Analysis Report ORDER.exe

Overview

General Information

Sample Name:	ORDER.exe
Analysis ID:	433263
MD5:	425f6b1e9437b1f1db352d1393d236d5
SHA1:	65cf68fdda68b0327d51b7e3989afaa2258d4c6d
SHA256:	cfb1e4b65fc8e0d9ca698ab5e67fc77735880b8439a6f4ee4e48be06ca631dc2
Tags:	exeNanoCore
Infos:
Most interesting Screenshot:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Nanocore Rat

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: NanoCore

Yara detected AntiVM3

Yara detected Nanocore RAT

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code contains very large strings

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Antivirus or Machine Learning detection for unpacked file

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Signatures

AV Detection:

Found malware configuration

Source: 0000000D.00000002.909542100.0000000003D17000.00000004.00000001.sdmp

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "30b6fbac-dd0d-47bd-b8ab-6df66b01", "Group": "Default", "Domain1": "kjjuigfdullygigyftkuyluylygilyfidyyuljhd.ydns.eu", "Domain2": "", "Port": 1187, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n <RegistrationInfo />\r\n <Triggers />\r\n <Principals>\r\n <Principal id=\"Author\">\r\n <LogonType>InteractiveToken</LogonType>\r\n <RunLevel>HighestAvailable</RunLevel>\r\n </Principal>\r\n </Principals>\r\n <Settings>\r\n <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n <AllowHardTerminate>true</AllowHardTerminate>\r\n <StartWhenAvailable>false</StartWhenAvailable>\r\n <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n <IdleSettings>\r\n <StopOnIdleEnd>false</StopOnIdleEnd>\r\n <RestartOnIdle>false</RestartOnIdle>\r\n </IdleSettings>\r\n <AllowStartOnDemand>true</AllowStartOnDemand>\r\n <Enabled>true</Enabled>\r\n <Hidden>false</Hidden>\r\n <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n <WakeToRun>false</WakeToRun>\r\n <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n <Priority>4</Priority>\r\n </Settings>\r\n <Actions Context=\"Author\">\r\n <Exec>\r\n <Command>\"#EXECUTABLEPATH\"</Command>\r\n <Arguments>$(Arg0)</Arguments>\r\n </Exec>\r\n </Actions>\r\n</Task"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Odstcl.exe

ReversingLabs: Detection: 45%

Multi AV Scanner detection for submitted file

Source: ORDER.exe	Virustotal: Detection: 33%			Perma Link
Source: ORDER.exe	ReversingLabs: Detection: 45%

Yara detected Nanocore RAT

Source: Yara match	File source: 0000000D.00000002.906988359.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.815063432.0000000003D01000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.909542100.0000000003D17000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000000.809591547.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.733532456.0000000003B71000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.728181195.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000000.810011437.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.824635528.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.826135770.0000000002B71000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.728520571.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.826223724.0000000003B71000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.911027683.00000000059C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.733930181.0000000003D27000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ORDER.exe PID: 6952, type: MEMORY
Source: Yara match	File source: Process Memory Space: ORDER.exe PID: 4480, type: MEMORY
Source: Yara match	File source: Process Memory Space: ORDER.exe PID: 7148, type: MEMORY
Source: Yara match	File source: 16.2.ORDER.exe.3e07b90.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.ORDER.exe.59c4629.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ORDER.exe.3c77b90.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.ORDER.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.ORDER.exe.3bb9cd6.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.0.ORDER.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.ORDER.exe.59c0000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.0.ORDER.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ORDER.exe.3c77b90.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.ORDER.exe.3bbeb0c.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.0.ORDER.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.ORDER.exe.3bbeb0c.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.ORDER.exe.59c0000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.ORDER.exe.3d1eb0c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.0.ORDER.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.ORDER.exe.3d23135.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.ORDER.exe.3bc3135.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.ORDER.exe.3d19cd6.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.ORDER.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.ORDER.exe.3d1eb0c.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ORDER.exe.3ec1978.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.ORDER.exe.3e07b90.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ORDER.exe.3e35f68.3.raw.unpack, type: UNPACKEDPE

Antivirus or Machine Learning detection for unpacked file

Source: 24.2.ORDER.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 24.0.ORDER.exe.400000.3.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 13.0.ORDER.exe.400000.1.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 24.0.ORDER.exe.400000.1.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 13.0.ORDER.exe.400000.3.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 13.2.ORDER.exe.59c0000.11.unpack	Avira: Label: TR/NanoCore.fadte
Source: 13.2.ORDER.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7

