4_2_05954500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05954500 mov eax, dword ptr fs:[00000030h]	4_2_05954500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05954500 mov eax, dword ptr fs:[00000030h]	4_2_05954500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05954500 mov eax, dword ptr fs:[00000030h]	4_2_05954500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05954500 mov eax, dword ptr fs:[00000030h]	4_2_05954500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05954500 mov eax, dword ptr fs:[00000030h]	4_2_05954500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05954500 mov eax, dword ptr fs:[00000030h]	4_2_05954500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05955537 mov eax, dword ptr fs:[00000030h]	4_2_05955537
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AE53E mov eax, dword ptr fs:[00000030h]	4_2_058AE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AE53E mov eax, dword ptr fs:[00000030h]	4_2_058AE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AE53E mov eax, dword ptr fs:[00000030h]	4_2_058AE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AE53E mov eax, dword ptr fs:[00000030h]	4_2_058AE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AE53E mov eax, dword ptr fs:[00000030h]	4_2_058AE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592F525 mov eax, dword ptr fs:[00000030h]	4_2_0592F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592F525 mov eax, dword ptr fs:[00000030h]	4_2_0592F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592F525 mov eax, dword ptr fs:[00000030h]	4_2_0592F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592F525 mov eax, dword ptr fs:[00000030h]	4_2_0592F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592F525 mov eax, dword ptr fs:[00000030h]	4_2_0592F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592F525 mov eax, dword ptr fs:[00000030h]	4_2_0592F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592F525 mov eax, dword ptr fs:[00000030h]	4_2_0592F525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BD530 mov eax, dword ptr fs:[00000030h]	4_2_058BD530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BD530 mov eax, dword ptr fs:[00000030h]	4_2_058BD530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890535 mov eax, dword ptr fs:[00000030h]	4_2_05890535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890535 mov eax, dword ptr fs:[00000030h]	4_2_05890535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890535 mov eax, dword ptr fs:[00000030h]	4_2_05890535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890535 mov eax, dword ptr fs:[00000030h]	4_2_05890535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890535 mov eax, dword ptr fs:[00000030h]	4_2_05890535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890535 mov eax, dword ptr fs:[00000030h]	4_2_05890535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0593B52F mov eax, dword ptr fs:[00000030h]	4_2_0593B52F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588D534 mov eax, dword ptr fs:[00000030h]	4_2_0588D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588D534 mov eax, dword ptr fs:[00000030h]	4_2_0588D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588D534 mov eax, dword ptr fs:[00000030h]	4_2_0588D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588D534 mov eax, dword ptr fs:[00000030h]	4_2_0588D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588D534 mov eax, dword ptr fs:[00000030h]	4_2_0588D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588D534 mov eax, dword ptr fs:[00000030h]	4_2_0588D534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05888550 mov eax, dword ptr fs:[00000030h]	4_2_05888550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05888550 mov eax, dword ptr fs:[00000030h]	4_2_05888550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B656A mov eax, dword ptr fs:[00000030h]	4_2_058B656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B656A mov eax, dword ptr fs:[00000030h]	4_2_058B656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B656A mov eax, dword ptr fs:[00000030h]	4_2_058B656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587B562 mov eax, dword ptr fs:[00000030h]	4_2_0587B562
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BB570 mov eax, dword ptr fs:[00000030h]	4_2_058BB570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BB570 mov eax, dword ptr fs:[00000030h]	4_2_058BB570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587B480 mov eax, dword ptr fs:[00000030h]	4_2_0587B480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05889486 mov eax, dword ptr fs:[00000030h]	4_2_05889486
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05889486 mov eax, dword ptr fs:[00000030h]	4_2_05889486
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590A4B0 mov eax, dword ptr fs:[00000030h]	4_2_0590A4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058864AB mov eax, dword ptr fs:[00000030h]	4_2_058864AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B34B0 mov eax, dword ptr fs:[00000030h]	4_2_058B34B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B44B0 mov ecx, dword ptr fs:[00000030h]	4_2_058B44B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059554DB mov eax, dword ptr fs:[00000030h]	4_2_059554DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058804E5 mov ecx, dword ptr fs:[00000030h]	4_2_058804E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059294E0 mov eax, dword ptr fs:[00000030h]	4_2_059294E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A340D mov eax, dword ptr fs:[00000030h]	4_2_058A340D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B8402 mov eax, dword ptr fs:[00000030h]	4_2_058B8402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B8402 mov eax, dword ptr fs:[00000030h]	4_2_058B8402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B8402 mov eax, dword ptr fs:[00000030h]	4_2_058B8402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587C427 mov eax, dword ptr fs:[00000030h]	4_2_0587C427
