c6aa9ccb80ecb6e5944212e43f12876266ae6786fd039d21ec6b9925aeda205b

Analysis

max time kernel
149s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OverlayAI Setup.exe
Size 132.7MB
Sample260522-ym94faes7k
SHA256 c6aa9ccb80ecb6e5944212e43f12876266ae6786fd039d21ec6b9925aeda205b
MD5 18b5ed1a5179d8dad573654c1f0771b2
SHA1 6c7cd7105d2861dfa48f1882b59d37421d64afa2
SHA512 9bc79c98e67d064cababce592b2b54f6b57ae117189fadcac2293fc95d13bbf62f316e4b9e91ca16b03ed844059c8fda0e6607af9b72794f414c970d22057e3a
SSDEEP 3145728:3uyPutMW5tBa7KdGN5Ojb/UFWpXIVpCkB0xydpvY:3fur02gNAP/UMpsYkBRpv
TLSH
T198683329CAF0E0CDE19239737F02729819ADF6B8BF494D6DE84D03E55E1CB85C60A51B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 15 IoCs

pid	Process
4648	Update.exe
4628	Squirrel.exe
1348	OverlayAI.exe
3180	Update.exe
2804	OverlayAI.exe
4432	OverlayAI.exe
4160	OverlayAI.exe
468	OverlayAI.exe
3916	OverlayAI.exe
3432	OverlayAI.exe
3308	OverlayAI.exe
3264	OverlayAI.exe
2016	OverlayAI.exe
1656	OverlayAI.exe
3448	OverlayAI.exe

Loads dropped DLL 19 IoCs

pid	Process
2804	OverlayAI.exe
2804	OverlayAI.exe
2804	OverlayAI.exe
2804	OverlayAI.exe
2804	OverlayAI.exe
2804	OverlayAI.exe
4160	OverlayAI.exe
468	OverlayAI.exe
3308	OverlayAI.exe
3308	OverlayAI.exe
3308	OverlayAI.exe
3308	OverlayAI.exe
3308	OverlayAI.exe
3308	OverlayAI.exe
2016	OverlayAI.exe
3264	OverlayAI.exe
3448	OverlayAI.exe
3448	OverlayAI.exe
3448	OverlayAI.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	OverlayAI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OverlayAI Setup.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OverlayAI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OverlayAI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OverlayAI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OverlayAI.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4648	Update.exe
4648	Update.exe
3448	OverlayAI.exe
3448	OverlayAI.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4648	Update.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe
Token: SeCreatePagefilePrivilege	3916	OverlayAI.exe
Token: SeShutdownPrivilege	3916	OverlayAI.exe

Suspicious use of FindShellTrayWindow 20 IoCs

pid	Process
1348	OverlayAI.exe
1348	OverlayAI.exe
1348	OverlayAI.exe
1348	OverlayAI.exe
1348	OverlayAI.exe
1348	OverlayAI.exe
1348	OverlayAI.exe
1348	OverlayAI.exe
1348	OverlayAI.exe
1348	OverlayAI.exe
3916	OverlayAI.exe
3916	OverlayAI.exe
3916	OverlayAI.exe
3916	OverlayAI.exe
3916	OverlayAI.exe
3916	OverlayAI.exe
3916	OverlayAI.exe
3916	OverlayAI.exe
4648	Update.exe
3916	OverlayAI.exe