Compliance:

Uses 32bit PE files

Source: ORDER.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\ORDER.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Source: Malware configuration extractor	URLs:
Source: Malware configuration extractor	URLs: kjjuigfdullygigyftkuyluylygilyfidyyuljhd.ydns.eu

Source: ORDER.exe, 00000001.00000003.640616008.0000000000F8D000.00000004.00000001.sdmp	String found in binary or memory: http://en.wI
Source: ORDER.exe, 00000001.00000003.641053984.000000000507B000.00000004.00000001.sdmp	String found in binary or memory: http://en.wa
Source: ORDER.exe, 00000001.00000002.738124687.0000000006272000.00000004.00000001.sdmp, ORDER.exe, 00000010.00000002.816314596.0000000005270000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: ORDER.exe, 00000001.00000002.738124687.0000000006272000.00000004.00000001.sdmp, ORDER.exe, 00000010.00000002.816314596.0000000005270000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: ORDER.exe, 00000001.00000003.644894489.000000000509E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: ORDER.exe, 00000001.00000003.644749277.000000000509E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comC
Source: ORDER.exe, 00000001.00000003.644894489.000000000509E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comTC3
Source: ORDER.exe, 00000001.00000003.644669004.000000000509E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comexc
Source: ORDER.exe, 00000001.00000003.644792909.000000000509E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comgne
Source: ORDER.exe, 00000001.00000003.644669004.000000000509E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comhly
Source: ORDER.exe, 00000001.00000002.738124687.0000000006272000.00000004.00000001.sdmp, ORDER.exe, 00000010.00000002.816314596.0000000005270000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: ORDER.exe, 00000001.00000003.644792909.000000000509E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comnewk
Source: ORDER.exe, 00000001.00000003.644669004.000000000509E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comona
Source: ORDER.exe, 00000001.00000003.644669004.000000000509E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comtal
Source: ORDER.exe, 00000001.00000003.644894489.000000000509E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comy
Source: ORDER.exe, 00000001.00000002.738124687.0000000006272000.00000004.00000001.sdmp, ORDER.exe, 00000010.00000002.816314596.0000000005270000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: ORDER.exe, 00000001.00000003.728655998.0000000005060000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com(G
Source: ORDER.exe, 00000010.00000002.816314596.0000000005270000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: ORDER.exe, 00000001.00000003.648432320.0000000005099000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/
Source: ORDER.exe, 00000001.00000002.738124687.0000000006272000.00000004.00000001.sdmp, ORDER.exe, 00000010.00000002.816314596.0000000005270000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: ORDER.exe, 00000001.00000002.738124687.0000000006272000.00000004.00000001.sdmp, ORDER.exe, 00000010.00000002.816314596.0000000005270000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: ORDER.exe, 00000001.00000002.738124687.0000000006272000.00000004.00000001.sdmp, ORDER.exe, 00000001.00000003.649010830.0000000005099000.00000004.00000001.sdmp, ORDER.exe, 00000010.00000002.816314596.0000000005270000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: ORDER.exe, 00000001.00000002.738124687.0000000006272000.00000004.00000001.sdmp, ORDER.exe, 00000010.00000002.816314596.0000000005270000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: ORDER.exe, 00000001.00000003.648728149.0000000005099000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers:
Source: ORDER.exe, 00000001.00000002.738124687.0000000006272000.00000004.00000001.sdmp, ORDER.exe, 00000010.00000002.816314596.0000000005270000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: ORDER.exe, 00000001.00000003.649737674.0000000005095000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersD
Source: ORDER.exe, 00000001.00000003.648477020.0000000005099000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersF
Source: ORDER.exe, 00000001.00000002.738124687.0000000006272000.00000004.00000001.sdmp, ORDER.exe, 00000010.00000002.816314596.0000000005270000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: ORDER.exe, 00000001.00000003.649531830.0000000005095000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersn
Source: ORDER.exe, 00000001.00000003.649881909.0000000005064000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com9
Source: ORDER.exe, 00000001.00000003.649881909.0000000005064000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comF
Source: ORDER.exe, 00000001.00000003.649881909.0000000005064000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comF(G
Source: ORDER.exe, 00000001.00000003.649881909.0000000005064000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comalicLG$
Source: ORDER.exe, 00000001.00000003.649881909.0000000005064000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comalsF
Source: ORDER.exe, 00000001.00000003.649881909.0000000005064000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comalsadF
Source: ORDER.exe, 00000001.00000003.728655998.0000000005060000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comgrito
Source: ORDER.exe, 00000001.00000003.649881909.0000000005064000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comlic
