Edit tour

Windows Analysis Report
hGlhyegaG6.exe

Overview

General Information

Sample name:	hGlhyegaG6.exe renamed because original name is a hash value
Original sample name:	7915b71dd31bd2c6f7a6bba943525920.exe
Analysis ID:	1625857
MD5:	7915b71dd31bd2c6f7a6bba943525920
SHA1:	0eda1ff79008761704bf522162accb687894a965
SHA256:	baf42171b1fc708641b1214b78090ff6b95c2f1dfcc3789b322831b5b811eb9d
Tags:	exeValleyRATuser-abuse_ch
Infos:

Detection

Score:	60
Range:	0 - 100
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Query firmware table information (likely to detect VMs)

AV process strings found (often used to terminate AV products)

Binary contains a suspicious time stamp

Contains functionality to detect virtual machines (SLDT)

Contains functionality to detect virtual machines (STR)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

hGlhyegaG6.exe (PID: 4944 cmdline: "C:\Users\user\Desktop\hGlhyegaG6.exe" MD5: 7915B71DD31BD2C6F7A6BBA943525920)

hGlhyegaG6.tmp (PID: 2916 cmdline: "C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp" /SL5="$30584,32291600,857600,C:\Users\user\Desktop\hGlhyegaG6.exe" MD5: 6E8DE531DFA6FFD065F93E3902A1CB51)

overseer.exe (PID: 3992 cmdline: "C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe" MD5: 7D81D10AA526A9F85DC4C4670AD7BDB3)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\5927.2.15.32233\is-VF533.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Roaming\5927.2.15.32233\is-4MVAS.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

HTTP traffic detected: GET /tools/avg/overseer/x64/overseer.exe.def HTTP/1.1Host: s-overseer.avcdn.netUser-Agent: libcurl/8.0.1-DEV Schannel zlib/1.2.11 c-ares/1.19.0 nghttp2/1.48.0Accept: */*Accept-Encoding: deflate, gzip

Source: global traffic	DNS traffic detected: DNS query: s-overseer.avcdn.net
Source: global traffic	DNS traffic detected: DNS query: v7event.stats.avast.com
Source: global traffic	DNS traffic detected: DNS query: analytics.ff.avast.com

Source: unknown

HTTP traffic detected: POST /v4/receive/json/56 HTTP/1.1Host: analytics.ff.avast.comAccept: */*Accept-Encoding: deflate, gzipContent-Type: application/jsonUser-Agent: Overseer.214.478/x64.19045Content-Length: 402

Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://api.kuaixunda.cn/api/code-to-activation
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://api.kuaixunda.cn/api/code-to-registration
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://api.kuaixunda.cn/api/config/soft_down
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://api.kuaixunda.cn/api/config/update
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://api.kuaixunda.cn/api/coupon-detail
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://api.kuaixunda.cn/api/coupon-detailRequest
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://api.kuaixunda.cn/api/ewm
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://api.kuaixunda.cn/api/getToken
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://api.kuaixunda.cn/api/license
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://api.kuaixunda.cn/api/mem_profile
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://api.kuaixunda.cn/api/notlogin-pay-qr
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://api.kuaixunda.cn/api/open-wx-login
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://api.kuaixunda.cn/api/price_plan
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://api.kuaixunda.cn/api/registration-code/check
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://api.kuaixunda.cn/api/registration-code/registerU
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://api.kuaixunda.cn/api/report/eventU
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://api.kuaixunda.cn/api/report/installU
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://api.kuaixunda.cn/api/report/install_failU
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://api.kuaixunda.cn/api/report/onlineU
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://api.kuaixunda.cn/api/report/preinstallU
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://api.kuaixunda.cn/api/report/uninstallU
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://api.kuaixunda.cn/api/sstatU
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://api.kuaixunda.cn/api/verify-buy
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://api.kuaixunda.cn/api/wechat-qr
Source: is-OIH7N.tmp.1.dr	String found in binary or memory: http://api.pdfxd.com/pdf-service/v1/report%s?product=%s&version=%s&timestamp=%I64d&sign=%sactionprod
Source: is-MME84.tmp.1.dr	String found in binary or memory: http://baoku.360.cn/search/webSoftList
Source: is-MME84.tmp.1.dr	String found in binary or memory: http://baoku.360.cn/search/webSoftList(softmgr)
Source: is-P1BFE.tmp.1.dr	String found in binary or memory: http://bar.baidu.com/ie_xy.html
Source: is-MME84.tmp.1.dr	String found in binary or memory: http://bbs.360safe.com/forum.php?mod=forumdisplay&fid=164&tj=soft/catlog=360softmgr
Source: is-K1PBH.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: is-K1PBH.tmp.1.dr, is-4MVAS.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: is-K1PBH.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: is-K1PBH.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: is-MME84.tmp.1.dr, is-6EAPK.tmp.1.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: is-MME84.tmp.1.dr, is-6EAPK.tmp.1.dr	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: is-MME84.tmp.1.dr, is-6EAPK.tmp.1.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: is-MME84.tmp.1.dr, is-6EAPK.tmp.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: is-MME84.tmp.1.dr, is-6EAPK.tmp.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: is-K6GSK.tmp.1.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: is-K6GSK.tmp.1.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: is-G796Q.tmp.1.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: hGlhyegaG6.tmp, 00000001.00000002.1819813933.0000000000B2D000.00000004.00000010.00020000.00000000.sdmp, is-P1BFE.tmp.1.dr	String found in binary or memory: http://crl.wosign.com/WoSignCodeSigning.crl0G
Source: is-K1PBH.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: is-K1PBH.tmp.1.dr, is-4MVAS.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: is-K1PBH.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: is-K1PBH.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: is-K1PBH.tmp.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: is-K6GSK.tmp.1.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: is-K6GSK.tmp.1.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: hGlhyegaG6.tmp, 00000001.00000002.1819813933.0000000000B2D000.00000004.00000010.00020000.00000000.sdmp, is-P1BFE.tmp.1.dr	String found in binary or memory: http://crt.wosign.com/WoSignCodeSigning.crt0
Source: is-MME84.tmp.1.dr	String found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe
Source: overseer.exe, 00000002.00000003.1835747192.0000000000569000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fallback.iabsra.avg.u.avcdn.net/avg/iabsra/servers.defon
Source: is-MME84.tmp.1.dr	String found in binary or memory: http://hao.360.cnhttps://hao.360.cnIHomePageSafeEx1win10setsafemon
Source: is-OIH7N.tmp.1.dr	String found in binary or memory: http://https://ftp://http://&%s=%sllProcessIyInformatioNtQuer%snProcessQueryFu%smageNameWKernel32.dl
Source: overseer.exe, 00000002.00000000.1812811963.0000000140180000.00000002.00000001.01000000.00000006.sdmp, overseer.exe, 00000002.00000002.1859908357.0000000140180000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://iavs9x.avg.u.avcdn.net/avg/iavs9x/servers.defiavs9xavg_fallback_servershttp://fallback.iabsra
Source: is-0LBHD.tmp.1.dr, is-IOLM1.tmp.1.dr	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: is-0LBHD.tmp.1.dr, is-K1PBH.tmp.1.dr, is-IOLM1.tmp.1.dr, is-G796Q.tmp.1.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: is-K1PBH.tmp.1.dr, is-4MVAS.tmp.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: is-K1PBH.tmp.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: is-K1PBH.tmp.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: is-K1PBH.tmp.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: is-MME84.tmp.1.dr, is-6EAPK.tmp.1.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: is-MME84.tmp.1.dr, is-6EAPK.tmp.1.dr	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: is-MME84.tmp.1.dr, is-6EAPK.tmp.1.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: is-6EAPK.tmp.1.dr	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: is-K6GSK.tmp.1.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: is-G796Q.tmp.1.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: is-MME84.tmp.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: is-MME84.tmp.1.dr, is-6EAPK.tmp.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: overseer.exe, overseer.exe, 00000002.00000003.1835420103.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835533900.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835376415.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835441303.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835376415.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835441303.00000000005ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://overseer.tools.avcdn.net/tools/avg/overseer/x64/overseer.exe.365.cab
Source: overseer.exe, 00000002.00000003.1835644176.0000000000558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://overseer.tools.avcdn.net/tools/avg/overseer/x64/overseer.exe.365.cab(
Source: overseer.exe, overseer.exe, 00000002.00000003.1835420103.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835533900.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835376415.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835441303.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835376415.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835441303.00000000005ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://overseer.tools.avcdn.net/tools/avg/overseer/x64/overseer.exe.365.lzma
Source: overseer.exe, 00000002.00000003.1835644176.0000000000558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://overseer.tools.avcdn.net/tools/avg/overseer/x64/overseer.exe.365.lzmaSTEM32R
Source: overseer.exe, overseer.exe, 00000002.00000003.1835602672.000000000057B000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835420103.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835533900.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835376415.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835441303.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835644176.0000000000558000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835376415.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835441303.00000000005ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://overseer.tools.avcdn.net/tools/avg/overseer/x64/overseer.exe.478.cab
Source: overseer.exe, overseer.exe, 00000002.00000003.1835602672.000000000057B000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835420103.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835533900.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835376415.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835441303.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835376415.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835441303.00000000005ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://overseer.tools.avcdn.net/tools/avg/overseer/x64/overseer.exe.478.lzma
Source: overseer.exe, 00000002.00000003.1835644176.0000000000558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://overseer.tools.avcdn.net/tools/avg/overseer/x64/overseer.exe.478.lzmaW
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap/
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/
Source: is-MME84.tmp.1.dr, is-6EAPK.tmp.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: is-MME84.tmp.1.dr, is-6EAPK.tmp.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: is-MME84.tmp.1.dr, is-6EAPK.tmp.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: is-6EAPK.tmp.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: is-G796Q.tmp.1.dr	String found in binary or memory: http://sf.symcb.com/sf.crl0f
Source: is-G796Q.tmp.1.dr	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: is-G796Q.tmp.1.dr	String found in binary or memory: http://sf.symcd.com0&
Source: is-G796Q.tmp.1.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: is-G796Q.tmp.1.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: is-G796Q.tmp.1.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: is-MVSHD.tmp.1.dr	String found in binary or memory: http://tt.137365.com
Source: overseer.exe, overseer.exe, 00000002.00000003.1835644176.0000000000558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://v7event.stats.avast.co
Source: overseer.exe, 00000002.00000003.1835420103.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835533900.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835376415.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835441303.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835376415.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835441303.00000000005ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
Source: is-P1BFE.tmp.1.dr	String found in binary or memory: http://www.baidu.com/index.php?tn=bdwn_pginvalid
Source: is-P1BFE.tmp.1.dr	String found in binary or memory: http://www.baidu.com/index.php?tn=tt98com_3_pg
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://www.borland.com/namespaces/Types
Source: hGlhyegaG6.tmp, 00000001.00000002.1819813933.0000000000B2D000.00000004.00000010.00020000.00000000.sdmp, is-P1BFE.tmp.1.dr	String found in binary or memory: http://www.comodogroup.com/repository0B
Source: is-K1PBH.tmp.1.dr, is-4MVAS.tmp.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: is-G796Q.tmp.1.dr	String found in binary or memory: http://www.haili.io
Source: is-G796Q.tmp.1.dr	String found in binary or memory: http://www.haili.io0
Source: is-4MVAS.tmp.1.dr	String found in binary or memory: http://www.indyproject.org/
Source: is-K6GSK.tmp.1.dr	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: is-MVSHD.tmp.1.dr	String found in binary or memory: http://www.ttwnl.com
Source: is-MVSHD.tmp.1.dr	String found in binary or memory: http://www.ttwnl.com/
Source: is-MME84.tmp.1.dr	String found in binary or memory: http://www.winimage.com/zLibDll
Source: is-MME84.tmp.1.dr	String found in binary or memory: http://www.winimage.com/zLibDllc
Source: is-P1BFE.tmp.1.dr	String found in binary or memory: http://www.wn51.com/
Source: hGlhyegaG6.tmp, 00000001.00000002.1819813933.0000000000B2D000.00000004.00000010.00020000.00000000.sdmp, is-P1BFE.tmp.1.dr	String found in binary or memory: http://www.wn51.com/0
Source: is-P1BFE.tmp.1.dr	String found in binary or memory: http://www.wnwb.com/
Source: hGlhyegaG6.tmp, 00000001.00000002.1819813933.0000000000B2D000.00000004.00000010.00020000.00000000.sdmp, is-P1BFE.tmp.1.dr	String found in binary or memory: http://www.wosign.com/cps/0
Source: overseer.exe, 00000002.00000000.1812811963.0000000140180000.00000002.00000001.01000000.00000006.sdmp, overseer.exe, 00000002.00000002.1859908357.0000000140180000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://analytics.ff.avast.com
Source: overseer.exe, 00000002.00000002.1858743479.0000000000562000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.ff.avast.com/
Source: overseer.exe, 00000002.00000003.1856768953.00000000005A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.ff.avast.com/v4/receive/json/56
Source: overseer.exe, 00000002.00000002.1858918397.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1853159713.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1857917622.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1858387119.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1857627513.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1854373776.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1856768953.00000000005A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.ff.avast.com/v4/receive/json/56172
Source: overseer.exe, 00000002.00000002.1858918397.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1853159713.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1857917622.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1858387119.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1857627513.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1854373776.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1856768953.00000000005A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.ff.avast.com/v4/receive/json/56I
Source: overseer.exe, 00000002.00000003.1836101011.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000002.1858918397.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1853159713.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1857917622.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1858387119.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1857627513.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1854373776.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835835518.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1856768953.00000000005A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.ff.avast.com/v4/receive/json/56V
Source: overseer.exe, 00000002.00000003.1836101011.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000002.1858918397.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1853159713.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1857917622.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1858387119.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1857627513.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1854373776.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1856768953.00000000005A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.ff.avast.com/v4/receive/json/56abinet0
Source: overseer.exe, 00000002.00000003.1836101011.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000002.1858918397.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1853159713.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1857917622.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1858387119.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1857627513.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1854373776.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1856768953.00000000005A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.ff.avast.com/v4/receive/json/56uistatU
Source: overseer.exe, 00000002.00000002.1858918397.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1853159713.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1857917622.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1858387119.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1857627513.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1854373776.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1856768953.00000000005A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.ff.avast.com/v4/receive/json/56vers
Source: overseer.exe, 00000002.00000000.1812811963.0000000140180000.00000002.00000001.01000000.00000006.sdmp, overseer.exe, 00000002.00000002.1859908357.0000000140180000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://analytics.ff.avast.comburger_over_http/v4/receive/json/56burgerx
Source: is-OIH7N.tmp.1.dr	String found in binary or memory: https://apis.pdfxd.com/account/v1/api/forgetpwd/step/submit?
Source: overseer.exe, 00000002.00000000.1812811963.0000000140180000.00000002.00000001.01000000.00000006.sdmp, overseer.exe, 00000002.00000002.1859908357.0000000140180000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: overseer.exe, 00000002.00000000.1812811963.0000000140180000.00000002.00000001.01000000.00000006.sdmp, overseer.exe, 00000002.00000002.1859908357.0000000140180000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: overseer.exe, 00000002.00000000.1812811963.0000000140180000.00000002.00000001.01000000.00000006.sdmp, overseer.exe, 00000002.00000002.1859908357.0000000140180000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: is-G796Q.tmp.1.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: is-G796Q.tmp.1.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: is-6EAPK.tmp.1.dr	String found in binary or memory: https://desktop.line-scdn.net/win/bin/real/installer/installer.jsonSoftware
Source: is-OIH7N.tmp.1.dr	String found in binary or memory: https://dev.pdfxd.com/account/v1/api/forgetpwd/step/submit?
Source: is-OIH7N.tmp.1.dr	String found in binary or memory: https://dev.pdfxd.com/third/wx/qrcode/login/noticehttps://dev.pdfxd.com/third/wx/qrcode/loginhttps:/
Source: is-OIH7N.tmp.1.dr	String found in binary or memory: https://duokai.pdfxd.com/protocol.html
Source: hGlhyegaG6.exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: overseer.exe, overseer.exe, 00000002.00000003.1835420103.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835533900.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835376415.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835441303.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835644176.0000000000558000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835376415.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835441303.00000000005ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s-overseer.avcdn.net/tools/avg/overseer/x64/overseer.exe.478.cab
Source: overseer.exe, overseer.exe, 00000002.00000003.1835420103.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835533900.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835376415.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835441303.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835644176.0000000000558000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835376415.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835441303.00000000005ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s-overseer.avcdn.net/tools/avg/overseer/x64/overseer.exe.478.lzma
Source: overseer.exe, overseer.exe, 00000002.00000003.1835747192.0000000000569000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835969909.000000000055F000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835644176.0000000000558000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835895791.000000000055F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s-overseer.avcdn.net/tools/avg/overseer/x64/overseer.exe.def
Source: overseer.exe, 00000002.00000003.1835644176.0000000000558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s-overseer.avcdn.net/tools/avg/overseer/x64/overseer.exe.defEd
Source: overseer.exe, overseer.exe, 00000002.00000002.1860071003.00000001401EE000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://s-overseer.avcdn.net/tools/avg/overseer/x64/overseer.exe.defGhttp://overseer.tools.avcdn.net
Source: overseer.exe, 00000002.00000003.1835644176.0000000000558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s-overseer.avcdn.net/tools/avg/overseer/x64/overseer.exe.defR
Source: overseer.exe, 00000002.00000003.1835644176.0000000000558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s-overseer.avcdn.net/tools/avg/overseer/x64/overseer.exe.deff
Source: is-K6GSK.tmp.1.dr	String found in binary or memory: https://sectigo.com/CPS0C
Source: is-K6GSK.tmp.1.dr	String found in binary or memory: https://sectigo.com/CPS0D
Source: is-6EAPK.tmp.1.dr	String found in binary or memory: https://terms.line.me/line_terms?lang=en
Source: is-6EAPK.tmp.1.dr	String found in binary or memory: https://terms.line.me/line_terms?lang=en=
Source: is-6EAPK.tmp.1.dr	String found in binary or memory: https://terms.line.me/line_terms?lang=es
Source: is-6EAPK.tmp.1.dr	String found in binary or memory: https://terms.line.me/line_terms?lang=id
Source: is-6EAPK.tmp.1.dr	String found in binary or memory: https://terms.line.me/line_terms?lang=ja
Source: is-6EAPK.tmp.1.dr	String found in binary or memory: https://terms.line.me/line_terms?lang=ko
Source: is-6EAPK.tmp.1.dr	String found in binary or memory: https://terms.line.me/line_terms?lang=th
Source: is-6EAPK.tmp.1.dr	String found in binary or memory: https://terms.line.me/line_terms?lang=zh-Hant
Source: overseer.exe, overseer.exe, 00000002.00000003.1836101011.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000002.1858918397.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1853159713.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000000.1812811963.0000000140180000.00000002.00000001.01000000.00000006.sdmp, overseer.exe, 00000002.00000003.1857917622.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1858387119.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1857627513.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000002.1859908357.0000000140180000.00000002.00000001.01000000.00000006.sdmp, overseer.exe, 00000002.00000003.1854373776.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1856768953.00000000005A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
Source: overseer.exe, 00000002.00000003.1836101011.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000002.1858918397.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1853159713.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1857917622.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1858387119.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1857627513.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1854373776.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1856768953.00000000005A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgia
Source: overseer.exe, 00000002.00000000.1812811963.0000000140180000.00000002.00000001.01000000.00000006.sdmp, overseer.exe, 00000002.00000002.1859908357.0000000140180000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://v7event.stats.avast.com/cgi-bin/iavsevents.cgiiavs
Source: is-MME84.tmp.1.dr, is-6EAPK.tmp.1.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: hGlhyegaG6.exe, 00000000.00000003.1757877930.000000007F49B000.00000004.00001000.00020000.00000000.sdmp, hGlhyegaG6.exe, 00000000.00000003.1757389822.0000000002ED0000.00000004.00001000.00020000.00000000.sdmp, hGlhyegaG6.tmp, 00000001.00000000.1759474820.0000000000C61000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.innosetup.com/
Source: hGlhyegaG6.exe, 00000000.00000003.1757877930.000000007F49B000.00000004.00001000.00020000.00000000.sdmp, hGlhyegaG6.exe, 00000000.00000003.1757389822.0000000002ED0000.00000004.00001000.00020000.00000000.sdmp, hGlhyegaG6.tmp, 00000001.00000000.1759474820.0000000000C61000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.remobjects.com/ps

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 2.19.11.98:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe

Code function: 2_2_0000000140001000

2_2_0000000140001000

Source: hGlhyegaG6.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-OIH7N.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: 7-zip archive data, version 0.4
Source: is-OIH7N.tmp.1.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: is-P1BFE.tmp.1.dr	Static PE information: Resource name: SETUPCAB type: Microsoft Cabinet archive data, Windows 2000/XP setup, 352422 bytes, 1 file, at 0x2c +A "wnbz\wnbz.exe", ID 12345, number 1, 25 datablocks, 0x1 compression