Suspicious use of SendNotifyMessage 17 IoCs

pid	Process
1348	OverlayAI.exe
1348	OverlayAI.exe
1348	OverlayAI.exe
1348	OverlayAI.exe
1348	OverlayAI.exe
1348	OverlayAI.exe
1348	OverlayAI.exe
1348	OverlayAI.exe
3916	OverlayAI.exe
3916	OverlayAI.exe
3916	OverlayAI.exe
3916	OverlayAI.exe
3916	OverlayAI.exe
3916	OverlayAI.exe
3916	OverlayAI.exe
3916	OverlayAI.exe
3916	OverlayAI.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 4648	4488	OverlayAI Setup.exe	81
PID 4648 wrote to memory of 4628	4648	Update.exe	82
PID 4648 wrote to memory of 1348	4648	Update.exe	83
PID 1348 wrote to memory of 3180	1348	OverlayAI.exe	84
PID 1348 wrote to memory of 2804	1348	OverlayAI.exe	85
PID 1348 wrote to memory of 4432	1348	OverlayAI.exe	86
PID 1348 wrote to memory of 2804	1348	OverlayAI.exe	85
PID 1348 wrote to memory of 4160	1348	OverlayAI.exe	87
PID 1348 wrote to memory of 4160	1348	OverlayAI.exe	87
PID 1348 wrote to memory of 468	1348	OverlayAI.exe	88
PID 1348 wrote to memory of 468	1348	OverlayAI.exe	88
PID 4648 wrote to memory of 3916	4648	Update.exe	90
PID 3916 wrote to memory of 3432	3916	OverlayAI.exe	91
PID 3916 wrote to memory of 3308	3916	OverlayAI.exe	92
PID 3916 wrote to memory of 3308	3916	OverlayAI.exe	92
PID 3916 wrote to memory of 3264	3916	OverlayAI.exe	93
PID 3916 wrote to memory of 3264	3916	OverlayAI.exe	93
PID 3916 wrote to memory of 2016	3916	OverlayAI.exe	94
PID 3916 wrote to memory of 2016	3916	OverlayAI.exe	94
PID 3916 wrote to memory of 796	3916	OverlayAI.exe	95
PID 3916 wrote to memory of 1656	3916	OverlayAI.exe	96
PID 3916 wrote to memory of 1656	3916	OverlayAI.exe	96
PID 3916 wrote to memory of 3448	3916	OverlayAI.exe	97