Source: ORDER.exe, 00000001.00000003.728655998.0000000005060000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comuec:G~
Source: ORDER.exe, 00000001.00000003.641053984.000000000507B000.00000004.00000001.sdmp, ORDER.exe, 00000010.00000002.816314596.0000000005270000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: ORDER.exe, 00000001.00000003.641053984.000000000507B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com8
Source: ORDER.exe, 00000001.00000003.641080097.000000000507B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comn
Source: ORDER.exe, 00000001.00000003.641080097.000000000507B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comro
Source: ORDER.exe, 00000001.00000002.738124687.0000000006272000.00000004.00000001.sdmp, ORDER.exe, 00000001.00000003.644123942.0000000005064000.00000004.00000001.sdmp, ORDER.exe, 00000001.00000003.644069423.000000000509D000.00000004.00000001.sdmp, ORDER.exe, 00000010.00000002.816314596.0000000005270000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: ORDER.exe, 00000001.00000002.738124687.0000000006272000.00000004.00000001.sdmp, ORDER.exe, 00000010.00000002.816314596.0000000005270000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: ORDER.exe, 00000001.00000003.644329844.0000000005064000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/c
Source: ORDER.exe, 00000001.00000002.738124687.0000000006272000.00000004.00000001.sdmp, ORDER.exe, 00000010.00000002.816314596.0000000005270000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: ORDER.exe, 00000001.00000003.644399534.000000000506B000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cngH
Source: ORDER.exe, 00000001.00000003.644069423.000000000509D000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cns-c
Source: ORDER.exe, 00000001.00000003.644069423.000000000509D000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnt-p
Source: ORDER.exe, 00000001.00000003.651124405.000000000506D000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: ORDER.exe, 00000001.00000002.738124687.0000000006272000.00000004.00000001.sdmp, ORDER.exe, 00000010.00000002.816314596.0000000005270000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: ORDER.exe, 00000001.00000002.738124687.0000000006272000.00000004.00000001.sdmp, ORDER.exe, 00000010.00000002.816314596.0000000005270000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: ORDER.exe, 00000001.00000002.738124687.0000000006272000.00000004.00000001.sdmp, ORDER.exe, 00000010.00000002.816314596.0000000005270000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: ORDER.exe, 00000001.00000002.738124687.0000000006272000.00000004.00000001.sdmp, ORDER.exe, 00000010.00000002.816314596.0000000005270000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: ORDER.exe, 00000001.00000002.738124687.0000000006272000.00000004.00000001.sdmp, ORDER.exe, 00000010.00000002.816314596.0000000005270000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: ORDER.exe, 00000001.00000003.641053984.000000000507B000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com-d
Source: ORDER.exe, 00000001.00000002.738124687.0000000006272000.00000004.00000001.sdmp, ORDER.exe, 00000010.00000002.816314596.0000000005270000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: ORDER.exe, 00000001.00000003.642523808.0000000005069000.00000004.00000001.sdmp, ORDER.exe, 00000001.00000002.738124687.0000000006272000.00000004.00000001.sdmp, ORDER.exe, 00000010.00000002.816314596.0000000005270000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: ORDER.exe, 00000001.00000003.642523808.0000000005069000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr2Dq
Source: ORDER.exe, 00000001.00000003.642523808.0000000005069000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr;D~
Source: ORDER.exe, 00000010.00000002.816314596.0000000005270000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: ORDER.exe, 00000001.00000003.641383898.000000000507B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comFTd
Source: ORDER.exe, 00000001.00000003.641383898.000000000507B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comMd
Source: ORDER.exe, 00000001.00000003.641327316.000000000507B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comn7dc
Source: ORDER.exe, 00000001.00000002.738124687.0000000006272000.00000004.00000001.sdmp, ORDER.exe, 00000010.00000002.816314596.0000000005270000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: ORDER.exe, 00000001.00000002.738124687.0000000006272000.00000004.00000001.sdmp, ORDER.exe, 00000010.00000002.816314596.0000000005270000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: ORDER.exe, 00000001.00000002.738124687.0000000006272000.00000004.00000001.sdmp, ORDER.exe, 00000010.00000002.816314596.0000000005270000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Source: 0000000D.00000002.906988359.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000D.00000002.906988359.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000010.00000002.815063432.0000000003D01000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000010.00000002.815063432.0000000003D01000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000D.00000002.909542100.0000000003D17000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000018.00000000.809591547.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000018.00000000.809591547.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000002.733532456.0000000003B71000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000002.733532456.0000000003B71000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000D.00000000.728181195.