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587E420 mov eax, dword ptr fs:[00000030h]	4_2_0587E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587E420 mov eax, dword ptr fs:[00000030h]	4_2_0587E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587E420 mov eax, dword ptr fs:[00000030h]	4_2_0587E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BA430 mov eax, dword ptr fs:[00000030h]	4_2_058BA430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0593F453 mov eax, dword ptr fs:[00000030h]	4_2_0593F453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588B440 mov eax, dword ptr fs:[00000030h]	4_2_0588B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588B440 mov eax, dword ptr fs:[00000030h]	4_2_0588B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588B440 mov eax, dword ptr fs:[00000030h]	4_2_0588B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588B440 mov eax, dword ptr fs:[00000030h]	4_2_0588B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588B440 mov eax, dword ptr fs:[00000030h]	4_2_0588B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588B440 mov eax, dword ptr fs:[00000030h]	4_2_0588B440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BE443 mov eax, dword ptr fs:[00000030h]	4_2_058BE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BE443 mov eax, dword ptr fs:[00000030h]	4_2_058BE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BE443 mov eax, dword ptr fs:[00000030h]	4_2_058BE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BE443 mov eax, dword ptr fs:[00000030h]	4_2_058BE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BE443 mov eax, dword ptr fs:[00000030h]	4_2_058BE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BE443 mov eax, dword ptr fs:[00000030h]	4_2_058BE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BE443 mov eax, dword ptr fs:[00000030h]	4_2_058BE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BE443 mov eax, dword ptr fs:[00000030h]	4_2_058BE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A245A mov eax, dword ptr fs:[00000030h]	4_2_058A245A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587645D mov eax, dword ptr fs:[00000030h]	4_2_0587645D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05881460 mov eax, dword ptr fs:[00000030h]	4_2_05881460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05881460 mov eax, dword ptr fs:[00000030h]	4_2_05881460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05881460 mov eax, dword ptr fs:[00000030h]	4_2_05881460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05881460 mov eax, dword ptr fs:[00000030h]	4_2_05881460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05881460 mov eax, dword ptr fs:[00000030h]	4_2_05881460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589F460 mov eax, dword ptr fs:[00000030h]	4_2_0589F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589F460 mov eax, dword ptr fs:[00000030h]	4_2_0589F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589F460 mov eax, dword ptr fs:[00000030h]	4_2_0589F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589F460 mov eax, dword ptr fs:[00000030h]	4_2_0589F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589F460 mov eax, dword ptr fs:[00000030h]	4_2_0589F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589F460 mov eax, dword ptr fs:[00000030h]	4_2_0589F460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0595547F mov eax, dword ptr fs:[00000030h]	4_2_0595547F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AA470 mov eax, dword ptr fs:[00000030h]	4_2_058AA470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AA470 mov eax, dword ptr fs:[00000030h]	4_2_058AA470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AA470 mov eax, dword ptr fs:[00000030h]	4_2_058AA470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0593F78A mov eax, dword ptr fs:[00000030h]	4_2_0593F78A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059537B6 mov eax, dword ptr fs:[00000030h]	4_2_059537B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058807AF mov eax, dword ptr fs:[00000030h]	4_2_058807AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059097A9 mov eax, dword ptr fs:[00000030h]	4_2_059097A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AD7B0 mov eax, dword ptr fs:[00000030h]	4_2_058AD7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F7BA mov eax, dword ptr fs:[00000030h]	4_2_0587F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F7BA mov eax, dword ptr fs:[00000030h]	4_2_0587F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F7BA mov eax, dword ptr fs:[00000030h]	4_2_0587F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F7BA mov eax, dword ptr fs:[00000030h]	4_2_0587F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F7BA mov eax, dword ptr fs:[00000030h]	4_2_0587F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F7BA mov eax, dword ptr fs:[00000030h]	4_2_0587F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F7BA mov eax, dword ptr fs:[00000030h]	4_2_0587F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F7BA mov eax, dword ptr fs:[00000030h]	4_2_0587F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F7BA mov eax, dword ptr fs:[00000030h]	4_2_0587F7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590F7AF mov eax, dword ptr fs:[00000030h]	4_2_0590F7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590F7AF mov eax, dword ptr fs:[00000030h]	4_2_0590F7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590F7AF mov eax, dword ptr fs:[00000030h]	4_2_0590F7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590F7AF mov eax, dword ptr fs:[00000030h]	4_2_0590F7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590F7AF mov eax, dword ptr fs:[00000030h]	4_2_0590F7AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588C7C0 mov eax, dword ptr fs:[00000030h]	4_2_0588C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058857C0 mov eax, dword ptr fs:[00000030h]	4_2_058857C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058857C0 mov eax, dword ptr fs:[00000030h]	4_2_058857C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058857C0 mov eax, dword ptr fs:[00000030h]	4_2_058857C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A27ED mov eax, dword ptr fs:[00000030h]	4_2_058A27ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A27ED mov eax, dword ptr fs:[00000030h]	4_2_058A27ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A27ED mov eax, dword ptr fs:[00000030h]	4_2_058A27ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588D7E0 mov ecx, dword ptr fs:[00000030h]	4_2_0588D7E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058847FB mov eax, dword ptr fs:[00000030h]	4_2_058847FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058847FB mov eax, dword ptr fs:[00000030h]	4_2_058847FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05885702 mov eax, dword ptr fs:[00000030h]	4_2_05885702
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05885702 mov eax, dword ptr fs:[00000030h]	4_2_05885702
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05887703 mov eax, dword ptr fs:[00000030h]	4_2_05887703