C:\Users\Admin\AppData\Local\Temp\OverlayAI Setup.exe
"C:\Users\Admin\AppData\Local\Temp\OverlayAI Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\Squirrel.exe
    "C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    3⤵
    - Executes dropped EXE
    PID:4628
- - C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\OverlayAI.exe
    "C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\OverlayAI.exe" --squirrel-install 1.0.0
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1348
  - - C:\Users\Admin\AppData\Local\overlayai\Update.exe
      C:\Users\Admin\AppData\Local\overlayai\Update.exe --createShortcut=OverlayAI.exe
      4⤵
      Executes dropped EXE
      PID:3180
  - - C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\OverlayAI.exe
      "C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\OverlayAI.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\OverlayAI" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1668,i,4233261523604893430,3959955967767598474,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1672,i,5884697541149789027,5982985551839989752,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1664 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2804
  - - C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\OverlayAI.exe
      "C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\OverlayAI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\OverlayAI" --field-trial-handle=1668,i,4233261523604893430,3959955967767598474,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1672,i,5884697541149789027,5982985551839989752,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1888 /prefetch:11
      4⤵
      Executes dropped EXE
      PID:4432
  - - C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\OverlayAI.exe
      "C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\OverlayAI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\OverlayAI" --app-user-model-id=com.squirrel.overlayai.OverlayAI --app-path="C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1779479253706172 --launch-time-ticks=518891114 --field-trial-handle=1668,i,4233261523604893430,3959955967767598474,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1672,i,5884697541149789027,5982985551839989752,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2640 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4160
  - - C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\OverlayAI.exe
      "C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\OverlayAI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\OverlayAI" --app-user-model-id=com.squirrel.overlayai.OverlayAI --app-path="C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1779479253706172 --launch-time-ticks=518925888 --field-trial-handle=1668,i,4233261523604893430,3959955967767598474,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1672,i,5884697541149789027,5982985551839989752,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2956 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:468
- - C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\OverlayAI.exe
    "C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\OverlayAI.exe" --squirrel-firstrun
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3916
  - - C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\OverlayAI.exe
      "C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\OverlayAI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\OverlayAI" --field-trial-handle=2256,i,3983571748796824916,4283925651377255617,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2260,i,10742124408480289585,10920400980887853094,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2288 /prefetch:11
      4⤵
      Executes dropped EXE
      PID:3432
  - - C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\OverlayAI.exe
      "C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\OverlayAI.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\OverlayAI" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2256,i,3983571748796824916,4283925651377255617,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2260,i,10742124408480289585,10920400980887853094,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2252 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3308
  - - C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\OverlayAI.exe
      "C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\OverlayAI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\OverlayAI" --app-user-model-id=com.squirrel.overlayai.OverlayAI --app-path="C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1779479253706174 --launch-time-ticks=523180877 --field-trial-handle=2256,i,3983571748796824916,4283925651377255617,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2260,i,10742124408480289585,10920400980887853094,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2648 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3264
  - - C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\OverlayAI.exe
      "C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\OverlayAI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\OverlayAI" --app-user-model-id=com.squirrel.overlayai.OverlayAI --app-path="C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1779479253706174 --launch-time-ticks=523211915 --field-trial-handle=2256,i,3983571748796824916,4283925651377255617,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2260,i,10742124408480289585,10920400980887853094,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2968 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2016
  - - C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
      python -u C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\resources\transcribe_server.py base transcribe
      4⤵
      PID:796
  - - C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\OverlayAI.exe
      "C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\OverlayAI.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\OverlayAI" --field-trial-handle=2256,i,3983571748796824916,4283925651377255617,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2260,i,10742124408480289585,10920400980887853094,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3732 /prefetch:12
      4⤵
      Executes dropped EXE
      PID:1656
  - - C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\OverlayAI.exe
      "C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\OverlayAI.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\OverlayAI" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2256,i,3983571748796824916,4283925651377255617,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2260,i,10742124408480289585,10920400980887853094,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=832 /prefetch:10
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:3448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 80B
SHA256 8de1276045c616cc447b027f6ad107be1dc741114d755f66093ff75d4170cc65
MD5 9a7b91953d0d0e098e62b570f82a2ada
SHA1 06435f5a07b00913ff1181da7dfe30ed39ba9c63
SHA512 3855462c7385bdd46a8eb3cbcb470e805e142de3a50bee78e94e5906cc40d798732123e17e4989bae4cc3950490cc6689d604d898835120462a40472e71a397c
TLSH
T170A012DC215820D8C4C485804C090854C5008A3606C0016016046E438011015596509B
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.8MB
SHA256 76359cd4b0349a83337b941332ad042c90351c2bb0a4628307740324c97984cc
MD5 a560bad9e373ea5223792d60bede2b13
SHA1 82a0da9b52741d8994f28ad9ed6cbd3e6d3538fa
SHA512 58a1b4e1580273e1e5021dd2309b1841767d2a4be76ab4a7d4ff11b53fa9de068f6da67bf0dccfb19b4c91351387c0e6e200a2a864ec3fa737a1cb0970c8242c
SSDEEP 24576:pWltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9m2:0t3UCiag6CKM2zCyZuOjJaxSS5qh
TLSH
T15A956C01E7E89F2BE56F6B76E030055813F3E9867376F78B2A4871792A937504E053A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif
Size 43KB
SHA256 ce636d201ef86ffbf4ee8c8762b4d9dc255be9d5f490d0a22e36fe0c938f7244
MD5 b5a42ecde0b058b3c4e661e0ec84400b
SHA1 7e2bfc653c5bc6997553c150a0823daae372cd99
SHA512 b7f4a7bddb226066f7edf23dfb9bee658c30ae03dfe727ec739f51fd98c63831f732343c14a6ca080f31baed38bf9064cdd57c9d1daaf4c42c029fe83d846dc0
SSDEEP 768:5XxIn344C+JtOb7Q+8Phv9YaZuJ+Hz7X9Dbzjy2CXdSksvlxkZPbM/zEffvTeq6e:5XxIn344C+Jty7Q+8Phv9YaZuJ+Hz7Xk
TLSH
T106136B3EC2949279B43716F72A1B4EE26B5667B4221152421BFC70D332BCAEE334641F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setupIcon.ico

Path C:\Users\Admin\AppData\Local\SquirrelTemp\setupIcon.ico
Size 70KB
SHA256 a7845acfe3751cbedaf2f928e62d6e83c4c99bdcb4a436eff23290d3cc2aea3b
MD5 8b817fa625856da298c870f719d32dba
SHA1 b903bc4a18a2e1088be39efac26db6326b175caf
SHA512 f4aec3de43cab016ac4d6851059a6be890503427a97b9becaa1d66a791661f59ded2979064f0491bb6551dc56d178d0b9459cbf4db4f2dc02047fcc8f5032df5
SSDEEP 1536:Z3a713SkbvWe2ONCn3/Ayx4JKnAFhia31JX5OT:Z3W13SkbZ2SQx4JKnAF9JpOT
TLSH
T11F6302A6CBB5DA03527A2E936125C0E83ABDED4FF540195CBAE0C8080F46E87E9F0547
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OverlayAI.exe