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000D.00000000.728181195.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000018.00000000.810011437.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000018.00000000.810011437.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000018.00000002.824635528.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000018.00000002.824635528.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000018.00000002.826135770.0000000002B71000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000D.00000002.910722949.0000000005600000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000D.00000000.728520571.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000D.00000000.728520571.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000018.00000002.826223724.0000000003B71000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000D.00000002.911027683.00000000059C0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000002.733930181.0000000003D27000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000002.733930181.0000000003D27000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: ORDER.exe PID: 6952, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: ORDER.exe PID: 6952, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: ORDER.exe PID: 4480, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: ORDER.exe PID: 4480, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: ORDER.exe PID: 7148, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: ORDER.exe PID: 7148, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 24.2.ORDER.exe.2b93884.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 16.2.ORDER.exe.3e07b90.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 16.2.ORDER.exe.3e07b90.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.ORDER.exe.3c77b90.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.2.ORDER.exe.59c4629.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.ORDER.exe.3c77b90.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 24.2.ORDER.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 24.2.ORDER.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 24.2.ORDER.exe.3bb9cd6.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 24.2.ORDER.exe.3bb9cd6.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 13.2.ORDER.exe.59c0000.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 24.0.ORDER.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 24.0.ORDER.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 24.0.ORDER.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 24.0.ORDER.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.ORDER.exe.3c77b90.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.ORDER.exe.3c77b90.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 13.2.ORDER.exe.5600000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 24.2.ORDER.exe.3bbeb0c.5.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.0.ORDER.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.0.ORDER.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 24.2.ORDER.exe.3bbeb0c.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.2.ORDER.exe.59c0000.11.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.2.ORDER.exe.3d1eb0c.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.0.ORDER.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.0.ORDER.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 13.2.ORDER.exe.3d23135.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 24.2.ORDER.exe.3bc3135.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.2.ORDER.exe.2ce1648.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.2.ORDER.exe.3d19cd6.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.2.ORDER.exe.3d19cd6.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 13.2.ORDER.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 13.2.ORDER.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 13.2.ORDER.exe.3d1eb0c.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.ORDER.exe.3ec1978.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.ORDER.exe.3ec1978.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 16.2.ORDER.exe.3e07b90.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 16.2.ORDER.exe.3e07b90.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.ORDER.exe.3e35f68.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.ORDER.exe.3e35f68.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Source: ORDER.exe, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: Odstcl.exe.1.dr, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: 1.0.ORDER.exe.470000.0.unpack, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: 1.2.ORDER.exe.470000.0.unpack, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: 13.0.ORDER.exe.690000.2.unpack, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: 13.0.ORDER.exe.690000.4.unpack, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: 13.2.ORDER.exe.690000.1.unpack, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: 13.0.ORDER.exe.690000.0.unpack, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: 16.2.ORDER.exe.590000.0.unpack, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: 16.0.ORDER.exe.590000.0.unpack, ContactManagement/ContactForm.cs	Long String: Length: 11840
Source: 24.0.ORDER.exe.550000.4.unpack, ContactManagement/ContactForm.cs	Long String: Length: 11840