Source: hGlhyegaG6.exe	Static PE information: Number of sections : 11 > 10
Source: hGlhyegaG6.tmp.0.dr	Static PE information: Number of sections : 11 > 10

Source: hGlhyegaG6.exe, 00000000.00000003.1757389822.0000000002FDF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs hGlhyegaG6.exe
Source: hGlhyegaG6.exe, 00000000.00000000.1755637578.0000000000989000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs hGlhyegaG6.exe
Source: hGlhyegaG6.exe, 00000000.00000003.1757877930.000000007F78B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs hGlhyegaG6.exe
Source: hGlhyegaG6.exe	Binary or memory string: OriginalFileName vs hGlhyegaG6.exe

Source: hGlhyegaG6.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal60.evad.winEXE@5/38@5/2

Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp

File created: C:\Users\user\AppData\Roaming\5927.2.15.32233

Jump to behavior

Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe

Mutant created: \Sessions\1\BaseNamedObjects\Global\{F12E76D4-B7F5-4A9A-AF3B-67A1FE6CA675}

Source: C:\Users\user\Desktop\hGlhyegaG6.exe

File created: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp

Jump to behavior

Source: Yara match	File source: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-VF533.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-4MVAS.tmp, type: DROPPED

Source: C:\Users\user\Desktop\hGlhyegaG6.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\hGlhyegaG6.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Desktop\hGlhyegaG6.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: hGlhyegaG6.exe

Virustotal: Detection: 20%

Source: hGlhyegaG6.exe

String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\hGlhyegaG6.exe

File read: C:\Users\user\Desktop\hGlhyegaG6.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\hGlhyegaG6.exe "C:\Users\user\Desktop\hGlhyegaG6.exe"
Source: C:\Users\user\Desktop\hGlhyegaG6.exe	Process created: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp "C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp" /SL5="$30584,32291600,857600,C:\Users\user\Desktop\hGlhyegaG6.exe"
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Process created: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe "C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe"
Source: C:\Users\user\Desktop\hGlhyegaG6.exe	Process created: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp "C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp" /SL5="$30584,32291600,857600,C:\Users\user\Desktop\hGlhyegaG6.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Process created: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe "C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe"	Jump to behavior

Source: C:\Users\user\Desktop\hGlhyegaG6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\hGlhyegaG6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp

Window found: window name: TMainForm

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: hGlhyegaG6.exe

Static file information: File size 33266825 > 1048576

Source: hGlhyegaG6.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\_work\1\s\src\StoreInstaller\obj\Release\net472\StoreInstaller.pdbSHA256b% source: is-H6PSO.tmp.1.dr
Source:	Binary string: D:\jenkins_agent\workspace\windows_desktop_new_installer_build\line-updater\LineInstaller\bin\LineInstaller.pdb source: is-6EAPK.tmp.1.dr
Source:	Binary string: D:\a\_work\1\s\src\StoreInstaller\obj\Release\net472\StoreInstaller.pdb source: is-H6PSO.tmp.1.dr
Source:	Binary string: C:\vmagent_new\bin\joblist\784575\out\Release\InstSe.pdb source: is-MME84.tmp.1.dr
Source:	Binary string: d:\Work\Wnsoft\WnInstall(wnwg)\WnInstall\Release\WnInstall.pdb source: is-P1BFE.tmp.1.dr
Source:	Binary string: D:\jenkins_agent\workspace\windows_desktop_new_installer_build\line-updater\LineInstaller\bin\LineInstaller.pdbI source: is-6EAPK.tmp.1.dr
Source:	Binary string: C:\BUILD\work\3ec84b7238d5b18a\BUILDS\Release\x64\overseer.pdb source: overseer.exe, 00000002.00000000.1812811963.0000000140180000.00000002.00000001.01000000.00000006.sdmp, overseer.exe, 00000002.00000002.1859908357.0000000140180000.00000002.00000001.01000000.00000006.sdmp

Source: is-H6PSO.tmp.1.dr

Static PE information: 0x9AD0D863 [Mon Apr 22 05:55:47 2052 UTC]

Source: is-H6PSO.tmp.1.dr	Static PE information: real checksum: 0x111707 should be: 0x11b53a
Source: is-IOLM1.tmp.1.dr	Static PE information: real checksum: 0x0 should be: 0x1cf47c
Source: is-MVSHD.tmp.1.dr	Static PE information: real checksum: 0x0 should be: 0x2169c9
Source: is-0LBHD.tmp.1.dr	Static PE information: real checksum: 0x0 should be: 0x11b277
Source: hGlhyegaG6.tmp.0.dr	Static PE information: real checksum: 0x0 should be: 0x333175
Source: is-4O04J.tmp.1.dr	Static PE information: real checksum: 0x2185b6 should be: 0x21e883

Source: hGlhyegaG6.exe	Static PE information: section name: .didata
Source: hGlhyegaG6.tmp.0.dr	Static PE information: section name: .didata
Source: is-6EAPK.tmp.1.dr	Static PE information: section name: .fptable
Source: is-4O04J.tmp.1.dr	Static PE information: section name: _RDATA
Source: is-VF533.tmp.1.dr	Static PE information: section name: .didata
Source: is-4MVAS.tmp.1.dr	Static PE information: section name: .didata

Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_0056B2A8 push ecx; ret	2_3_0056B371
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_0056B2A8 push ecx; ret	2_3_0056B371
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_0056B2A8 push ecx; ret	2_3_0056B371
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_0056B2A8 push ecx; ret	2_3_0056B371
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_0056B2A8 push ecx; ret	2_3_0056B371
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_0056B2A8 push ecx; ret	2_3_0056B371
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_0056B2A8 push ecx; ret	2_3_0056B371
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_0056B2A8 push ecx; ret	2_3_0056B371
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_0055C350 push eax; ret	2_3_0055C351
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_0055C34B push eax; ret	2_3_0055C351
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_0055C34B push eax; ret	2_3_0055C351
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_00567558 push eax; retf	2_3_00567559
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_0056C140 push eax; ret	2_3_0056C131
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_0056C140 push eax; ret	2_3_0056C131
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_0056C140 push eax; ret	2_3_0056C131
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_0056C140 push eax; ret	2_3_0056C131
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_0056C140 push eax; ret	2_3_0056C131
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_0056C140 push eax; ret	2_3_0056C131
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_0056C140 push eax; ret	2_3_0056C131
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_0056C140 push eax; ret	2_3_0056C131
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_00567578 push edx; retf	2_3_00567579
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_00567574 push edx; retf	2_3_00567579
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_00567574 push edx; retf	2_3_00567579
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_00567574 push edx; retf	2_3_00567579
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_00567574 push edx; retf	2_3_00567579
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_00567574 push edx; retf	2_3_00567579
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_00567574 push edx; retf	2_3_00567579
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_0056F56C push edx; ret	2_3_0056F579
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_0056F56C push edx; ret	2_3_0056F579
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_0056F56C push edx; ret	2_3_0056F579
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe	Code function: 2_3_0056F56C push edx; ret	2_3_0056F579

Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-P1BFE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-OIH7N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\)).t.8.1.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\)~. ...h.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-MME84.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\2000002290_406649A8EBDBEE64943B69C2B49248C8_20240129 - o,.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-DBR9G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-H6PSO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-IOLM1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\Free Countdown Timer_5.2.0.0.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-4O04J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\w.)...exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-K6GSK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-G796Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\123SW.`_2.0.0.3.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\LineInst.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\WhatsApp Installer.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-VF533.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\123SW.`_2.0.0.3 - o,.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\hGlhyegaG6.exe	File created: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\j ..H_7.4.0_1735612174.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\..kW..2.0.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\...u(360.H)_3.1.0.1_1734850795.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-0LBHD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-K1PBH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\2000002290_406649A8EBDBEE64943B69C2B49248C8_20240129.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\].-N.t._1.5.0.5.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-6EAPK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-MVSHD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Local\Temp\is-INPU8.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	File created: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-4MVAS.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\hGlhyegaG6.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe

Code function: 2_3_0056F261 sldt word ptr [eax]

2_3_0056F261

Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe

Code function: 2_3_0055F4D2 str word ptr [eax+0055F470h]

2_3_0055F4D2

Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-P1BFE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-OIH7N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\5927.2.15.32233\)).t.8.1.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\5927.2.15.32233\)~. ...h.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-MME84.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\5927.2.15.32233\2000002290_406649A8EBDBEE64943B69C2B49248C8_20240129 - o,.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-DBR9G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-H6PSO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-IOLM1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\5927.2.15.32233\Free Countdown Timer_5.2.0.0.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\5927.2.15.32233\w.)...exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-K6GSK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-G796Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\5927.2.15.32233\123SW.`_2.0.0.3.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\5927.2.15.32233\LineInst.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\5927.2.15.32233\WhatsApp Installer.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-VF533.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\5927.2.15.32233\123SW.`_2.0.0.3 - o,.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\5927.2.15.32233\..kW..2.0.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\5927.2.15.32233\j ..H_7.4.0_1735612174.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\5927.2.15.32233\...u(360.H)_3.1.0.1_1734850795.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-0LBHD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\5927.2.15.32233\2000002290_406649A8EBDBEE64943B69C2B49248C8_20240129.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-K1PBH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\5927.2.15.32233\].-N.t._1.5.0.5.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-6EAPK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-MVSHD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-INPU8.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-4MVAS.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe

File opened: PhysicalDrive0

Jump to behavior

Source: overseer.exe, 00000002.00000002.1858743479.0000000000545000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllpp

Source: C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: is-MME84.tmp.1.dr

Binary or memory string: Jr+br+bwbProgram ManagerProgmanSoftMgrLite.exeSOFTWARE\Microsoft\Windows\CurrentVersion\policies\systemConsentPromptBehaviorAdminPromptOnSecureDesktopUsers\Administrator\AppData\LocalSeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeCreateProcessWithTokenWadvapi32.dllrunas360

Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe

Code function: 2_2_0000000140126F50 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