Path C:\Users\Admin\AppData\Local\overlayai\OverlayAI.exe
Size 320KB
SHA256 01abd3e12ab012f586dc0aeaed8f637b4cc2b44c5364fbb2fba22503e9d494b8
MD5 37565c8fdaf614901e63060fd0e402a0
SHA1 91741dd4a6f7f84c8c03455c90ba45b83e6d6a46
SHA512 7db04378bb02639ae069c5ddc4c6247e078fc90b50cf34fcc0441359460a5ebca2f19c15c613b8ba16a99a5a2b9c714e70f5139a7c598db5eeb838f10d19ebfa
SSDEEP 6144:kZzvhs2Z4n1E7g34XtVYAOfTdoW1CzSYjAjJLdU:kJ+2Z4nShVY571CWYaLdU
TLSH
T1A9648C21B9D2C4B2D1B2163009F8E7B16A2DFD600E619E7B73D4772E1F741C29631AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\chrome_100_percent.pak
Size 113KB
SHA256 34433fa04ddf5eb78b3b4e9c64a3af626e28641907ad7a6086614eb6a8f00a07
MD5 a8d9be85b9a9c2a1be1815b29cfde9ce
SHA1 9b8df5aebf541d063311ad4c2be1d23398f13a33
SHA512 37ad60e74c7e439f83b87ce61018619568914ee491289e3fb34234a0c4e3258c4986cd56e6e58652134058ab1f824a90499d4aed46e611937ec946d9a3b680ec
SSDEEP 3072:fnk4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:fnZYWFUbGz8LI1TdjQBQCrC
TLSH
T1F8B3E0D773B0AD7DD6870BB783660070FCB31B2D06C2160A4A99E479652AF88D8D93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\chrome_200_percent.pak
Size 183KB
SHA256 581c8d53199c10512d31a340699f9ad269f8eea5fe6bc49e05c1bde98ee612aa
MD5 e0d4001307e8e8554810b27796ad636f
SHA1 be92e88b55ae85cc5118009af0fe32c9470c0dca
SHA512 762324239832fa1a531cc3da546df8627610a164c13d83f12b64c28e207273989fa7da0c4e96787ab0a5d09f5202ebc31895f09ad2fdbea4e6e70c0d2b4f51d1
SSDEEP 3072:jgJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:jxGQ+N6uSZQDQYakvyAk9jQBQNd4
TLSH
T1C704F2D723B8AE3DD9570B73926610E0FE7A20291EB3110E469F98397925F8CD9C9343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\d3dcompiler_47.dll
Size 4.5MB
SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
TLSH
T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\dxcompiler.dll
Size 24.5MB
SHA256 7a743a2af5b4cb59cec8c38e7fb544b87fb6547f215491634a577a03a4e83bd8
MD5 dcf7bc6b7aeac597a40b06a906efd791
SHA1 e0b1e1b4defa1700afff55a053bd861ee92ac43b
SHA512 41654c55f7df527bf61365b7be205aa749278dc0c9a0a2f0951942aa4e03e028c9d06caa041bc5653ff3193e2da0ed69352eb8b7c5a7a2f43eff6c611ff1f591
SSDEEP 393216:Y9tCn2P9zxhOMXtVz5icpXH5uVUi+zru:xGzPdrIVCC
TLSH
T13C473A122646D49CC059C879C7678B26CA6C30E73FA7B8EBC0F451252B79EBC5B39235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\dxil.dll
Size 1.4MB
SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
MD5 f8f3501026df30556c34a9af9cb7af9c
SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
TLSH
T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\ffmpeg.dll
Size 3.0MB
SHA256 e7aec5ca86d80540ea30c5acdf0a13acb34d1d9dd0f9e78b36fb21776b711a1e
MD5 d16c22c2e0a5b20328e4b97d17eb1ec3
SHA1 c5bd4b1732e374c3d8d886957c89e01fc0d04f86
SHA512 c057fb776361decefd67ab0bcd6fdfc6e6c2e5721dbc4804607d31f5a76f840db2221ab3c2e74a239c6914be1937036fdf2d9b048456b000a6c5cb6620cf9672
SSDEEP 49152:TlyMFEi+bSxsTUs3mFNYisl199a6LKIbB7k6TNDNoJHaKyEC8bWa:TlyJGsQsU+is9dNoJAe
TLSH