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BC700 mov eax, dword ptr fs:[00000030h]	4_2_058BC700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BF71F mov eax, dword ptr fs:[00000030h]	4_2_058BF71F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BF71F mov eax, dword ptr fs:[00000030h]	4_2_058BF71F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05880710 mov eax, dword ptr fs:[00000030h]	4_2_05880710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B0710 mov eax, dword ptr fs:[00000030h]	4_2_058B0710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05883720 mov eax, dword ptr fs:[00000030h]	4_2_05883720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0595B73C mov eax, dword ptr fs:[00000030h]	4_2_0595B73C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0595B73C mov eax, dword ptr fs:[00000030h]	4_2_0595B73C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0595B73C mov eax, dword ptr fs:[00000030h]	4_2_0595B73C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0595B73C mov eax, dword ptr fs:[00000030h]	4_2_0595B73C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589F720 mov eax, dword ptr fs:[00000030h]	4_2_0589F720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589F720 mov eax, dword ptr fs:[00000030h]	4_2_0589F720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589F720 mov eax, dword ptr fs:[00000030h]	4_2_0589F720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BC720 mov eax, dword ptr fs:[00000030h]	4_2_058BC720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BC720 mov eax, dword ptr fs:[00000030h]	4_2_058BC720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588973A mov eax, dword ptr fs:[00000030h]	4_2_0588973A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588973A mov eax, dword ptr fs:[00000030h]	4_2_0588973A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B273C mov eax, dword ptr fs:[00000030h]	4_2_058B273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B273C mov ecx, dword ptr fs:[00000030h]	4_2_058B273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B273C mov eax, dword ptr fs:[00000030h]	4_2_058B273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05879730 mov eax, dword ptr fs:[00000030h]	4_2_05879730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05879730 mov eax, dword ptr fs:[00000030h]	4_2_05879730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0593F72E mov eax, dword ptr fs:[00000030h]	4_2_0593F72E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058FC730 mov eax, dword ptr fs:[00000030h]	4_2_058FC730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594972B mov eax, dword ptr fs:[00000030h]	4_2_0594972B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B5734 mov eax, dword ptr fs:[00000030h]	4_2_058B5734
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05904755 mov eax, dword ptr fs:[00000030h]	4_2_05904755
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B674D mov esi, dword ptr fs:[00000030h]	4_2_058B674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B674D mov eax, dword ptr fs:[00000030h]	4_2_058B674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B674D mov eax, dword ptr fs:[00000030h]	4_2_058B674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05893740 mov eax, dword ptr fs:[00000030h]	4_2_05893740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05893740 mov eax, dword ptr fs:[00000030h]	4_2_05893740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05893740 mov eax, dword ptr fs:[00000030h]	4_2_05893740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05880750 mov eax, dword ptr fs:[00000030h]	4_2_05880750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2750 mov eax, dword ptr fs:[00000030h]	4_2_058C2750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2750 mov eax, dword ptr fs:[00000030h]	4_2_058C2750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05953749 mov eax, dword ptr fs:[00000030h]	4_2_05953749
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587B765 mov eax, dword ptr fs:[00000030h]	4_2_0587B765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587B765 mov eax, dword ptr fs:[00000030h]	4_2_0587B765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587B765 mov eax, dword ptr fs:[00000030h]	4_2_0587B765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587B765 mov eax, dword ptr fs:[00000030h]	4_2_0587B765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05888770 mov eax, dword ptr fs:[00000030h]	4_2_05888770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890770 mov eax, dword ptr fs:[00000030h]	4_2_05890770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890770 mov eax, dword ptr fs:[00000030h]	4_2_05890770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890770 mov eax, dword ptr fs:[00000030h]	4_2_05890770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890770 mov eax, dword ptr fs:[00000030h]	4_2_05890770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890770 mov eax, dword ptr fs:[00000030h]	4_2_05890770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890770 mov eax, dword ptr fs:[00000030h]	4_2_05890770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890770 mov eax, dword ptr fs:[00000030h]	4_2_05890770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890770 mov eax, dword ptr fs:[00000030h]	4_2_05890770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890770 mov eax, dword ptr fs:[00000030h]	4_2_05890770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890770 mov eax, dword ptr fs:[00000030h]	4_2_05890770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890770 mov eax, dword ptr fs:[00000030h]	4_2_05890770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05890770 mov eax, dword ptr fs:[00000030h]	4_2_05890770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05884690 mov eax, dword ptr fs:[00000030h]	4_2_05884690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05884690 mov eax, dword ptr fs:[00000030h]	4_2_05884690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590368C mov eax, dword ptr fs:[00000030h]	4_2_0590368C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590368C mov eax, dword ptr fs:[00000030h]	4_2_0590368C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590368C mov eax, dword ptr fs:[00000030h]	4_2_0590368C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590368C mov eax, dword ptr fs:[00000030h]	4_2_0590368C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587D6AA mov eax, dword ptr fs:[00000030h]	4_2_0587D6AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587D6AA mov eax, dword ptr fs:[00000030h]	4_2_0587D6AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BC6A6 mov eax, dword ptr fs:[00000030h]	4_2_058BC6A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058776B2 mov eax, dword ptr fs:[00000030h]	4_2_058776B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058776B2 mov eax, dword ptr fs:[00000030h]	