2_2_0000000140126F50

Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: is-MME84.tmp.1.dr

Binary or memory string: aRSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Safe.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	13 Virtualization/Sandbox Evasion	LSASS Memory	221 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Process Injection	Security Account Manager	13 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	2 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
hGlhyegaG6.exe	8%	ReversingLabs
hGlhyegaG6.exe	20%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\is-INPU8.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\)).t.8.1.exe (copy)	17%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\)~. ...h.exe (copy)	3%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\...u(360.H)_3.1.0.1_1734850795.exe (copy)	5%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\..kW..2.0.exe (copy)	10%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\123SW.`_2.0.0.3 - o,.exe (copy)	8%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\123SW.`_2.0.0.3.exe (copy)	8%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\2000002290_406649A8EBDBEE64943B69C2B49248C8_20240129 - o,.exe (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\2000002290_406649A8EBDBEE64943B69C2B49248C8_20240129.exe (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\Free Countdown Timer_5.2.0.0.exe (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\LineInst.exe (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\WhatsApp Installer.exe (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\].-N.t._1.5.0.5.exe (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\is-0LBHD.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\is-4MVAS.tmp	8%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\is-4O04J.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\is-6EAPK.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\is-DBR9G.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\is-G796Q.tmp	29%	ReversingLabs	Win32.Trojan.Sasfis
C:\Users\user\AppData\Roaming\5927.2.15.32233\is-H6PSO.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\is-IOLM1.tmp	3%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\is-K1PBH.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\is-K6GSK.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\is-MME84.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\is-MVSHD.tmp	17%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\is-OIH7N.tmp	5%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\is-P1BFE.tmp	10%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\is-VF533.tmp	8%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\j ..H_7.4.0_1735612174.exe (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\overseer.exe (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\5927.2.15.32233\w.)...exe (copy)	29%	ReversingLabs	Win32.Trojan.Sasfis