T132E5AE02F6D651ECD019C074979B9313F631340A4F209AEB16909A263F6BFD87E7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\icudtl.dat
Size 10.3MB
SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
MD5 5bfd3eefca4b5ef2d1a869396390a7de
SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
TLSH
T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\libEGL.dll
Size 510KB
SHA256 6edaea2de8f6bca40dc4cbb60a55be5ae93c2454a66474c3706953b5d1d73e26
MD5 a65b12fa968ed59208ac9a7f0d7305af
SHA1 e15a8e532677056fbac70e1c86e857131bea9474
SHA512 37d6e4340ea299dd6eaebaf95f55d8c752858c15fd123399036f58d010098f4846797ee3877fa6331adccb962ce98f20187aaa7358b2eb7b4a42570ec6fecda9
SSDEEP 6144:ZeQszxnw5uBqWh//UlBowkZDYJ6RSQmWYmkHGVGWFcsfAVMugP4CfaguL1iMg:JG/V/iZJOmW6GVGWFcsfAOugP4C410
TLSH
T185B47D15F3E84BA9D07AD1348A438642DB7174961F65F9EF02E052392F3BBF45A3A324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\libGLESv2.dll
Size 7.6MB
SHA256 49c2a50a3a43c10e258eee0d58e81be9d207ebeae206d603314f1ebc36d7567f
MD5 ab703fc065cead136704b1c2963c4039
SHA1 fac04af28e1cc55f65a01c33cb68d1a6226cda49
SHA512 3db650bed7c33720a1da60646d174aa025aa5bb84d475d18557729fcbf569b920a8700849558771fe363f7606759f395981551e1328d2744fc633167c03c9d87
SSDEEP 49152:lp3tZ2bk75+yjyLiQOnCtRmNdEHsQZl90dhM9FGgI53lt7w5YAzw/LMOO40YNDYL:zKbyLyLWw9q3zc5Zm5uThnjGk6pG
TLSH
T1AE867D03F68641D9C05DE2749B67A223FB34B8450724B7CF2AA457152F6AFE0AB3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\locales\en-US.pak
Size 548KB
SHA256 a02518efe75c630a1b5419af5ffdb1b16636b939139bccd7710e37f36ad9d55c
MD5 514fbace34b812d20cf9b2bcd2d7fe54
SHA1 2c0d961496efe4b8f8f2614a64aaf3e35d23f848
SHA512 eb915b16e3ee4382d2bb14393900d3f80f198fd029cd2c3faf066795ac29fb3dbd592fc0ff1a7203259eda205aae1ef7399a5aa9daea69971d41b1a9a8ef0e4a
SSDEEP 6144:roemduy82EC+HNHfYOMg/jScMP9sQqblfaYQhp1B1OjRng98//Swf:snuy6rHfdZM6Qqbg0jSwf
TLSH
T1FDC44C1FF744122A05A352A27F0995A2FF32D06CA35112563CBD812C33B6B6693B77F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\resources.pak
Size 6.4MB
SHA256 741b7aebbec65ed7af754530e77b45ea4274e8f7c012c4396de789563a1183a5
MD5 2c43829c0a3d14b39faefb40d3db1c92
SHA1 c0a4afec5b4aaba80bd61e92e1806a5562fc318d
SHA512 c2dd9e9a26cda3ce112ecb714774bc33734c3c2d7ebcf72b248bfdbe96895d96d00817322ca5347edf92d54c1480ac3fa5037a1db368b8823522dc3e1dfec67f
SSDEEP 196608:2StRBRMfjp5QoCmkrB0QMguFBgt3m06Rw+Ki:2SvTMU9mkr4jFWBm0iw+h
TLSH
T1AC6633DBB1311C4FC58883FE8529417EA86CA7A1398951A2199C7128CC2E74F7FC967F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\resources\app.asar
Size 1.3MB
SHA256 4b5734b5beeb0db7e7484e3e45cc194c735aaf5a5726a91465878dde4f8c01a1
MD5 e24ac990c6674f97c8b94a467faabc47
SHA1 79c89c74ff3826042c0933c9b583e32c12d94aee
SHA512 0f13d582b56a7662ad4d9fc488183faaa3481cf419ac63afad3b46a977da4ae405effa96f5d9fb660663f2a5e580eb32dcc778e03c9d3964430cc58090261d61
SSDEEP 6144:r1UJViiVJlCMPTDiOD8DkUrO8USzoUVLG4VX36YxOhnkwWIdg+ZRUPd1mFfqhOkD:ryvjZ8oUJH3bYcz+PUPxB0fvJUMxE
TLSH
T195555BA57A61F4B503E346E6903B0102F3382529701D84A0B76CDCDFAB5998F61BBF79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.png