Source: C:\Users\user\Desktop\ORDER.exe	Code function: 13_2_04FE152A NtQuerySystemInformation,		13_2_04FE152A
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 13_2_04FE14EF NtQuerySystemInformation,		13_2_04FE14EF

Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_00BE2477	1_2_00BE2477
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB20B8	1_2_04CB20B8
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CBC9C0	1_2_04CBC9C0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB0180	1_2_04CB0180
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB56A0	1_2_04CB56A0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB3678	1_2_04CB3678
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB3E28	1_2_04CB3E28
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB47C1	1_2_04CB47C1
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CBBB80	1_2_04CBBB80
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CBC720	1_2_04CBC720
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB2731	1_2_04CB2731
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CBB48E	1_2_04CBB48E
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CBA480	1_2_04CBA480
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CBB490	1_2_04CBB490
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB20A9	1_2_04CB20A9
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CBC4A8	1_2_04CBC4A8
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB70B8	1_2_04CB70B8
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB7860	1_2_04CB7860
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB7870	1_2_04CB7870
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB9C00	1_2_04CB9C00
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB89C8	1_2_04CB89C8
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB75F9	1_2_04CB75F9
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CBC9B0	1_2_04CBC9B0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB0170	1_2_04CB0170
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CBA504	1_2_04CBA504
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB568B	1_2_04CB568B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB365B	1_2_04CB365B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB9E51	1_2_04CB9E51
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB9E60	1_2_04CB9E60
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB7608	1_2_04CB7608
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB7A11	1_2_04CB7A11
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB6E20	1_2_04CB6E20
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB6E30	1_2_04CB6E30
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB73E0	1_2_04CB73E0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB9BF1	1_2_04CB9BF1
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB73F0	1_2_04CB73F0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB8F98	1_2_04CB8F98
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB8F5B	1_2_04CB8F5B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CBA76A	1_2_04CBA76A
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB9768	1_2_04CB9768
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CBBB7B	1_2_04CBBB7B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB9778	1_2_04CB9778
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB2B78	1_2_04CB2B78
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 13_2_04ECB0A0	13_2_04ECB0A0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 13_2_04EC3850	13_2_04EC3850
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 13_2_04EC86B8	13_2_04EC86B8
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 13_2_04EC92B8	13_2_04EC92B8
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 13_2_04EC2FA8	13_2_04EC2FA8
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 13_2_04EC23A0	13_2_04EC23A0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 13_2_04EC306F	13_2_04EC306F
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 13_2_04EC95CB	13_2_04EC95CB
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 13_2_04EC9B60	13_2_04EC9B60
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 13_2_04EC937F	13_2_04EC937F
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D3678	16_2_027D3678
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D3E30	16_2_027D3E30
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027DC6B0	16_2_027DC6B0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D56A0	16_2_027D56A0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D2740	16_2_027D2740
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027DBB00	16_2_027DBB00
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D47D0	16_2_027D47D0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D20B8	16_2_027D20B8
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027DC940	16_2_027DC940
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D0180	16_2_027D0180
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D9E60	16_2_027D9E60
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D9E51	16_2_027D9E51
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D6E30	16_2_027D6E30
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D7A20	16_2_027D7A20
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D6E20	16_2_027D6E20
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D3E23	16_2_027D3E23
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D7A11	16_2_027D7A11
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D3609	16_2_027D3609
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D7608	16_2_027D7608
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027DBAF0	16_2_027DBAF0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027DAACF	16_2_027DAACF
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027DC6A0	16_2_027DC6A0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D5687	16_2_027D5687
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D9778	16_2_027D9778
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D2B73	16_2_027D2B73
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D9768	16_2_027D9768
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027DA76A	16_2_027DA76A
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D8F41	16_2_027D8F41
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D9BF1	16_2_027D9BF1
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D73F0	16_2_027D73F0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D73E0	16_2_027D73E0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D47C3	16_2_027D47C3
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D8F98	16_2_027D8F98
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D2B80	16_2_027D2B80
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D7870	16_2_027D7870
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D7860	16_2_027D7860
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D8448	16_2_027D8448
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027DC438	16_2_027DC438
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027DC428	16_2_027DC428
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027DA418	16_2_027DA418
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D9C00	16_2_027D9C00
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D70C8	16_2_027D70C8
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D70B8	16_2_027D70B8
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D20A9	16_2_027D20A9
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027DB490	16_2_027DB490
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027DB48B	16_2_027DB48B
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027DA480	16_2_027DA480
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D0170	16_2_027D0170
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027DC930	16_2_027DC930
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027DA504	16_2_027DA504
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D75F9	16_2_027D75F9
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D3DE0	16_2_027D3DE0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D35D8	16_2_027D35D8
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D89C8	16_2_027D89C8
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D89C1	16_2_027D89C1
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 16_2_027D55A0	16_2_027D55A0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 24_2_04DB2FA8	24_2_04DB2FA8
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 24_2_04DB23A0	24_2_04DB23A0
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 24_2_04DB3850	24_2_04DB3850
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 24_2_04DB306F	24_2_04DB306F

Source: ORDER.exe	Binary or memory string: OriginalFilename vs ORDER.exe
Source: ORDER.exe, 00000001.00000000.639462168.0000000000472000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameCEXv.exeF vs ORDER.exe
Source: ORDER.exe, 00000001.00000002.738501405.0000000006650000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs ORDER.exe
Source: ORDER.exe, 00000001.00000002.738764924.0000000006870000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs ORDER.exe
Source: ORDER.exe, 00000001.00000002.735079668.0000000005000000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameWindowsNetwork.dll> vs ORDER.exe
Source: ORDER.exe, 00000001.00000002.739147705.0000000006B30000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs ORDER.exe
Source: ORDER.exe, 00000001.00000002.739147705.0000000006B30000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs ORDER.exe
Source: ORDER.exe, 00000001.00000002.739054988.0000000006AD0000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs ORDER.exe
Source: ORDER.exe	Binary or memory string: OriginalFilename vs ORDER.exe
Source: ORDER.exe, 0000000D.00000002.910993960.00000000059B0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs ORDER.exe
Source: ORDER.exe, 0000000D.00000002.907073021.0000000000692000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameCEXv.exeF vs ORDER.exe
Source: ORDER.exe, 0000000D.00000002.909542100.0000000003D17000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs ORDER.exe
Source: ORDER.exe, 0000000D.00000002.909542100.0000000003D17000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs ORDER.exe
Source: ORDER.exe, 0000000D.00000002.910515299.00000000055A0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs ORDER.exe
Source: ORDER.exe, 0000000D.00000002.911600537.0000000006270000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs ORDER.exe
Source: ORDER.exe, 0000000D.00000002.909926045.0000000004FD0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs ORDER.exe
Source: ORDER.exe	Binary or memory string: OriginalFilename vs ORDER.exe
Source: ORDER.exe, 00000010.00000002.817531838.0000000006370000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs ORDER.exe
Source: ORDER.exe, 00000010.00000002.810578210.0000000000592000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameCEXv.exeF vs ORDER.exe
Source: ORDER.exe, 00000010.00000002.816032614.00000000051A0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameWindowsNetwork.dll> vs ORDER.exe
Source: ORDER.exe, 00000010.00000002.818255998.0000000006830000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs ORDER.exe
Source: ORDER.exe, 00000010.00000002.818255998.0000000006830000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs ORDER.exe
Source: ORDER.exe, 00000010.00000002.818162192.00000000067D0000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs ORDER.exe
Source: ORDER.exe, 00000010.00000002.815401049.0000000003EB7000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs ORDER.exe
Source: ORDER.exe, 00000010.00000002.811501603.0000000000C5A000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenamemscorwks.dllT vs ORDER.exe
Source: ORDER.exe	Binary or memory string: OriginalFilename vs ORDER.exe
Source: ORDER.exe, 00000018.00000000.809641342.0000000000552000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameCEXv.exeF vs ORDER.exe
Source: ORDER.exe, 00000018.00000002.826634288.0000000004EC0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs ORDER.exe
Source: ORDER.exe, 00000018.00000002.826135770.0000000002B71000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs ORDER.exe
Source: ORDER.exe, 00000018.00000002.826135770.0000000002B71000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs ORDER.exe
Source: ORDER.exe, 00000018.00000002.826223724.0000000003B71000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs ORDER.exe
Source: ORDER.exe	Binary or memory string: OriginalFilenameCEXv.exeF vs ORDER.exe

Source: ORDER.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: Odstcl.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: ORDER.exe, ContactManagement/ContactForm.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: Odstcl.exe.1.dr, ContactManagement/ContactForm.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.0.ORDER.exe.470000.0.unpack, ContactManagement/ContactForm.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.2.ORDER.exe.470000.0.unpack, ContactManagement/ContactForm.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 13.0.ORDER.exe.690000.2.unpack, ContactManagement/ContactForm.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 13.0.ORDER.exe.400000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 24.2.ORDER.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 24.2.ORDER.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 13.0.ORDER.exe.400000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 13.0.ORDER.exe.400000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 24.0.ORDER.exe.400000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 24.0.ORDER.exe.400000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 13.0.ORDER.exe.400000.3.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 13.0.ORDER.exe.400000.3.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 13.2.ORDER.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 13.2.ORDER.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 24.0.ORDER.exe.400000.3.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 24.0.ORDER.exe.400000.3.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: C:\Users\user\Desktop\ORDER.exe	Code function: 13_2_04FE12EA AdjustTokenPrivileges,		13_2_04FE12EA
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 13_2_04FE12B3 AdjustTokenPrivileges,		13_2_04FE12B3