Source	Detection	Scanner	Label
http://fallback.iabsra.avg.u.avcdn.net/avg/iabsra/servers.defon	0%	Avira URL Cloud	safe
http://api.kuaixunda.cn/api/coupon-detail	0%	Avira URL Cloud	safe
http://hao.360.cnhttps://hao.360.cnIHomePageSafeEx1win10setsafemon	0%	Avira URL Cloud	safe
https://analytics.ff.avast.comburger_over_http/v4/receive/json/56burgerx	0%	Avira URL Cloud	safe
https://dev.pdfxd.com/third/wx/qrcode/login/noticehttps://dev.pdfxd.com/third/wx/qrcode/loginhttps:/	0%	Avira URL Cloud	safe
http://www.wnwb.com/	0%	Avira URL Cloud	safe
http://api.kuaixunda.cn/api/verify-buy	0%	Avira URL Cloud	safe
http://www.haili.io0	0%	Avira URL Cloud	safe
http://api.kuaixunda.cn/api/getToken	0%	Avira URL Cloud	safe
http://api.kuaixunda.cn/api/license	0%	Avira URL Cloud	safe
http://api.kuaixunda.cn/api/price_plan	0%	Avira URL Cloud	safe
http://bar.baidu.com/ie_xy.html	0%	Avira URL Cloud	safe
http://https://ftp://http://&%s=%sllProcessIyInformatioNtQuer%snProcessQueryFu%smageNameWKernel32.dl	0%	Avira URL Cloud	safe
http://crt.wosign.com/WoSignCodeSigning.crt0	0%	Avira URL Cloud	safe
http://www.wn51.com/	0%	Avira URL Cloud	safe
http://api.kuaixunda.cn/api/code-to-activation	0%	Avira URL Cloud	safe
http://api.kuaixunda.cn/api/report/install_failU	0%	Avira URL Cloud	safe
http://api.kuaixunda.cn/api/coupon-detailRequest	0%	Avira URL Cloud	safe
http://tt.137365.com	0%	Avira URL Cloud	safe
http://api.kuaixunda.cn/api/ewm	0%	Avira URL Cloud	safe
http://api.kuaixunda.cn/api/report/onlineU	0%	Avira URL Cloud	safe
http://www.wn51.com/0	0%	Avira URL Cloud	safe
http://crl.wosign.com/WoSignCodeSigning.crl0G	0%	Avira URL Cloud	safe
http://api.kuaixunda.cn/api/registration-code/check	0%	Avira URL Cloud	safe
http://api.kuaixunda.cn/api/report/uninstallU	0%	Avira URL Cloud	safe
http://www.winimage.com/zLibDllc	0%	Avira URL Cloud	safe
http://api.kuaixunda.cn/api/open-wx-login	0%	Avira URL Cloud	safe
http://api.kuaixunda.cn/api/registration-code/registerU	0%	Avira URL Cloud	safe
https://duokai.pdfxd.com/protocol.html	0%	Avira URL Cloud	safe
http://v7event.stats.avast.co	0%	Avira URL Cloud	safe
http://www.ttwnl.com	0%	Avira URL Cloud	safe
http://api.kuaixunda.cn/api/report/installU	0%	Avira URL Cloud	safe
http://www.comodogroup.com/repository0B	0%	Avira URL Cloud	safe
http://www.haili.io	0%	Avira URL Cloud	safe
http://www.wosign.com/cps/0	0%	Avira URL Cloud	safe
http://api.kuaixunda.cn/api/notlogin-pay-qr	0%	Avira URL Cloud	safe
http://api.kuaixunda.cn/api/code-to-registration	0%	Avira URL Cloud	safe
http://api.kuaixunda.cn/api/wechat-qr	0%	Avira URL Cloud	safe
http://api.kuaixunda.cn/api/config/soft_down	0%	Avira URL Cloud	safe
https://dev.pdfxd.com/account/v1/api/forgetpwd/step/submit?	0%	Avira URL Cloud	safe
http://api.kuaixunda.cn/api/report/preinstallU	0%	Avira URL Cloud	safe
http://api.kuaixunda.cn/api/sstatU	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
a366.dscd.akamai.net	2.19.11.98	true	false	high
analytics-prod-gcp.ff.avast.com	34.117.223.223	true	false	high
v7event.stats.avast.com	unknown	unknown	false	high
s-overseer.avcdn.net	unknown	unknown	false	high
analytics.ff.avast.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://v7event.stats.avast.com/cgi-bin/iavsevents.cgi	false	high
https://analytics.ff.avast.com/v4/receive/json/56	false	high
https://s-overseer.avcdn.net/tools/avg/overseer/x64/overseer.exe.def	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://api.kuaixunda.cn/api/coupon-detail	is-4MVAS.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://www.wnwb.com/	is-P1BFE.tmp.1.dr	false	Avira URL Cloud: safe	unknown
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	hGlhyegaG6.exe	false		high
http://fallback.iabsra.avg.u.avcdn.net/avg/iabsra/servers.defon	overseer.exe, 00000002.00000003.1835747192.0000000000569000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://hao.360.cnhttps://hao.360.cnIHomePageSafeEx1win10setsafemon	is-MME84.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://overseer.tools.avcdn.net/tools/avg/overseer/x64/overseer.exe.365.lzmaSTEM32R	overseer.exe, 00000002.00000003.1835644176.0000000000558000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.pdfxd.com/third/wx/qrcode/login/noticehttps://dev.pdfxd.com/third/wx/qrcode/loginhttps:/	is-OIH7N.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe	is-MME84.tmp.1.dr	false		high
https://s-overseer.avcdn.net/tools/avg/overseer/x64/overseer.exe.478.cab	overseer.exe, overseer.exe, 00000002.00000003.1835420103.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835533900.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835376415.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835441303.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835644176.0000000000558000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835376415.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835441303.00000000005ED000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.indyproject.org/	is-4MVAS.tmp.1.dr	false		high
https://v7event.stats.avast.com/cgi-bin/iavsevents.cgiiavs	overseer.exe, 00000002.00000000.1812811963.0000000140180000.00000002.00000001.01000000.00000006.sdmp, overseer.exe, 00000002.00000002.1859908357.0000000140180000.00000002.00000001.01000000.00000006.sdmp	false		high
http://api.kuaixunda.cn/api/verify-buy	is-4MVAS.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://api.pdfxd.com/pdf-service/v1/report%s?product=%s&version=%s&timestamp=%I64d&sign=%sactionprod	is-OIH7N.tmp.1.dr	false		high
http://overseer.tools.avcdn.net/tools/avg/overseer/x64/overseer.exe.365.cab(	overseer.exe, 00000002.00000003.1835644176.0000000000558000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.haili.io0	is-G796Q.tmp.1.dr	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/hsts.html	overseer.exe, 00000002.00000000.1812811963.0000000140180000.00000002.00000001.01000000.00000006.sdmp, overseer.exe, 00000002.00000002.1859908357.0000000140180000.00000002.00000001.01000000.00000006.sdmp	false		high
https://apis.pdfxd.com/account/v1/api/forgetpwd/step/submit?	is-OIH7N.tmp.1.dr	false		high
https://analytics.ff.avast.comburger_over_http/v4/receive/json/56burgerx	overseer.exe, 00000002.00000000.1812811963.0000000140180000.00000002.00000001.01000000.00000006.sdmp, overseer.exe, 00000002.00000002.1859908357.0000000140180000.00000002.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
http://api.kuaixunda.cn/api/getToken	is-4MVAS.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://overseer.tools.avcdn.net/tools/avg/overseer/x64/overseer.exe.478.lzma	overseer.exe, overseer.exe, 00000002.00000003.1835602672.000000000057B000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835420103.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835533900.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835376415.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835441303.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835376415.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835441303.00000000005ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.remobjects.com/ps	hGlhyegaG6.exe, 00000000.00000003.1757877930.000000007F49B000.00000004.00001000.00020000.00000000.sdmp, hGlhyegaG6.exe, 00000000.00000003.1757389822.0000000002ED0000.00000004.00001000.00020000.00000000.sdmp, hGlhyegaG6.tmp, 00000001.00000000.1759474820.0000000000C61000.00000020.00000001.01000000.00000004.sdmp	false		high
http://api.kuaixunda.cn/api/license	is-4MVAS.tmp.1.dr	false	Avira URL Cloud: safe	unknown
https://analytics.ff.avast.com	overseer.exe, 00000002.00000000.1812811963.0000000140180000.00000002.00000001.01000000.00000006.sdmp, overseer.exe, 00000002.00000002.1859908357.0000000140180000.00000002.00000001.01000000.00000006.sdmp	false		high
https://analytics.ff.avast.com/v4/receive/json/56uistatU	overseer.exe, 00000002.00000003.1836101011.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000002.1858918397.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1853159713.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1857917622.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1858387119.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1857627513.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1854373776.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1856768953.00000000005A3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://desktop.line-scdn.net/win/bin/real/installer/installer.jsonSoftware	is-6EAPK.tmp.1.dr	false		high
https://www.innosetup.com/	hGlhyegaG6.exe, 00000000.00000003.1757877930.000000007F49B000.00000004.00001000.00020000.00000000.sdmp, hGlhyegaG6.exe, 00000000.00000003.1757389822.0000000002ED0000.00000004.00001000.00020000.00000000.sdmp, hGlhyegaG6.tmp, 00000001.00000000.1759474820.0000000000C61000.00000020.00000001.01000000.00000004.sdmp	false		high
http://api.kuaixunda.cn/api/price_plan	is-4MVAS.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://bar.baidu.com/ie_xy.html	is-P1BFE.tmp.1.dr	false	Avira URL Cloud: safe	unknown
https://terms.line.me/line_terms?lang=ja	is-6EAPK.tmp.1.dr	false		high
http://www.wn51.com/	is-P1BFE.tmp.1.dr	false	Avira URL Cloud: safe	unknown
https://v7event.stats.avast.com/cgi-bin/iavsevents.cgia	overseer.exe, 00000002.00000003.1836101011.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000002.1858918397.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1853159713.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1857917622.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1858387119.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1857627513.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1854373776.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1856768953.00000000005A3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://https://ftp://http://&%s=%sllProcessIyInformatioNtQuer%snProcessQueryFu%smageNameWKernel32.dl	is-OIH7N.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi	overseer.exe, 00000002.00000003.1835420103.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835533900.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835376415.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835441303.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835376415.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835441303.00000000005ED000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	is-4MVAS.tmp.1.dr	false		high
https://s-overseer.avcdn.net/tools/avg/overseer/x64/overseer.exe.478.lzma	overseer.exe, overseer.exe, 00000002.00000003.1835420103.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835533900.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835376415.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835441303.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835644176.0000000000558000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835376415.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835441303.00000000005ED000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.wosign.com/WoSignCodeSigning.crt0	hGlhyegaG6.tmp, 00000001.00000002.1819813933.0000000000B2D000.00000004.00000010.00020000.00000000.sdmp, is-P1BFE.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	is-K6GSK.tmp.1.dr	false		high
http://nsis.sf.net/NSIS_ErrorError	is-0LBHD.tmp.1.dr, is-K1PBH.tmp.1.dr, is-IOLM1.tmp.1.dr, is-G796Q.tmp.1.dr	false		high
https://curl.se/docs/alt-svc.html	overseer.exe, 00000002.00000000.1812811963.0000000140180000.00000002.00000001.01000000.00000006.sdmp, overseer.exe, 00000002.00000002.1859908357.0000000140180000.00000002.00000001.01000000.00000006.sdmp	false		high
http://api.kuaixunda.cn/api/code-to-activation	is-4MVAS.tmp.1.dr	false	Avira URL Cloud: safe	unknown
https://terms.line.me/line_terms?lang=id	is-6EAPK.tmp.1.dr	false		high
http://overseer.tools.avcdn.net/tools/avg/overseer/x64/overseer.exe.365.lzma	overseer.exe, overseer.exe, 00000002.00000003.1835420103.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835533900.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835376415.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835441303.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835376415.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835441303.00000000005ED000.00000004.00000020.00020000.00000000.sdmp	false		high
http://api.kuaixunda.cn/api/coupon-detailRequest	is-4MVAS.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://tt.137365.com	is-MVSHD.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://api.kuaixunda.cn/api/report/install_failU	is-4MVAS.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://api.kuaixunda.cn/api/report/onlineU	is-4MVAS.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_Error	is-0LBHD.tmp.1.dr, is-IOLM1.tmp.1.dr	false		high
http://schemas.xmlsoap.org/wsdl/soap12/	is-4MVAS.tmp.1.dr	false		high
https://s-overseer.avcdn.net/tools/avg/overseer/x64/overseer.exe.defR	overseer.exe, 00000002.00000003.1835644176.0000000000558000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.wn51.com/0	hGlhyegaG6.tmp, 00000001.00000002.1819813933.0000000000B2D000.00000004.00000010.00020000.00000000.sdmp, is-P1BFE.tmp.1.dr	false	Avira URL Cloud: safe	unknown
https://analytics.ff.avast.com/v4/receive/json/56vers	overseer.exe, 00000002.00000002.1858918397.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1853159713.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1857917622.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1858387119.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1857627513.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1854373776.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1856768953.00000000005A3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://api.kuaixunda.cn/api/ewm	is-4MVAS.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://www.baidu.com/index.php?tn=bdwn_pginvalid	is-P1BFE.tmp.1.dr	false		high
http://crl.wosign.com/WoSignCodeSigning.crl0G	hGlhyegaG6.tmp, 00000001.00000002.1819813933.0000000000B2D000.00000004.00000010.00020000.00000000.sdmp, is-P1BFE.tmp.1.dr	false	Avira URL Cloud: safe	unknown
https://analytics.ff.avast.com/	overseer.exe, 00000002.00000002.1858743479.0000000000562000.00000004.00000020.00020000.00000000.sdmp	false		high
http://baoku.360.cn/search/webSoftList	is-MME84.tmp.1.dr	false		high
http://overseer.tools.avcdn.net/tools/avg/overseer/x64/overseer.exe.478.cab	overseer.exe, overseer.exe, 00000002.00000003.1835602672.000000000057B000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835420103.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835533900.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835376415.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835441303.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835644176.0000000000558000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835376415.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835441303.00000000005ED000.00000004.00000020.00020000.00000000.sdmp	false		high
http://api.kuaixunda.cn/api/registration-code/check	is-4MVAS.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0	is-K6GSK.tmp.1.dr	false		high
http://api.kuaixunda.cn/api/report/uninstallU	is-4MVAS.tmp.1.dr	false	Avira URL Cloud: safe	unknown
https://terms.line.me/line_terms?lang=en=	is-6EAPK.tmp.1.dr	false		high
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	is-K6GSK.tmp.1.dr	false		high
http://schemas.xmlsoap.org/soap/envelope/	is-4MVAS.tmp.1.dr	false		high
http://api.kuaixunda.cn/api/open-wx-login	is-4MVAS.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDllc	is-MME84.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://overseer.tools.avcdn.net/tools/avg/overseer/x64/overseer.exe.365.cab	overseer.exe, overseer.exe, 00000002.00000003.1835420103.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835533900.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835376415.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835441303.00000000005CC000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835376415.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835441303.00000000005ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duokai.pdfxd.com/protocol.html	is-OIH7N.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://api.kuaixunda.cn/api/registration-code/registerU	is-4MVAS.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	is-K6GSK.tmp.1.dr	false		high
http://schemas.xmlsoap.org/wsdl/soap/	is-4MVAS.tmp.1.dr	false		high
https://s-overseer.avcdn.net/tools/avg/overseer/x64/overseer.exe.deff	overseer.exe, 00000002.00000003.1835644176.0000000000558000.00000004.00000020.00020000.00000000.sdmp	false		high
http://v7event.stats.avast.co	overseer.exe, overseer.exe, 00000002.00000003.1835644176.0000000000558000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://analytics.ff.avast.com/v4/receive/json/56V	overseer.exe, 00000002.00000003.1836101011.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000002.1858918397.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1853159713.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1857917622.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1858387119.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1857627513.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1854373776.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1835835518.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1856768953.00000000005A3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.borland.com/namespaces/Types	is-4MVAS.tmp.1.dr	false		high
http://www.comodogroup.com/repository0B	hGlhyegaG6.tmp, 00000001.00000002.1819813933.0000000000B2D000.00000004.00000010.00020000.00000000.sdmp, is-P1BFE.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	is-G796Q.tmp.1.dr	false		high
http://www.ttwnl.com	is-MVSHD.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://api.kuaixunda.cn/api/report/installU	is-4MVAS.tmp.1.dr	false	Avira URL Cloud: safe	unknown
https://terms.line.me/line_terms?lang=en	is-6EAPK.tmp.1.dr	false		high
https://sectigo.com/CPS0C	is-K6GSK.tmp.1.dr	false		high
https://terms.line.me/line_terms?lang=es	is-6EAPK.tmp.1.dr	false		high
https://sectigo.com/CPS0D	is-K6GSK.tmp.1.dr	false		high
http://www.wosign.com/cps/0	hGlhyegaG6.tmp, 00000001.00000002.1819813933.0000000000B2D000.00000004.00000010.00020000.00000000.sdmp, is-P1BFE.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://www.haili.io	is-G796Q.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://baoku.360.cn/search/webSoftList(softmgr)	is-MME84.tmp.1.dr	false		high
http://api.kuaixunda.cn/api/notlogin-pay-qr	is-4MVAS.tmp.1.dr	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/http-cookies.html	overseer.exe, 00000002.00000000.1812811963.0000000140180000.00000002.00000001.01000000.00000006.sdmp, overseer.exe, 00000002.00000002.1859908357.0000000140180000.00000002.00000001.01000000.00000006.sdmp	false		high
http://api.kuaixunda.cn/api/config/soft_down	is-4MVAS.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://api.kuaixunda.cn/api/wechat-qr	is-4MVAS.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://api.kuaixunda.cn/api/sstatU	is-4MVAS.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	is-G796Q.tmp.1.dr	false		high
https://s-overseer.avcdn.net/tools/avg/overseer/x64/overseer.exe.defEd	overseer.exe, 00000002.00000003.1835644176.0000000000558000.00000004.00000020.00020000.00000000.sdmp	false		high
http://api.kuaixunda.cn/api/code-to-registration	is-4MVAS.tmp.1.dr	false	Avira URL Cloud: safe	unknown
https://analytics.ff.avast.com/v4/receive/json/56I	overseer.exe, 00000002.00000002.1858918397.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1853159713.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1857917622.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1858387119.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1857627513.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1854373776.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1856768953.00000000005A3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.pdfxd.com/account/v1/api/forgetpwd/step/submit?	is-OIH7N.tmp.1.dr	false	Avira URL Cloud: safe	unknown
http://api.kuaixunda.cn/api/report/preinstallU	is-4MVAS.tmp.1.dr	false	Avira URL Cloud: safe	unknown
https://analytics.ff.avast.com/v4/receive/json/56172	overseer.exe, 00000002.00000002.1858918397.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1853159713.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1857917622.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1858387119.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1857627513.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1854373776.00000000005A3000.00000004.00000020.00020000.00000000.sdmp, overseer.exe, 00000002.00000003.1856768953.00000000005A3000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
34.117.223.223	analytics-prod-gcp.ff.avast.com	United States		139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
2.19.11.98	a366.dscd.akamai.net	European Union		719	ELISA-ASHelsinkiFinlandEU	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1625857
Start date and time:	2025-02-27 18:20:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	hGlhyegaG6.exe renamed because original name is a hash value
Original Sample Name:	7915b71dd31bd2c6f7a6bba943525920.exe
Detection:	MAL
Classification:	mal60.evad.winEXE@5/38@5/2
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 40.126.32.134, 13.107.246.60, 20.223.36.55, 2.19.96.129
Excluded domains from analysis (whitelisted): www.bing.com, slscr.update.microsoft.com, login.live.com, otelrules.azureedge.net, ctldl.windowsupdate.com, tse1.mm.bing.net, arc.msn.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target overseer.exe, PID 3992 because there are no executed function
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
12:21:33	API Interceptor	1x Sleep call for process: overseer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.223.223	Canvas of Kings_N6xC-S2.exe	Get hash	malicious	Unknown	Browse	v7event.stats.avast.com/cgi-bin/iavsevents.cgi
	Violated Heroine_91zbZ-1.exe	Get hash	malicious	Unknown	Browse	v7event.stats.avast.com/cgi-bin/iavsevents.cgi
	avast_free_antivirus_setup_online.exe	Get hash	malicious	Unknown	Browse	v7event.stats.avast.com/cgi-bin/iavsevents.cgi
	avast_free_antivirus_setup_online.exe	Get hash	malicious	Unknown	Browse	v7event.stats.avast.com/cgi-bin/iavsevents.cgi
	Team Fortress 2 Brotherhood Of Arms_aez-LU1.exe	Get hash	malicious	Unknown	Browse	v7event.stats.avast.com/cgi-bin/iavsevents.cgi
	Team Fortress 2 Brotherhood Of Arms_aez-LU1.exe	Get hash	malicious	Unknown	Browse	v7event.stats.avast.com/cgi-bin/iavsevents.cgi
	SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe	Get hash	malicious	PrivateLoader	Browse	v7event.stats.avast.com/cgi-bin/iavsevents.cgi
	Microstub.exe	Get hash	malicious	Unknown	Browse	v7event.stats.avast.com/cgi-bin/iavsevents.cgi
	Microstub.exe	Get hash	malicious	Unknown	Browse	v7event.stats.avast.com/cgi-bin/iavsevents.cgi
	ccsetup621.zip	Get hash	malicious	Unknown	Browse	v7event.stats.avast.com/cgi-bin/iavsevents.cgi
2.19.11.98	https://mfsus-my.sharepoint.com/:u:/p/jmaldonado/ETgv2ykDZTZFqqQuEgMT5HYBmLmp6Wc681CQdzzQhFcYJQ?e=deM7Fd	Get hash	malicious	HTMLPhisher	Browse
	https://1drv.ms/f/s!Al3kOrNM1pisdUEXbGg8JkzKK48?e=tOzHl1	Get hash	malicious	HTMLPhisher	Browse
	https://tampopo304-my.sharepoint.com/personal/t_peter_tampopo_co_uk/_layouts/15/guestaccess.aspx?share=ErD6Vn1_jHJCkzNA55SF53AB1bLxHPSyAiXwDO2SC9GB1Q&e=F2hCiy	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	https://1drv.ms/f/s!AjoVkDIsGnpOd7LuARNPe9SBPXk?e=Pdaap6	Get hash	malicious	Unknown	Browse
	Microsoft subscription purchase confirmation.eml	Get hash	malicious	HTMLPhisher	Browse
	https://used-trudy-s08zvfvm.dcms.site/	Get hash	malicious	HTMLPhisher	Browse
	https://gsiarchitektenag-my.sharepoint.com/:f:/g/personal/gs_gsi-architekten_ch/EntlC9XtnJ1Bgd09WLx74WkBB05V16Z8JVmiV-l5ACpLgQ?e=KRNxYh	Get hash	malicious	Unknown	Browse
	https://rnicrosoft-secured-office.squarespace.com/sharepointcoc?e=bob_smith@gmail.com	Get hash	malicious	HTMLPhisher	Browse
	installer.msi	Get hash	malicious	Unknown	Browse
	NRKCZ1PSDM.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
analytics-prod-gcp.ff.avast.com	Canvas of Kings_N6xC-S2.exe	Get hash	malicious	Unknown	Browse	34.117.223.223
	Violated Heroine_91zbZ-1.exe	Get hash	malicious	Unknown	Browse	34.117.223.223
	lw2HMxuVuf.exe	Get hash	malicious	Unknown	Browse	34.117.223.223
	avast_free_antivirus_setup_online.exe	Get hash	malicious	Unknown	Browse	34.117.223.223
	avast_free_antivirus_setup_online.exe	Get hash	malicious	Unknown	Browse	34.117.223.223
	https://download.ccleaner.com/portable/ccsetup629.zip	Get hash	malicious	Unknown	Browse	34.117.223.223
	https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail	Get hash	malicious	Unknown	Browse	34.117.223.223
	SecuriteInfo.com.Trojan.Siggen29.7508.16428.4641.exe	Get hash	malicious	Unknown	Browse	34.117.223.223
	Team Fortress 2 Brotherhood Of Arms_aez-LU1.exe	Get hash	malicious	Unknown	Browse	34.117.223.223
	Team Fortress 2 Brotherhood Of Arms_aez-LU1.exe	Get hash	malicious	Unknown	Browse	34.117.223.223