Path C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\resources\icon.png
Size 414KB
SHA256 f4b95631e7fa6a1125c26f071a455e21714af58fff036ec80dfdd89ad78bb1f9
MD5 cef913c1b1f4e9d49f7c7af3501c0f8f
SHA1 47aa72231177680e06b7207faa543f3982c50f19
SHA512 11c76d314d50c8db92c649d836309d9060d4beac9d9934c78e47aa2731eb0e61a91b50f84e8089738b4015cb3074979d9b46ebdff66a6b7ee7369ee181087330
SSDEEP 12288:h2mMhemWi9P5C+EUsXHoSnQxAKRB1U0seHUJwO:hdMheM9vLSn0AKRomHUJwO
TLSH
T13094230252A517F5978F44C27A088392FD317ABEF7C5475BCD73E8318887AB49C92A72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

squirrel.exe

Path C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\squirrel.exe
Size 1.9MB
SHA256 29b55ec938a3681c2aa0418f867676efca925ea6a0f3c21e2a2fb129f5dee521
MD5 4704dd1e51bea3d4f09d332dfaeb890f
SHA1 bf37ecd47ddf15beb35104955480a2bbabf7fbf6
SHA512 a596ccf57e113acb1ff8486832d3a482673f71159c19e82f73970161d1f6e35f16b513ff0ee0c71f2e9ae50e6e939b2ea6bb70ddb638bd057bd1df24010178ef
SSDEEP 24576:sWltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9miVn:Zt3UCiag6CKM2zCyZuOjJaxSS5qhN
TLSH
T122957C01E7E89F2BE56F6B76E030055813F3E9867376F78B2A4871792A937504E053A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\v8_context_snapshot.bin
Size 698KB
SHA256 c321440b5b893fabf4cb983c46c325e6b1959536b7c98a3f1f0200df8ad61a33
MD5 6e8d12753ebc5b5936175f4e27161596
SHA1 ae99854477eadd9bb153f1d7475eb50b28c465b9
SHA512 7ba52fa8ebbc8f3067d7218d5bab657d93b18d5c6e7324e82b97ac77ec47db376685b047a4d73109888946316f369fee3190936a3c27fefe5cc625c696847f34
SSDEEP 6144:V/V4XptgO5XKt+Hlzx/8v7Lx2NyuClVlxykismIdukcLKYNcPK:V8D5XlEvXx2NySkQIId/H
TLSH
T1ECE4A761FB0A8F3AC5453BBD8DE657463A30B18E9E87E24B7405633D78B96B04C3652C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\overlayai\app-1.0.0\vk_swiftshader.dll
Size 5.4MB
SHA256 d50b5ed41356b540e1f1d3525837effd4045220cb4efbfc2b913fd7d7edd0999
MD5 3007dd886e26b72242062241cbc44433
SHA1 f6983d1db8933923b3b175cd074881d6ac395190
SHA512 2e1c0594cdf42c72b8e411b528dd6b2614df035670703598a438ef4960022c738f15a08dbca8c5f5d1dfcda54e078d0d47c554e785fdc8e269bfe3e827df1a3f
SSDEEP 49152:4+et2UcrN42sf0vTrWny2/Gh9qIHGZpVZSbiP1VFz2ZtIgrduZsgP/m9vqjfc2c7:4Jt2vI4gmlml3pCIn
TLSH
T1DE463803F28681E9C06DE5798B5FA623F631F8840B2276DF56A00F192E66FE0673D715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\OverlayAI\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 6bd8aa3aa45e77524876d4b7e9b56e35557cadd0dadebad2bb1b6e8ce716c1dc
MD5 601feb38e1ed15bf24895b463e60562d
SHA1 2a89af1a932bcc9618b8ec0ba693cef8314c24f4
SHA512 c9141547f282b06e1799cc18c6f972f48f8dc5f6c57725d4350b017e591e3ae9f5841e30898ac8b75319d300b973293984e7b5a9a14bbcf8cff11e0109c6250c
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\OverlayAI\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\OverlayAI\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 55600663ff6dfffbcbde6cc380e5d05ff382a6663f03f344eccf019a8e337410
MD5 4372a895f18e208d9c3261f904bbf9fd
SHA1 484cca4a7ca3107f87bdffd1ff2ca0193599686c
SHA512 4e5e257d91b68afd8d6eb8e0fbbd5a37e081902d32824de796a274ad17cc2def6ba2628b4ecd12f8f6881a2948b0354c16b1c0035357ba6af42bdd15f8508176
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\OverlayAI\DawnGraphiteCache\index
Size 256KB
SHA256 0e15ff130a317fe16b36d58533d73340cf857943f055b3970c3082f5cf8a76a6
MD5 d6cdd740da5dc13ad98a4b66ab7c11b6
SHA1 b859a6c9afb408a518a06942fdbddae676f039a2
SHA512 df9b85fbaa715c3f90cd8aeaf7bf3596df6cd8b40a2155c6e0818fe12cb62e8bf1dc5d9bc3825c418a3cebbdb8e2df536b247e0df80c4d4a342b9ad7f05bfce9
SSDEEP 3:LsOllllklkXl3jKt:LsUlP3jK
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\OverlayAI\DawnWebGPUCache\index
Size 256KB
SHA256 732fa94cb174e7edb2913b205cd2d306dd0f061134fcf900822d26b236a16f3b
MD5 3767312633d3e9cd46866b6214ba54fd
SHA1 185a895a9c13b86881a7d32e8716dcc7f5a8d0e8
SHA512 40647ebae382cdca1488f4e02630d21090242c1a824fb8c32f83274820a345c26d2d3b208b8db5a8ee4e8dc0f02e351bb21135d6db84228620dffc03630fa796
SSDEEP 3:LsOllllklkXlGMt:LsUlP5
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\OverlayAI\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\OverlayAI\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\OverlayAI\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\OverlayAI\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\OverlayAI\GPUCache\index
Size 256KB
SHA256 0d541dced4e2da92dd6284418162fd17e1d765ce73b1c74e9aacaf1981614381
MD5 2c76a333a2d4984e5e9b314f3fb11c18
SHA1 c92259497d7ce6b6e571f4a34fe953e3334ddc9a
SHA512 49c58e9e5e003e53e1a39cfba335ab2373e445537a78aa226fe46668d6e278ed0d0510e5e9b252636d7355ed33440f5037510ba2f0cff32aaec862fb25860576
SSDEEP 3:LsOllllklkXlvxKt:LsUlPJK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\OverlayAI\Local State
Size 490B
SHA256 593306440982fc175f1124105fed8d11668fdbf86870c6a35f48d8d69709358e
MD5 9afcf1e591bc04883c4df78c22a28339
SHA1 8c91770e78680aaecf060bfdd129275f3e1aa703
SHA512 f92dc5e68ed45730b76bd2124f7391ee3545cefaca8612125d998f650781e45add71b152f57e778b52cadc983f92268f80aa46c10c8335856f373bf28ca14b1d
TLSH
T164F054BD0CB12F552F1ECD984C8A75030C7914B35864408632D98202C2EFD7C8703C74
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Roaming\OverlayAI\Local Storage\leveldb\000003.log
Size 30B
SHA256 8bd2ea70a0b70c91de138a5b87c7936c6a6fa7c4275c54b97f4ef0ccc5b79bb4
MD5 7e957d693bbab6ad7dec1d3aa28bd69b
SHA1 50369f74c280d83046d6b779ecbde129b8ac3b98
SHA512 0228357b6c4b73f3ef20a333b7afe71fb589efe438bc28a3e04df3fb64f367b7b463dc9c9792921c531124b7bde600524827b40f2cc5aeddbc1df8b3ed822cbf
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Roaming\OverlayAI\Local Storage\leveldb\LOG
Size 251B
SHA256 d481bc7496d422447803dc025a59bb81c470b473d82cdd16f361a91e687aef3c
MD5 60953f57c1d0c97e6a892be2d59db1f9
SHA1 168860f2e9d68c14764342633465a083173cff94
SHA512 cd6412ef764a0378d61a5f8a5f580e950280e4d83901faf32fe4e770444f53669d176538f21a43bbcccd7df8cd0da8ca4985fa092024faf67390cfbd588f3175
TLSH
T1D5D02E3290EE874CA64A81EBC237B70ACB74A220FBCC225D5F48F44A358420C98020A2
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\OverlayAI\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\OverlayAI\Network\Network Persistent State
Size 185B
SHA256 290f2910266f8591fb60cec19617d5075b070c66dd429df55d207f873dc4a0de
MD5 ad2acd7710f1ab58b7315d392be235f1
SHA1 96477929e7e8375c575ead3377a5f281bde106d0
SHA512 c1ccf5978f1dc0d4fe5a033ea2da8fc817cffc7a6f64e5446dad14b64c00f9f500338646710646b90757adfc061187234f969b7583a0d736abf69d46dbb7c071
TLSH
T180C012A6967028FE475593F05914AD13C6FE0006131C9DA69568B729466257D541484B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\OverlayAI\Preferences
Size 93B
SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
MD5 322f01bb491180333c338526d93f115a
SHA1 554d5e43d5e46774b8f2a6b3682243a289927754
SHA512 69f8e980f44b1465cee8c0485598fa00be163db0fe88598e45ab2f817f9bea36a2b70dbb9d25d5214174ea9c198b9641bb3d5a86c18b1a4ea4493c00e2e95eb2
TLSH
T103B01253B810A0324B1B09E5000BC94F2CBE00340E475A0510D4F39D492DD4D088702B
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\OverlayAI\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\OverlayAI\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

memory/3180-210-0x0000000002F40000-0x0000000002F60000-memory.dmp

Download

memory/3448-385-0x0000017BC5840000-0x0000017BC5841000-memory.dmp

Download

memory/3448-394-0x0000017BC5840000-0x0000017BC5841000-memory.dmp

Download

memory/3448-395-0x0000017BC5840000-0x0000017BC5841000-memory.dmp

Download

memory/3448-389-0x0000017BC5840000-0x0000017BC5841000-memory.dmp

Download

memory/3448-390-0x0000017BC5840000-0x0000017BC5841000-memory.dmp

Download

memory/3448-391-0x0000017BC5840000-0x0000017BC5841000-memory.dmp

Download

memory/3448-383-0x0000017BC5840000-0x0000017BC5841000-memory.dmp

Download

memory/3448-392-0x0000017BC5840000-0x0000017BC5841000-memory.dmp

Download

memory/3448-384-0x0000017BC5840000-0x0000017BC5841000-memory.dmp

Download

memory/3448-393-0x0000017BC5840000-0x0000017BC5841000-memory.dmp

Download

memory/4160-179-0x00007FF86EB20000-0x00007FF86EB21000-memory.dmp

Download

memory/4160-180-0x00007FF86DB10000-0x00007FF86DB11000-memory.dmp

Download

memory/4628-108-0x0000000000430000-0x0000000000618000-memory.dmp

Download

memory/4648-125-0x0000000022480000-0x00000000224B8000-memory.dmp

Download

memory/4648-126-0x0000000022450000-0x000000002245E000-memory.dmp

Download

memory/4648-8-0x0000000000420000-0x00000000005F6000-memory.dmp

Download