4_2_058776B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058776B2 mov eax, dword ptr fs:[00000030h]	4_2_058776B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B66B0 mov eax, dword ptr fs:[00000030h]	4_2_058B66B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B16CF mov eax, dword ptr fs:[00000030h]	4_2_058B16CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588B6C0 mov eax, dword ptr fs:[00000030h]	4_2_0588B6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588B6C0 mov eax, dword ptr fs:[00000030h]	4_2_0588B6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588B6C0 mov eax, dword ptr fs:[00000030h]	4_2_0588B6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588B6C0 mov eax, dword ptr fs:[00000030h]	4_2_0588B6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588B6C0 mov eax, dword ptr fs:[00000030h]	4_2_0588B6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588B6C0 mov eax, dword ptr fs:[00000030h]	4_2_0588B6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BA6C7 mov ebx, dword ptr fs:[00000030h]	4_2_058BA6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BA6C7 mov eax, dword ptr fs:[00000030h]	4_2_058BA6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0593F6C7 mov eax, dword ptr fs:[00000030h]	4_2_0593F6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059416CC mov eax, dword ptr fs:[00000030h]	4_2_059416CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059416CC mov eax, dword ptr fs:[00000030h]	4_2_059416CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059416CC mov eax, dword ptr fs:[00000030h]	4_2_059416CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059416CC mov eax, dword ptr fs:[00000030h]	4_2_059416CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059006F1 mov eax, dword ptr fs:[00000030h]	4_2_059006F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059006F1 mov eax, dword ptr fs:[00000030h]	4_2_059006F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0593D6F0 mov eax, dword ptr fs:[00000030h]	4_2_0593D6F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B36EF mov eax, dword ptr fs:[00000030h]	4_2_058B36EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AD6E0 mov eax, dword ptr fs:[00000030h]	4_2_058AD6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AD6E0 mov eax, dword ptr fs:[00000030h]	4_2_058AD6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058FE6F2 mov eax, dword ptr fs:[00000030h]	4_2_058FE6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058FE6F2 mov eax, dword ptr fs:[00000030h]	4_2_058FE6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058FE6F2 mov eax, dword ptr fs:[00000030h]	4_2_058FE6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058FE6F2 mov eax, dword ptr fs:[00000030h]	4_2_058FE6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059136EE mov eax, dword ptr fs:[00000030h]	4_2_059136EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059136EE mov eax, dword ptr fs:[00000030h]	4_2_059136EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059136EE mov eax, dword ptr fs:[00000030h]	4_2_059136EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059136EE mov eax, dword ptr fs:[00000030h]	4_2_059136EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059136EE mov eax, dword ptr fs:[00000030h]	4_2_059136EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059136EE mov eax, dword ptr fs:[00000030h]	4_2_059136EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589260B mov eax, dword ptr fs:[00000030h]	4_2_0589260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589260B mov eax, dword ptr fs:[00000030h]	4_2_0589260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589260B mov eax, dword ptr fs:[00000030h]	4_2_0589260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589260B mov eax, dword ptr fs:[00000030h]	4_2_0589260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589260B mov eax, dword ptr fs:[00000030h]	4_2_0589260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589260B mov eax, dword ptr fs:[00000030h]	4_2_0589260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589260B mov eax, dword ptr fs:[00000030h]	4_2_0589260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058FE609 mov eax, dword ptr fs:[00000030h]	4_2_058FE609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BF603 mov eax, dword ptr fs:[00000030h]	4_2_058BF603
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B1607 mov eax, dword ptr fs:[00000030h]	4_2_058B1607
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C2619 mov eax, dword ptr fs:[00000030h]	4_2_058C2619
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05883616 mov eax, dword ptr fs:[00000030h]	4_2_05883616
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05883616 mov eax, dword ptr fs:[00000030h]	4_2_05883616
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F626 mov eax, dword ptr fs:[00000030h]	4_2_0587F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F626 mov eax, dword ptr fs:[00000030h]	4_2_0587F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F626 mov eax, dword ptr fs:[00000030h]	4_2_0587F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F626 mov eax, dword ptr fs:[00000030h]	4_2_0587F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F626 mov eax, dword ptr fs:[00000030h]	4_2_0587F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F626 mov eax, dword ptr fs:[00000030h]	4_2_0587F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F626 mov eax, dword ptr fs:[00000030h]	4_2_0587F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F626 mov eax, dword ptr fs:[00000030h]	4_2_0587F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F626 mov eax, dword ptr fs:[00000030h]	4_2_0587F626
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05955636 mov eax, dword ptr fs:[00000030h]	4_2_05955636
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588262C mov eax, dword ptr fs:[00000030h]	4_2_0588262C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B6620 mov eax, dword ptr fs:[00000030h]	4_2_058B6620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B8620 mov eax, dword ptr fs:[00000030h]	4_2_058B8620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589E627 mov eax, dword ptr fs:[00000030h]	4_2_0589E627
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589C640 mov eax, dword ptr fs:[00000030h]	4_2_0589C640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BA660 mov eax, dword ptr fs:[00000030h]	4_2_058BA660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BA660 mov eax, dword ptr fs:[00000030h]	4_2_058BA660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B9660 mov eax, dword ptr fs:[00000030h]	4_2_058B9660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B9660 mov eax, dword ptr fs:[00000030h]	4_2_058B9660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594866E mov eax, dword ptr fs:[00000030h]	4_2_0594866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594866E mov eax, dword ptr fs:[00000030h]	4_2_0594866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B2674 mov eax, dword ptr fs:[00000030h]	4_2_058B2674