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	http://rbitzer.com	Get hash	malicious	Unknown	Browse	34.117.239.71
	http://mail.aestheticfina.com	Get hash	malicious	Unknown	Browse	34.117.188.166
	CheatEngine75.exe	Get hash	malicious	Unknown	Browse	34.117.223.223
	9JJKvVwvGx.exe	Get hash	malicious	Destiny Stealer, Phemedrone Stealer, StormKitty	Browse	34.117.59.81
	REMITTANCE DETAILS....xlsx	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	34.117.188.166
	X9aIq7jyai.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	7HLZuA5T52.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	bwJj13Uume.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	F2024065877 (1).html	Get hash	malicious	Unknown	Browse	34.117.188.166
	Ahnenblatt4.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
ELISA-ASHelsinkiFinlandEU	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	157.145.81.32
	debug.dbg.elf	Get hash	malicious	Mirai, Moobot	Browse	157.145.68.75
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	157.144.158.145
	CheatEngine75.exe	Get hash	malicious	Unknown	Browse	2.19.11.115
	ppc.elf	Get hash	malicious	Unknown	Browse	81.197.31.98
	https://docs.google.com/presentation/d/e/2PACX-1vSvmWyfLEJZ5nZ6r7zLeERwPTtQoLAUQ4RPEvcJe62ARx9vU5tDh9sA907TMKlRkeGtkb4myCac4reD/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	2.19.11.163
	FW_ Fw_ Spreadsheet shared with you_ _Invitation to Bid_ By Elna Davis [ID_0023058].eml	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	2.19.11.103
	New Missed Call Notification for jim.huber 2252025 84809 PM.msg	Get hash	malicious	Unknown	Browse	2.19.11.120
	http://docusign.net	Get hash	malicious	Unknown	Browse	2.19.11.109
	star.ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	91.156.132.69

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
74954a0c86284d0d6e1c4efefe92b521	1.exe	Get hash	malicious	Unknown	Browse	34.117.223.223 2.19.11.98
	setup.msi	Get hash	malicious	Unknown	Browse	34.117.223.223 2.19.11.98
	5bf784.msi	Get hash	malicious	Unknown	Browse	34.117.223.223 2.19.11.98
	34.exe	Get hash	malicious	Unknown	Browse	34.117.223.223 2.19.11.98
	11.exe	Get hash	malicious	Unknown	Browse	34.117.223.223 2.19.11.98
	BundleInstaller.dll.exe	Get hash	malicious	Unknown	Browse	34.117.223.223 2.19.11.98
	CffcJEOeKdr.vbs	Get hash	malicious	Unknown	Browse	34.117.223.223 2.19.11.98
	microsoft-update.bat	Get hash	malicious	Unknown	Browse	34.117.223.223 2.19.11.98
	s57VlxH5.bat	Get hash	malicious	Quasar	Browse	34.117.223.223 2.19.11.98
	SDG9IrTB.bat	Get hash	malicious	Quasar	Browse	34.117.223.223 2.19.11.98

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\is-INPU8.tmp\_isetup\_setup64.tmp	CheatEngine75.exe	Get hash	malicious	Unknown	Browse
	script.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	script.exe	Get hash	malicious	RMSRemoteAdmin	Browse
	LjRzIncZn3.exe	Get hash	malicious	Unknown	Browse
	5Y4GVzLuoR.exe	Get hash	malicious	MicroClip	Browse
	LjRzIncZn3.exe	Get hash	malicious	Unknown	Browse
	W0utxsxevL.exe	Get hash	malicious	MicroClip	Browse
	7UeILSfH5L.exe	Get hash	malicious	MicroClip	Browse
	5Y4GVzLuoR.exe	Get hash	malicious	Unknown	Browse
	W0utxsxevL.exe	Get hash	malicious	MicroClip	Browse

Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\)).t.8.1.exe (copy)	ReversingLabs: Detection: 17%
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-G796Q.tmp	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\is-MVSHD.tmp	ReversingLabs: Detection: 17%
Source: C:\Users\user\AppData\Roaming\5927.2.15.32233\w.)...exe (copy)	ReversingLabs: Detection: 28%

Source: Joe Sandbox View	IP Address: 34.117.223.223 34.117.223.223
Source: Joe Sandbox View	IP Address: 34.117.223.223 34.117.223.223
Source: Joe Sandbox View	IP Address: 2.19.11.98 2.19.11.98

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Process:	C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: CheatEngine75.exe, Detection: malicious, Browse Filename: script.exe, Detection: malicious, Browse Filename: script.exe, Detection: malicious, Browse Filename: LjRzIncZn3.exe, Detection: malicious, Browse Filename: 5Y4GVzLuoR.exe, Detection: malicious, Browse Filename: LjRzIncZn3.exe, Detection: malicious, Browse Filename: W0utxsxevL.exe, Detection: malicious, Browse Filename: 7UeILSfH5L.exe, Detection: malicious, Browse Filename: 5Y4GVzLuoR.exe, Detection: malicious, Browse Filename: W0utxsxevL.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

Process:	C:\Users\user\Desktop\hGlhyegaG6.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3347968
Entropy (8bit):	6.594964217507136
Encrypted:	false
SSDEEP:	49152:CdJYVM+9JtzZWnoS2VC23aun8+f5KuG2OY9IG9ivyv2cLx1RQ5333Re+I:0JYVM+LtVt3P/KuG2ONG9iqLRQ5333E
MD5:	6E8DE531DFA6FFD065F93E3902A1CB51
SHA1:	9A484E85432C38D9749C2DFB56E72207A6A9B88E
SHA-256:	0313C8B1EAF4BF8A2C920717CAD7335B7AA9C210298C659B97647E433B0272BD
SHA-512:	30DB086FA4E73A17F32321BC4CF4D16BD9A58540DAA9E77FE4FCA1361618B874AD33A673012D85C7A28474FB3376C739389B7321DE4D3E08581D50913C1A51D2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f....................P..................@...........................3...........@......@...................P,.n.....,.j:...P0.......................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc........P0......./.............@..@.............04......`3.............@..@................