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6936:120:WilError_01
Source: C:\Users\user\Desktop\ORDER.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Users\user\Desktop\ORDER.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{30b6fbac-dd0d-47bd-b8ab-6df66b017896}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4552:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6840:120:WilError_01

Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ORDER.exe 'C:\Users\user\Desktop\ORDER.exe'
Source: C:\Users\user\Desktop\ORDER.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\Odstcl' /XML 'C:\Users\user\AppData\Local\Temp\tmp6A1C.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ORDER.exe	Process created: C:\Users\user\Desktop\ORDER.exe {path}
Source: C:\Users\user\Desktop\ORDER.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp777A.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\ORDER.exe C:\Users\user\Desktop\ORDER.exe 0
Source: C:\Users\user\Desktop\ORDER.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\Odstcl' /XML 'C:\Users\user\AppData\Local\Temp\tmpFE00.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ORDER.exe	Process created: C:\Users\user\Desktop\ORDER.exe {path}
Source: C:\Users\user\Desktop\ORDER.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\Odstcl' /XML 'C:\Users\user\AppData\Local\Temp\tmp6A1C.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process created: C:\Users\user\Desktop\ORDER.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp777A.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\Odstcl' /XML 'C:\Users\user\AppData\Local\Temp\tmpFE00.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process created: C:\Users\user\Desktop\ORDER.exe {path}	Jump to behavior

Source: ORDER.exe, ContactManagement/ContactForm.cs	.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: Odstcl.exe.1.dr, ContactManagement/ContactForm.cs	.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: 1.0.ORDER.exe.470000.0.unpack, ContactManagement/ContactForm.cs	.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: 1.2.ORDER.exe.470000.0.unpack, ContactManagement/ContactForm.cs	.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: 13.0.ORDER.exe.690000.2.unpack, ContactManagement/ContactForm.cs	.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: 13.0.ORDER.exe.690000.4.unpack, ContactManagement/ContactForm.cs	.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: 13.2.ORDER.exe.690000.1.unpack, ContactManagement/ContactForm.cs	.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: 13.0.ORDER.exe.690000.0.unpack, ContactManagement/ContactForm.cs	.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: 16.2.ORDER.exe.590000.0.unpack, ContactManagement/ContactForm.cs	.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: 16.0.ORDER.exe.590000.0.unpack, ContactManagement/ContactForm.cs	.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
Source: 24.0.ORDER.exe.550000.4.unpack, ContactManagement/ContactForm.cs	.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)

Source: 13.0.ORDER.exe.400000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 13.0.ORDER.exe.400000.1.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 13.0.ORDER.exe.400000.3.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 13.0.ORDER.exe.400000.3.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 13.2.ORDER.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 13.2.ORDER.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 24.2.ORDER.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 24.2.ORDER.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 24.0.ORDER.exe.400000.3.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 24.0.ORDER.exe.400000.3.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 24.0.ORDER.exe.400000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 24.0.ORDER.exe.400000.1.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB55CB push esp; retf	1_2_04CB55CE
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB55C7 push eax; retf	1_2_04CB55CA
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB55DB push ecx; retf	1_2_04CB55DE
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB55D7 push eax; retf	1_2_04CB55DA
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB55EB push ebx; retf	1_2_04CB55EE
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB55E7 push ebx; retf	1_2_04CB55EA
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB55F3 push ebx; retf	1_2_04CB55F6
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB55AB push edx; retf	1_2_04CB55AE
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB55AF push ecx; retf	1_2_04CB55B2
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB55A3 push esp; retf	1_2_04CB55A6
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB55A7 push eax; retf	1_2_04CB55AA
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB55BB push eax; retf	1_2_04CB55BE
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB55B3 push ebp; retf	1_2_04CB55B6
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB5683 push eax; retf	1_2_04CB5686
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB5687 push edx; retf	1_2_04CB568A
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB564B push esp; retf	1_2_04CB564E
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB564F push ebx; retf	1_2_04CB5652
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB5647 push edx; retf	1_2_04CB564A
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB565B push esp; retf	1_2_04CB565E
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB565F push edx; retf	1_2_04CB5662
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB5653 push esp; retf	1_2_04CB5656
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB5663 push edx; retf	1_2_04CB5666
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB5667 push ebx; retf	1_2_04CB566A
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB567B push esp; retf	1_2_04CB567E
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB5673 push ecx; retf	1_2_04CB5676
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB5607 push edx; retf	1_2_04CB560A
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB5617 push edx; retf	1_2_04CB561A
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB562B push ebp; retf	1_2_04CB562E
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB5627 push ecx; retf	1_2_04CB562A
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 1_2_04CB5633 push eax; retf	1_2_04CB5636
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 13_2_027A9D58 pushad ; retf	13_2_027A9D59