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C0185 mov eax, dword ptr fs:[00000030h]	4_2_058C0185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590019F mov eax, dword ptr fs:[00000030h]	4_2_0590019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590019F mov eax, dword ptr fs:[00000030h]	4_2_0590019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590019F mov eax, dword ptr fs:[00000030h]	4_2_0590019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0590019F mov eax, dword ptr fs:[00000030h]	4_2_0590019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587A197 mov eax, dword ptr fs:[00000030h]	4_2_0587A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587A197 mov eax, dword ptr fs:[00000030h]	4_2_0587A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587A197 mov eax, dword ptr fs:[00000030h]	4_2_0587A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0593C188 mov eax, dword ptr fs:[00000030h]	4_2_0593C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0593C188 mov eax, dword ptr fs:[00000030h]	4_2_0593C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058D7190 mov eax, dword ptr fs:[00000030h]	4_2_058D7190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059311A4 mov eax, dword ptr fs:[00000030h]	4_2_059311A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059311A4 mov eax, dword ptr fs:[00000030h]	4_2_059311A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059311A4 mov eax, dword ptr fs:[00000030h]	4_2_059311A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059311A4 mov eax, dword ptr fs:[00000030h]	4_2_059311A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589B1B0 mov eax, dword ptr fs:[00000030h]	4_2_0589B1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059461C3 mov eax, dword ptr fs:[00000030h]	4_2_059461C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059461C3 mov eax, dword ptr fs:[00000030h]	4_2_059461C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BD1D0 mov eax, dword ptr fs:[00000030h]	4_2_058BD1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058BD1D0 mov ecx, dword ptr fs:[00000030h]	4_2_058BD1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059551CB mov eax, dword ptr fs:[00000030h]	4_2_059551CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A51EF mov eax, dword ptr fs:[00000030h]	4_2_058A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A51EF mov eax, dword ptr fs:[00000030h]	4_2_058A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A51EF mov eax, dword ptr fs:[00000030h]	4_2_058A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A51EF mov eax, dword ptr fs:[00000030h]	4_2_058A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A51EF mov eax, dword ptr fs:[00000030h]	4_2_058A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A51EF mov eax, dword ptr fs:[00000030h]	4_2_058A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A51EF mov eax, dword ptr fs:[00000030h]	4_2_058A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A51EF mov eax, dword ptr fs:[00000030h]	4_2_058A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A51EF mov eax, dword ptr fs:[00000030h]	4_2_058A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A51EF mov eax, dword ptr fs:[00000030h]	4_2_058A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A51EF mov eax, dword ptr fs:[00000030h]	4_2_058A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A51EF mov eax, dword ptr fs:[00000030h]	4_2_058A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A51EF mov eax, dword ptr fs:[00000030h]	4_2_058A51EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058851ED mov eax, dword ptr fs:[00000030h]	4_2_058851ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059561E5 mov eax, dword ptr fs:[00000030h]	4_2_059561E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B01F8 mov eax, dword ptr fs:[00000030h]	4_2_058B01F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05940115 mov eax, dword ptr fs:[00000030h]	4_2_05940115
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592A118 mov ecx, dword ptr fs:[00000030h]	4_2_0592A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592A118 mov eax, dword ptr fs:[00000030h]	4_2_0592A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592A118 mov eax, dword ptr fs:[00000030h]	4_2_0592A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592A118 mov eax, dword ptr fs:[00000030h]	4_2_0592A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B0124 mov eax, dword ptr fs:[00000030h]	4_2_058B0124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587B136 mov eax, dword ptr fs:[00000030h]	4_2_0587B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587B136 mov eax, dword ptr fs:[00000030h]	4_2_0587B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587B136 mov eax, dword ptr fs:[00000030h]	4_2_0587B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587B136 mov eax, dword ptr fs:[00000030h]	4_2_0587B136
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05881131 mov eax, dword ptr fs:[00000030h]	4_2_05881131
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05881131 mov eax, dword ptr fs:[00000030h]	4_2_05881131
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05955152 mov eax, dword ptr fs:[00000030h]	4_2_05955152
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05879148 mov eax, dword ptr fs:[00000030h]	4_2_05879148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05879148 mov eax, dword ptr fs:[00000030h]	4_2_05879148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05879148 mov eax, dword ptr fs:[00000030h]	4_2_05879148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05879148 mov eax, dword ptr fs:[00000030h]	4_2_05879148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587C156 mov eax, dword ptr fs:[00000030h]	4_2_0587C156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05914144 mov eax, dword ptr fs:[00000030h]	4_2_05914144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05914144 mov eax, dword ptr fs:[00000030h]	4_2_05914144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05914144 mov ecx, dword ptr fs:[00000030h]	4_2_05914144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05914144 mov eax, dword ptr fs:[00000030h]	4_2_05914144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05914144 mov eax, dword ptr fs:[00000030h]	4_2_05914144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05887152 mov eax, dword ptr fs:[00000030h]	4_2_05887152
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05886154 mov eax, dword ptr fs:[00000030h]	4_2_05886154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05886154 mov eax, dword ptr fs:[00000030h]	4_2_05886154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05919179 mov eax, dword ptr fs:[00000030h]	4_2_05919179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587F172 mov eax, dword ptr fs:[00000030h]	4_2_0587F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588208A mov eax, dword ptr fs:[00000030h]	4_2_0588208A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587D08D mov eax, dword ptr fs:[00000030h]	4_2_0587D08D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B909C mov eax, dword ptr fs:[00000030h]	4_2_058B909C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AD090 mov eax, dword ptr fs:[00000030h]	4_2_058AD090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AD090 mov eax, dword ptr fs:[00000030h]	4_2_058AD090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05885096 mov eax, dword ptr fs:[00000030h]	4_2_05885096
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059460B8 mov eax, dword ptr fs:[00000030h]	4_2_059460B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059460B8 mov ecx, dword ptr fs:[00000030h]	4_2_059460B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov eax, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov ecx, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov ecx, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov eax, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov ecx, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov ecx, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov eax, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov eax, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov eax, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov eax, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov eax, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov eax, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov eax, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov eax, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov eax, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov eax, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov eax, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058970C0 mov eax, dword ptr fs:[00000030h]	4_2_058970C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059550D9 mov eax, dword ptr fs:[00000030h]	4_2_059550D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_059020DE mov eax, dword ptr fs:[00000030h]	4_2_059020DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A90DB mov eax, dword ptr fs:[00000030h]	4_2_058A90DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058880E9 mov eax, dword ptr fs:[00000030h]	4_2_058880E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587A0E3 mov ecx, dword ptr fs:[00000030h]	4_2_0587A0E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A50E4 mov eax, dword ptr fs:[00000030h]	4_2_058A50E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A50E4 mov ecx, dword ptr fs:[00000030h]	4_2_058A50E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587C0F0 mov eax, dword ptr fs:[00000030h]	4_2_0587C0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058C20F0 mov ecx, dword ptr fs:[00000030h]	4_2_058C20F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589E016 mov eax, dword ptr fs:[00000030h]	4_2_0589E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589E016 mov eax, dword ptr fs:[00000030h]	4_2_0589E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589E016 mov eax, dword ptr fs:[00000030h]	4_2_0589E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0589E016 mov eax, dword ptr fs:[00000030h]	4_2_0589E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587A020 mov eax, dword ptr fs:[00000030h]	4_2_0587A020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587C020 mov eax, dword ptr fs:[00000030h]	4_2_0587C020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594903E mov eax, dword ptr fs:[00000030h]	4_2_0594903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594903E mov eax, dword ptr fs:[00000030h]	4_2_0594903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594903E mov eax, dword ptr fs:[00000030h]	4_2_0594903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0594903E mov eax, dword ptr fs:[00000030h]	4_2_0594903E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592705E mov ebx, dword ptr fs:[00000030h]	4_2_0592705E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0592705E mov eax, dword ptr fs:[00000030h]	4_2_0592705E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05882050 mov eax, dword ptr fs:[00000030h]	4_2_05882050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AB052 mov eax, dword ptr fs:[00000030h]	4_2_058AB052
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05955060 mov eax, dword ptr fs:[00000030h]	4_2_05955060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05891070 mov eax, dword ptr fs:[00000030h]	4_2_05891070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05891070 mov ecx, dword ptr fs:[00000030h]	4_2_05891070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05891070 mov eax, dword ptr fs:[00000030h]	4_2_05891070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05891070 mov eax, dword ptr fs:[00000030h]	4_2_05891070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05891070 mov eax, dword ptr fs:[00000030h]	4_2_05891070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05891070 mov eax, dword ptr fs:[00000030h]	4_2_05891070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05891070 mov eax, dword ptr fs:[00000030h]	4_2_05891070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05891070 mov eax, dword ptr fs:[00000030h]	4_2_05891070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05891070 mov eax, dword ptr fs:[00000030h]	4_2_05891070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05891070 mov eax, dword ptr fs:[00000030h]	4_2_05891070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05891070 mov eax, dword ptr fs:[00000030h]	4_2_05891070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05891070 mov eax, dword ptr fs:[00000030h]	4_2_05891070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05891070 mov eax, dword ptr fs:[00000030h]	4_2_05891070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058AC073 mov eax, dword ptr fs:[00000030h]	4_2_058AC073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A438F mov eax, dword ptr fs:[00000030h]	4_2_058A438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A438F mov eax, dword ptr fs:[00000030h]	4_2_058A438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0595539D mov eax, dword ptr fs:[00000030h]	4_2_0595539D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587E388 mov eax, dword ptr fs:[00000030h]	4_2_0587E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587E388 mov eax, dword ptr fs:[00000030h]	4_2_0587E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0587E388 mov eax, dword ptr fs:[00000030h]	4_2_0587E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05878397 mov eax, dword ptr fs:[00000030h]	4_2_05878397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05878397 mov eax, dword ptr fs:[00000030h]	4_2_05878397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_05878397 mov eax, dword ptr fs:[00000030h]	4_2_05878397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058D739A mov eax, dword ptr fs:[00000030h]	4_2_058D739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058D739A mov eax, dword ptr fs:[00000030h]	4_2_058D739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B33A0 mov eax, dword ptr fs:[00000030h]	4_2_058B33A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058B33A0 mov eax, dword ptr fs:[00000030h]	4_2_058B33A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058A33A5 mov eax, dword ptr fs:[00000030h]	4_2_058A33A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0593B3D0 mov ecx, dword ptr fs:[00000030h]	4_2_0593B3D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0588A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0588A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0588A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0588A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0588A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0588A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0588A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058883C0 mov eax, dword ptr fs:[00000030h]	4_2_058883C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058883C0 mov eax, dword ptr fs:[00000030h]	4_2_058883C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058883C0 mov eax, dword ptr fs:[00000030h]	4_2_058883C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058883C0 mov eax, dword ptr fs:[00000030h]	4_2_058883C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_0593C3CD mov eax, dword ptr fs:[00000030h]	4_2_0593C3CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058903E9 mov eax, dword ptr fs:[00000030h]	4_2_058903E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058903E9 mov eax, dword ptr fs:[00000030h]	4_2_058903E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058903E9 mov eax, dword ptr fs:[00000030h]	4_2_058903E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Code function: 4_2_058903E9 mov eax, dword ptr fs:[00000030h]	4_2_058903E9

Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe

Memory allocated: page read and write | page guard

.NET source code references suspicious native API functions

HIPS / PFW / Operating System Protection Evasion

Source: PO-SINCO-PDF.exe, ---.cs	Reference to suspicious API methods: LoadLibrary(_FDC9_06FE_FD45_06EB(0))
Source: PO-SINCO-PDF.exe, ---.cs	Reference to suspicious API methods: GetProcAddress(_061C_FBCA_FDE5_FDE6_064E_0609_FBB3, _FDC9_06FE_FD45_06EB(12))
Source: PO-SINCO-PDF.exe, ---.cs	Reference to suspicious API methods: VirtualProtect(procAddress, (uint)_06E8_061D.Count, 64u, out _061D_06DA_FDEA_FDED_FBBD_0607)

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO-SINCO-PDF.exe" -Force
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO-SINCO-PDF.exe" -Force			Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 400000 protect: page execute and read and write

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 4FED008	Jump to behavior

Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO-SINCO-PDF.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe	Queries volume information: C:\Users\user\Desktop\PO-SINCO-PDF.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Disables UAC (registry)

Source: C:\Users\user\Desktop\PO-SINCO-PDF.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Source: Yara match	File source: 4.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1799111466.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1799357610.0000000005270000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Source: Yara match	File source: 4.2.ngen.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ngen.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1799111466.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1799357610.0000000005270000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	311 Process Injection	21 Disable or Modify Tools	OS Credential Dumping	131 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
PO-SINCO-PDF.exe	50%	ReversingLabs	Win64.Trojan.Swotter
PO-SINCO-PDF.exe	100%	Avira	TR/AD.Swotter.ujscr
PO-SINCO-PDF.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.8.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538504
Start date and time:	2024-10-21 13:16:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO-SINCO-PDF.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@10/10@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 82% Number of executed functions: 22 Number of non-executed functions: 239
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.22
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: PO-SINCO-PDF.exe

Simulations

Behavior and APIs

Time	Type	Description
07:17:08	API Interceptor	23x Sleep call for process: powershell.exe modified
07:17:16	API Interceptor	1x Sleep call for process: WerFault.exe modified
07:17:38	API Interceptor	3x Sleep call for process: ngen.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PO-SINCO-PDF.exe_2124842be94b53df48482161971cf6d3b1c6d74_f89742f5_046ffd4c-7bee-4f4d-bb98-98cece3cb9e1\Report.wer

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1534357349203241
Encrypted:	false
SSDEEP:	192:Mxbd+aKo0UnUFaWBHaWrpmIdzuiFVZ24lO8+:kKDUnUFamHajIzuiFVY4lO8+
MD5:	DF02CE3679EDE8B88F00AC1A3FC18812
SHA1:	D71860DCF25A1CAFC1E3B5010E70C7562522DDF2
SHA-256:	CC1B4274D4091ADF8EE93D3B3FD807C898D2DD890506CB10BE5AF5A5B2384EEC
SHA-512:	8470CC542599FD3B238EABF1B099878EF2FAFE2050C6C81C90846692536238771DBA388CD9F909E5B8D89540803D0415F658A024A16E69A7F03BECE0B9FE481B
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.9.8.3.0.2.6.9.5.3.1.3.5.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.9.8.3.0.2.8.5.6.2.5.2.4.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.4.6.f.f.d.4.c.-.7.b.e.e.-.4.f.4.d.-.b.b.9.8.-.9.8.c.e.c.e.3.c.b.9.e.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.6.6.7.5.8.3.8.-.9.8.7.e.-.4.7.8.a.-.a.8.9.c.-.2.e.6.b.4.c.e.4.a.f.0.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.P.O.-.S.I.N.C.O.-.P.D.F...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.2.4.-.0.0.0.1.-.0.0.1.4.-.f.b.d.7.-.9.8.c.1.a.a.2.3.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.d.c.8.e.a.3.a.a.0.d.5.b.0.2.3.7.3.f.8.4.7.2.1.8.8.b.a.8.1.8.6.0.0.0.0.f.f.f.f.!.0.0.0.0.0.4.f.b.9.b.8.1.b.3.a.5.b.c.1.2.a.5.9.1.8.2.9.f.e.3.2.f.0.3.2.0.0.3.3.7.1.3.9.3.!.P.O.-.S.I.N.C.O.-.P.D.F...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC63D.tmp.dmp

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Mon Oct 21 11:17:07 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	471150
Entropy (8bit):	3.1390285426282305
Encrypted:	false
SSDEEP:	3072:gHIFZJGLIvsFT1CCq6oxFI3+v4zzEa6L4FJE1cSEWCcZlSgkl+J0:geZJGLkiqS3Qc6PEWNnG
MD5:	3E352ACC6EF435115A77C3488607F833
SHA1:	DAF3725BC4FEB3D440249069093E755812889154
SHA-256:	332A0244559855A4B61E8CE37EF3B8CB2955F7D70370CC8D9C025F4EACDD739A
SHA-512:	D4E3A9A8DA86DE2F16BB4BE983FA0145EA5FD7A2D1981B7D727F54D8D2CAA9D6B64F09ADD3DFC005970063B68C91A818072480A1ACF102821EED2C446AF2DE49
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......38.g............t.......................$...p%...........%......$N..............l.......8...........T...........(8..F............C...........E..............................................................................eJ......,F......Lw......................T.......$.../8.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC90D.tmp.WERInternalMetadata.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8606
Entropy (8bit):	3.7144139503105817
Encrypted:	false
SSDEEP:	192:R6l7wVeJJmf6YSuKegmfjMwpr189bBbtXfYbR7jm:R6lXJ4f6YbKegmfjM3BbtfE6
MD5:	46C34D13EC27A172B9B60A2FC78F0DB7
SHA1:	94A965678BCF3B09BB246FACF09C94E570F5A06E
SHA-256:	F53CD7AE169557841AB8F9580BF2720EE9CB6796291FEA459D67A025A1AF1A6A
SHA-512:	46404C923886278DA02994C6ACCBF5E19593D4728A6BFC45E33630F3BD3E5AADA670DD59B0EE5A8F92ED54B11433E31EDB49E6586CEF1C0D80CB6D2BA685C4BA
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.6.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC96C.tmp.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4703
Entropy (8bit):	4.541993759756208
Encrypted:	false
SSDEEP:	48:cvIwWl8zsBJg771I9BWWpW8VYUHPYm8M4JwasQFboyq85QExrUIXid:uIjfTI7+37VzHSJwHUxrUIXid
MD5:	77620C7F59F384EB5081F01320005710
SHA1:	D6A5C0CFA968BBF16EC110BDE2F80532B3AC40E5
SHA-256:	0295644605E9F8908A0F30B3BE05ECA19EA00EEC1B596C35E58FB6C2CE1CE6D5
SHA-512:	E5F512362DA5AC7010E8C25E010F9F7F1EE1050C7E5FFFA97F17B75BA81CC22D32B2180F2D25B713CF914562E7A6E029E368F4D9B40D91AB3801B84A42E5D5BA
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="553099" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a4egxohx.mgi.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mvixqlf4.mpp.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pbs3lj2r.twe.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zi5uq1v5.0ld.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.37226329880328
Encrypted:	false
SSDEEP:	6144:oFVfpi6ceLP/9skLmb08yWWSPtaJG8nAge35OlMMhA2AX4WABlguNLiL:QV1iyWWI/glMM6kF7Zq
MD5:	FDE277A4DC5F6113CEE35A243EA6E596
SHA1:	77FAC6F5E2ADDF096AAD0FC18EC9050FC707F205
SHA-256:	AA323942041164BAECC317E1F766FCDC0E21B46DF8CE6331EB0ABA4EC8C58774
SHA-512:	CCDBDBA05A5ED0B3B0E7584D1740ADF1C3F357D6A6201033D02FB751182E7DE4D7DAAE747B888BEABEC75DB46D7B9EA433369A8DDFE8EE9AF125D1F9DD3036AA
Malicious:	false
Preview:	regfC...C....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..o.#................................................................................................................................................................................................................................................................................................................................................x.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.085910440903904
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PO-SINCO-PDF.exe
File size:	1'394'775 bytes
MD5:	d211d2330e29f7b1a0347e9041fed469
SHA1:	04fb9b81b3a5bc12a591829fe32f032003371393
SHA256:	bf7bccbcb60997695061aa9e272cdd14400b5e64727a826baa26f22a41757069
SHA512:	9fc73f600284265746bacc9052efb6a08731a339b0a7b67827d81ea7722f8e2e84fce2cfe4ef8cf8ef1a914e7c667e42a7cca108203c46a80a9696eff968b6f5
SSDEEP:	12288:0+hzChGCSH40QTVYMdmE8b+9ZuxYbNOfI6oBxeuP1lSNpbPqUrav29fY:0GChmY0QVl99Z2YxORCeiqfhfY
TLSH:	D65512127D4B8C93FD4A1A32E8C4B1F486FC9F6370F9849FEF564D8894041BE2965A72
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....=.g.........."...0..+............... ....@...... .......................`............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67123D8F [Fri Oct 18 10:50:55 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2b1a	0x2c00	998ba3545683c2d627b41313f17cb06a	False	0.6457741477272727	data	6.147838511010182	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Target ID:	0
Start time:	07:17:03
Start date:	21/10/2024
Path:	C:\Users\user\Desktop\PO-SINCO-PDF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\PO-SINCO-PDF.exe"
Imagebase:	0x990000
File size:	1'394'775 bytes
MD5 hash:	D211D2330E29F7B1A0347E9041FED469
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1555948913.0000000003073000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	07:17:06
Start date:	21/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO-SINCO-PDF.exe" -Force
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	07:17:06
Start date:	21/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	07:17:06
Start date:	21/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
Imagebase:	0x500000
File size:	144'344 bytes
MD5 hash:	417D6EA61C097F8DF6FEF2A57F9692DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.1799111466.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.1799111466.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.1799357610.0000000005270000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.1799357610.0000000005270000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Target ID:	5
Start time:	07:17:06
Start date:	21/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
Imagebase:
File size:	144'344 bytes
MD5 hash:	417D6EA61C097F8DF6FEF2A57F9692DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	8
Start time:	07:17:06
Start date:	21/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7460 -s 896
Imagebase:	0x7ff6b11b0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	07:17:11
Start date:	21/10/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff605670000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false