Entrypoint:	0x4a83bc
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6690DABD [Fri Jul 12 07:26:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	40ab50289f7ef5fae60801f88d4541fc

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xb7000	0x71	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb5000	0xfec	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xcb000	0x13d7c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xba000	0x10fa8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xb9000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb52d4	0x25c	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xb6000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa568c	0xa5800	b889d302f6fc48a904de33d8d947ae80	False	0.3620185045317221	data	6.377190161826806	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xa7000	0x1b64	0x1c00	588dd0a8ab499300d3701cbd11b017d9	False	0.548828125	data	6.109264411030635	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xa9000	0x3838	0x3a00	5c0c76e77aef52ebc6702430837ccb6e	False	0.35338092672413796	data	4.95916338709992	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xad000	0x7258	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xb5000	0xfec	0x1000	627340dff539ef99048969aa4824fb2d	False	0.380615234375	data	5.020404933181373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xb6000	0x1a4	0x200	fd11c1109737963cc6cb7258063abfd6	False	0.34765625	data	2.729290535217263	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xb7000	0x71	0x200	7de8ca0c7a61668a728fd3a88dc0942d	False	0.1796875	data	1.305578535725827	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xb8000	0x18	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xb9000	0x5d	0x200	d84006640084dc9f74a07c2ff9c7d656	False	0.189453125	data	1.3892750148744617	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xba000	0x10fa8	0x11000	a85fda2741bd9417695daa5fc5a9d7a5	False	0.5789579503676471	data	6.709466460182023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0xcb000	0x13d7c	0x13e00	bcf1d506b69abcd88579fe6d65479c17	False	0.5466784591194969	data	6.5279729599424385	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xcb438	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	United States	0.5932213415355495
RT_STRING	0xdbc60	0x3f8	data			0.3198818897637795
RT_STRING	0xdc058	0x2dc	data			0.36475409836065575
RT_STRING	0xdc334	0x430	data			0.40578358208955223
RT_STRING	0xdc764	0x44c	data			0.38636363636363635
RT_STRING	0xdcbb0	0x2d4	data			0.39226519337016574
RT_STRING	0xdce84	0xb8	data			0.6467391304347826
RT_STRING	0xdcf3c	0x9c	data			0.6410256410256411
RT_STRING	0xdcfd8	0x374	data			0.4230769230769231
RT_STRING	0xdd34c	0x398	data			0.3358695652173913
RT_STRING	0xdd6e4	0x368	data			0.3795871559633027
RT_STRING	0xdda4c	0x2a4	data			0.4275147928994083
RT_RCDATA	0xddcf0	0x10	data			1.5
RT_RCDATA	0xddd00	0x310	data			0.6173469387755102
RT_RCDATA	0xde010	0x2c	data			1.1818181818181819
RT_GROUP_ICON	0xde03c	0x14	data	English	United States	1.25
RT_VERSION	0xde050	0x584	data	English	United States	0.24858356940509915
RT_MANIFEST	0xde5d4	0x7a8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3377551020408163

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, CloseHandle, LocalFree, SizeofResource, VirtualProtect, QueryPerformanceFrequency, VirtualFree, GetFullPathNameW, GetProcessHeap, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVolumeInformationW, GetVersion, GetDriveTypeW, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetCommandLineW, GetSystemInfo, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, LCMapStringW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
advapi32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorW, OpenThreadToken, AdjustTokenPrivileges, LookupPrivilegeValueW, RegOpenKeyExW, OpenProcessToken, FreeSid, AllocateAndInitializeSid, EqualSid, RegQueryValueExW, GetTokenInformation, ConvertSidToStringSidW, RegCloseKey

Description	Data
Comments	This installation was built with Inno Setup.
CompanyName
FileDescription	7.2.15.3 Setup
FileVersion
LegalCopyright
OriginalFileName
ProductName	7.2.15.3
ProductVersion	7.2.15.3
Translation	0x0000 0x04b0

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 27, 2025 18:21:34.891890049 CET	49733	443	192.168.2.4	2.19.11.98
Feb 27, 2025 18:21:34.891918898 CET	443	49733	2.19.11.98	192.168.2.4
Feb 27, 2025 18:21:34.891998053 CET	49733	443	192.168.2.4	2.19.11.98
Feb 27, 2025 18:21:34.919771910 CET	49733	443	192.168.2.4	2.19.11.98
Feb 27, 2025 18:21:34.919791937 CET	443	49733	2.19.11.98	192.168.2.4
Feb 27, 2025 18:21:35.636918068 CET	443	49733	2.19.11.98	192.168.2.4
Feb 27, 2025 18:21:35.636996984 CET	49733	443	192.168.2.4	2.19.11.98
Feb 27, 2025 18:21:35.637844086 CET	443	49733	2.19.11.98	192.168.2.4
Feb 27, 2025 18:21:35.637902975 CET	49733	443	192.168.2.4	2.19.11.98
Feb 27, 2025 18:21:35.648960114 CET	49733	443	192.168.2.4	2.19.11.98
Feb 27, 2025 18:21:35.648971081 CET	443	49733	2.19.11.98	192.168.2.4
Feb 27, 2025 18:21:35.649194002 CET	443	49733	2.19.11.98	192.168.2.4
Feb 27, 2025 18:21:35.652545929 CET	49733	443	192.168.2.4	2.19.11.98
Feb 27, 2025 18:21:35.695329905 CET	443	49733	2.19.11.98	192.168.2.4
Feb 27, 2025 18:21:35.897948980 CET	443	49733	2.19.11.98	192.168.2.4
Feb 27, 2025 18:21:35.898173094 CET	443	49733	2.19.11.98	192.168.2.4
Feb 27, 2025 18:21:35.898241043 CET	49733	443	192.168.2.4	2.19.11.98
Feb 27, 2025 18:21:35.905026913 CET	49733	443	192.168.2.4	2.19.11.98
Feb 27, 2025 18:21:35.905062914 CET	443	49733	2.19.11.98	192.168.2.4
Feb 27, 2025 18:21:36.981259108 CET	49734	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:36.981281042 CET	443	49734	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:36.981384039 CET	49734	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:36.982131958 CET	49735	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:36.982181072 CET	443	49735	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:36.982253075 CET	49735	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:36.982615948 CET	49734	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:36.982631922 CET	443	49734	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:36.982647896 CET	49735	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:36.982669115 CET	443	49735	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:36.997062922 CET	49736	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:36.997085094 CET	443	49736	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:36.997149944 CET	49736	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:36.997514009 CET	49736	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:36.997528076 CET	443	49736	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.027621031 CET	49737	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:37.027653933 CET	443	49737	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.027745008 CET	49737	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:37.028078079 CET	49737	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:37.028093100 CET	443	49737	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.460535049 CET	443	49735	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.460608006 CET	49735	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:37.461105108 CET	443	49736	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.461168051 CET	49736	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:37.463452101 CET	49735	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:37.463463068 CET	443	49735	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.463879108 CET	443	49735	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.464469910 CET	49736	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:37.464479923 CET	443	49736	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.464864016 CET	443	49736	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.464925051 CET	49735	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:37.465536118 CET	49736	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:37.472111940 CET	443	49734	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.472232103 CET	49734	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:37.474076986 CET	49734	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:37.474087000 CET	443	49734	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.474385977 CET	443	49734	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.475018978 CET	49734	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:37.507334948 CET	443	49736	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.507337093 CET	443	49735	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.510499001 CET	443	49737	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.510706902 CET	49737	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:37.515331030 CET	443	49734	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.525537968 CET	49737	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:37.525563955 CET	443	49737	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.525825977 CET	443	49737	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.539061069 CET	49737	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:37.579339981 CET	443	49737	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.585026979 CET	443	49735	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.585278988 CET	443	49735	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.585335970 CET	49735	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:37.585829973 CET	443	49736	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.585916996 CET	443	49736	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.585961103 CET	49736	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:37.589631081 CET	49735	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:37.589648962 CET	443	49735	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.601927996 CET	443	49734	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.601994991 CET	443	49734	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.602041960 CET	49734	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:37.625334024 CET	49734	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:37.625349998 CET	443	49734	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.665874004 CET	443	49737	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.665942907 CET	443	49737	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:37.666001081 CET	49737	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:38.008590937 CET	49737	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:38.008627892 CET	443	49737	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:38.168984890 CET	49736	443	192.168.2.4	34.117.223.223
Feb 27, 2025 18:21:38.169024944 CET	443	49736	34.117.223.223	192.168.2.4
Feb 27, 2025 18:21:42.199063063 CET	60676	53	192.168.2.4	1.1.1.1
Feb 27, 2025 18:21:42.204165936 CET	53	60676	1.1.1.1	192.168.2.4
Feb 27, 2025 18:21:42.204237938 CET	60676	53	192.168.2.4	1.1.1.1
Feb 27, 2025 18:21:42.209434986 CET	53	60676	1.1.1.1	192.168.2.4
Feb 27, 2025 18:21:42.653676033 CET	60676	53	192.168.2.4	1.1.1.1
Feb 27, 2025 18:21:42.658864021 CET	53	60676	1.1.1.1	192.168.2.4
Feb 27, 2025 18:21:42.658941984 CET	60676	53	192.168.2.4	1.1.1.1