Source: initial sample	Static PE information: section name: .text entropy: 7.72970366103
Source: initial sample	Static PE information: section name: .text entropy: 7.72970366103

Source: 13.0.ORDER.exe.400000.1.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 13.0.ORDER.exe.400000.1.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 13.0.ORDER.exe.400000.3.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 13.0.ORDER.exe.400000.3.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 13.2.ORDER.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 13.2.ORDER.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 24.2.ORDER.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 24.2.ORDER.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 24.0.ORDER.exe.400000.3.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 24.0.ORDER.exe.400000.3.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 24.0.ORDER.exe.400000.1.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 24.0.ORDER.exe.400000.1.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Analysis Report ORDER.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Source: ORDER.exe, 00000001.00000002.730698080.0000000002BA2000.00000004.00000001.sdmp, ORDER.exe, 00000010.00000002.813220152.0000000002D32000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: ORDER.exe, 00000001.00000002.730698080.0000000002BA2000.00000004.00000001.sdmp, ORDER.exe, 00000010.00000002.813220152.0000000002D32000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\ORDER.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\ORDER.exe TID: 7028	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe TID: 404	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe TID: 404	Thread sleep count: 151 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe TID: 404	Thread sleep count: 141 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe TID: 816	Thread sleep count: 128 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe TID: 404	Thread sleep count: 47 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe TID: 1316	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe TID: 1316	Thread sleep time: -720000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe TID: 4620	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe TID: 4604	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: ORDER.exe, 00000010.00000002.813220152.0000000002D32000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: ORDER.exe, 0000000D.00000002.911600537.0000000006270000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: ORDER.exe, 00000010.00000002.813220152.0000000002D32000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: ORDER.exe, 00000010.00000002.813220152.0000000002D32000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: ORDER.exe, 00000010.00000002.813220152.0000000002D32000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: ORDER.exe, 00000010.00000002.813220152.0000000002D32000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: ORDER.exe, 00000010.00000002.813220152.0000000002D32000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: ORDER.exe, 0000000D.00000002.911600537.0000000006270000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: ORDER.exe, 0000000D.00000002.911600537.0000000006270000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: ORDER.exe, 00000010.00000002.813220152.0000000002D32000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: ORDER.exe, 00000010.00000002.813220152.0000000002D32000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: ORDER.exe, 00000010.00000002.813220152.0000000002D32000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: ORDER.exe, 0000000D.00000002.911600537.0000000006270000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\ORDER.exe	Memory written: C:\Users\user\Desktop\ORDER.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\Desktop\ORDER.exe	Memory written: C:\Users\user\Desktop\ORDER.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: ORDER.exe, 0000000D.00000002.908970440.0000000002D24000.00000004.00000001.sdmp	Binary or memory string: Program Manager
Source: ORDER.exe, 0000000D.00000002.907813908.0000000001350000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: ORDER.exe, 0000000D.00000002.907813908.0000000001350000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: ORDER.exe, 0000000D.00000002.907813908.0000000001350000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: ORDER.exe, 00000001.00000002.733930181.0000000003D27000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: ORDER.exe, 0000000D.00000002.906988359.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: ORDER.exe, 0000000D.00000002.909542100.0000000003D17000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: ORDER.exe, 00000018.00000000.809591547.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: ORDER.exe, 00000018.00000002.826135770.0000000002B71000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll

Source: C:\Users\user\Desktop\ORDER.exe	Code function: 13_2_04FE283A bind,		13_2_04FE283A
Source: C:\Users\user\Desktop\ORDER.exe	Code function: 13_2_04FE27E8 bind,		13_2_04FE27E8

Name	Malicious	Antivirus Detection	Reputation
	true	Avira URL Cloud: safe	low
kjjuigfdullygigyftkuyluylygilyfidyyuljhd.ydns.eu	true	Avira URL Cloud: safe	unknown