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 27, 2025 18:21:34.865267992 CET	56675	53	192.168.2.4	1.1.1.1
Feb 27, 2025 18:21:34.874691010 CET	53	56675	1.1.1.1	192.168.2.4
Feb 27, 2025 18:21:36.973237038 CET	56679	53	192.168.2.4	1.1.1.1
Feb 27, 2025 18:21:36.973237038 CET	56678	53	192.168.2.4	1.1.1.1
Feb 27, 2025 18:21:36.980290890 CET	53	56679	1.1.1.1	192.168.2.4
Feb 27, 2025 18:21:36.980874062 CET	53	56678	1.1.1.1	192.168.2.4
Feb 27, 2025 18:21:36.988529921 CET	56682	53	192.168.2.4	1.1.1.1
Feb 27, 2025 18:21:36.996118069 CET	53	56682	1.1.1.1	192.168.2.4
Feb 27, 2025 18:21:37.019887924 CET	56684	53	192.168.2.4	1.1.1.1
Feb 27, 2025 18:21:37.026649952 CET	53	56684	1.1.1.1	192.168.2.4
Feb 27, 2025 18:21:42.198699951 CET	53	64666	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
2025-02-27 17:21:35 UTC	211	OUT	GET /tools/avg/overseer/x64/overseer.exe.def HTTP/1.1 Host: s-overseer.avcdn.net User-Agent: libcurl/8.0.1-DEV Schannel zlib/1.2.11 c-ares/1.19.0 nghttp2/1.48.0 Accept: / Accept-Encoding: deflate, gzip
2025-02-27 17:21:35 UTC	430	IN	HTTP/1.1 200 OK Last-Modified: Tue, 01 Aug 2023 10:58:19 GMT ETag: "64c8e54b-364" Server: nginx Access-Control-Allow-Origin: * x-cache-status: HIT x-origin-cache: vpsorigin-cache-re-prod-001.europe-west3-a.ppp-lopst-vpsorigin-10 Content-Type: text/plain Content-Length: 868 Accept-Ranges: bytes Cache-Control: max-age=11 Expires: Thu, 27 Feb 2025 17:21:46 GMT Date: Thu, 27 Feb 2025 17:21:35 GMT Connection: close
2025-02-27 17:21:35 UTC	868	IN	Data Raw: 5b 53 74 61 74 69 73 74 69 63 73 5d 0d 0a 49 61 76 73 3d 68 74 74 70 3a 2f 2f 76 37 65 76 65 6e 74 2e 73 74 61 74 73 2e 61 76 61 73 74 2e 63 6f 6d 2f 63 67 69 2d 62 69 6e 2f 69 61 76 73 65 76 65 6e 74 73 2e 63 67 69 0d 0a 0d 0a 5b 55 70 64 61 74 65 5d 0d 0a 4c 61 74 65 73 74 42 75 69 6c 64 3d 33 36 35 0d 0a 0d 0a 5b 55 70 64 61 74 65 2e 55 72 6c 2e 30 5d 0d 0a 4c 7a 6d 61 3d 68 74 74 70 3a 2f 2f 6f 76 65 72 73 65 65 72 2e 74 6f 6f 6c 73 2e 61 76 63 64 6e 2e 6e 65 74 2f 74 6f 6f 6c 73 2f 61 76 67 2f 6f 76 65 72 73 65 65 72 2f 78 36 34 2f 6f 76 65 72 73 65 65 72 2e 65 78 65 2e 33 36 35 2e 6c 7a 6d 61 0d 0a 43 61 62 69 6e 65 74 3d 68 74 74 70 3a 2f 2f 6f 76 65 72 73 65 65 72 2e 74 6f 6f 6c 73 2e 61 76 63 64 6e 2e 6e 65 74 2f 74 6f 6f 6c 73 2f 61 76 67 2f 6f Data Ascii: [Statistics]Iavs=http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi[Update]LatestBuild=365[Update.Url.0]Lzma=http://overseer.tools.avcdn.net/tools/avg/overseer/x64/overseer.exe.365.lzmaCabinet=http://overseer.tools.avcdn.net/tools/avg/o

Timestamp	Bytes transferred	Direction	Data
2025-02-27 17:21:37 UTC	205	OUT	POST /v4/receive/json/56 HTTP/1.1 Host: analytics.ff.avast.com Accept: / Accept-Encoding: deflate, gzip Content-Type: application/json User-Agent: Overseer.214.478/x64.19045 Content-Length: 402
2025-02-27 17:21:37 UTC	402	OUT	Data Raw: 7b 22 72 65 63 6f 72 64 22 3a 5b 7b 22 65 76 65 6e 74 22 3a 7b 22 73 75 62 74 79 70 65 22 3a 31 2c 22 74 69 6d 65 22 3a 31 37 34 30 36 38 32 32 39 31 31 30 39 2c 22 74 79 70 65 22 3a 35 36 7d 2c 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 67 75 69 64 22 3a 22 22 2c 22 68 77 69 64 22 3a 22 33 46 35 43 37 43 44 34 34 44 31 46 36 41 43 37 36 39 39 33 34 43 41 44 41 32 36 37 42 34 44 46 45 45 31 39 42 35 46 46 46 46 46 36 32 38 36 36 38 30 34 36 45 45 36 44 30 32 42 45 34 44 31 44 22 7d 2c 22 6f 76 65 72 73 65 65 72 22 3a 7b 22 61 63 74 69 6f 6e 22 3a 22 73 74 61 72 74 65 64 22 2c 22 72 65 73 75 6c 74 22 3a 22 22 2c 22 73 65 73 73 69 6f 6e 5f 69 64 22 3a 22 39 36 38 38 32 32 31 36 2d 65 31 65 30 2d 34 62 66 61 2d 38 38 33 65 2d 32 36 39 35 61 33 36 39 31 62 61 38 Data Ascii: {"record":[{"event":{"subtype":1,"time":1740682291109,"type":56},"identity":{"guid":"","hwid":"3F5C7CD44D1F6AC769934CADA267B4DFEE19B5FFFFF628668046EE6D02BE4D1D"},"overseer":{"action":"started","result":"","session_id":"96882216-e1e0-4bfa-883e-2695a3691ba8
2025-02-27 17:21:37 UTC	216	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 27 Feb 2025 17:21:37 GMT Content-Type: application/json Content-Length: 19 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-02-27 17:21:37 UTC	19	IN	Data Raw: 7b 22 70 72 6f 63 65 73 73 65 64 22 3a 20 74 72 75 65 7d Data Ascii: {"processed": true}

Timestamp	Bytes transferred	Direction	Data
2025-02-27 17:21:37 UTC	246	OUT	POST /cgi-bin/iavsevents.cgi HTTP/1.1 Host: v7event.stats.avast.com User-Agent: libcurl/8.0.1-DEV Schannel zlib/1.2.11 c-ares/1.19.0 nghttp2/1.48.0 Accept: / Accept-Encoding: deflate, gzip Content-Type: iavs4/stats Content-Length: 205
2025-02-27 17:21:37 UTC	205	OUT	Data Raw: 65 64 69 74 69 6f 6e 3d 30 0a 65 76 65 6e 74 3d 6f 76 65 72 73 65 65 72 5f 66 69 6e 69 73 68 65 64 0a 65 78 65 5f 76 65 72 73 69 6f 6e 3d 31 2e 30 2e 34 37 38 2e 30 0a 6d 69 64 65 78 3d 33 46 35 43 37 43 44 34 34 44 31 46 36 41 43 37 36 39 39 33 34 43 41 44 41 32 36 37 42 34 44 46 45 45 31 39 42 35 46 46 46 46 46 36 32 38 36 36 38 30 34 36 45 45 36 44 30 32 42 45 34 44 31 44 0a 6f 73 3d 77 69 6e 2c 31 30 2c 30 2c 32 2c 31 39 30 34 35 2c 30 2c 41 4d 44 36 34 0a 73 74 61 74 5f 73 65 73 73 69 6f 6e 3d 39 36 38 38 32 32 31 36 2d 65 31 65 30 2d 34 62 66 61 2d 38 38 33 65 2d 32 36 39 35 61 33 36 39 31 62 61 38 0a Data Ascii: edition=0event=overseer_finishedexe_version=1.0.478.0midex=3F5C7CD44D1F6AC769934CADA267B4DFEE19B5FFFFF628668046EE6D02BE4D1Dos=win,10,0,2,19045,0,AMD64stat_session=96882216-e1e0-4bfa-883e-2695a3691ba8
2025-02-27 17:21:37 UTC	172	IN	HTTP/1.1 204 No Content Server: nginx Date: Thu, 27 Feb 2025 17:21:37 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Target ID:	0
Start time:	12:21:27
Start date:	27/02/2025
Path:	C:\Users\user\Desktop\hGlhyegaG6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\hGlhyegaG6.exe"
Imagebase:	0x8d0000
File size:	33'266'825 bytes
MD5 hash:	7915B71DD31BD2C6F7A6BBA943525920
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report hGlhyegaG6.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\is-INPU8.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\is-J21NL.tmp\hGlhyegaG6.tmp

C:\Users\user\AppData\Roaming\5927.2.15.32233\)).t.8.1.exe (copy)

C:\Users\user\AppData\Roaming\5927.2.15.32233\)~. ...h.exe (copy)

C:\Users\user\AppData\Roaming\5927.2.15.32233\...u(360.H)_3.1.0.1_1734850795.exe (copy)

C:\Users\user\AppData\Roaming\5927.2.15.32233\..kW..2.0.exe (copy)

C:\Users\user\AppData\Roaming\5927.2.15.32233\123SW.`_2.0.0.3 - o,.exe (copy)

C:\Users\user\AppData\Roaming\5927.2.15.32233\123SW.`_2.0.0.3.exe (copy)

C:\Users\user\AppData\Roaming\5927.2.15.32233\2000002290_406649A8EBDBEE64943B69C2B49248C8_20240129 - o,.exe (copy)

C:\Users\user\AppData\Roaming\5927.2.15.32233\2000002290_406649A8EBDBEE64943B69C2B49248C8_20240129.exe (copy)

C:\Users\user\AppData\Roaming\5927.2.15.32233\Free Countdown Timer_5.2.0.0.exe (copy)

C:\Users\user\AppData\Roaming\5927.2.15.32233\LineInst.exe (copy)

C:\Users\user\AppData\Roaming\5927.2.15.32233\Repository.xml (copy)

C:\Users\user\AppData\Roaming\5927.2.15.32233\WhatsApp Installer.exe (copy)

C:\Users\user\AppData\Roaming\5927.2.15.32233\].-N.t._1.5.0.5.exe (copy)

C:\Users\user\AppData\Roaming\5927.2.15.32233\is-0LBHD.tmp

C:\Users\user\AppData\Roaming\5927.2.15.32233\is-0UUDN.tmp

C:\Users\user\AppData\Roaming\5927.2.15.32233\is-4MVAS.tmp

C:\Users\user\AppData\Roaming\5927.2.15.32233\is-4O04J.tmp

C:\Users\user\AppData\Roaming\5927.2.15.32233\is-6EAPK.tmp

C:\Users\user\AppData\Roaming\5927.2.15.32233\is-DBR9G.tmp

Windows Analysis Report
hGlhyegaG6.exe

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre