c6a53c49ca21f363d68f98f6d4f857ec27d9efd97a068deb034d459fbd8b7afb

Analysis

user interaction
yes
max time kernel
26s
max time network
27s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
05/07/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Overlord_1.0.2_x64-setup.exe
Size 3.6MB
Sample260705-rtfpvacz31
SHA256 c6a53c49ca21f363d68f98f6d4f857ec27d9efd97a068deb034d459fbd8b7afb
MD5 6e46181fcc27b2bd5b2a5b2d93831802
SHA1 e58de8a0d3e1e0413a843361b553d2f51bdda3eb
SHA512 7e0b4c13d54016ddcfb74207c5883a69893faefefa85f42e744e4e5ca3a732e7d57333c414732f72fb2422f370a47814adae77a788a9fc7d5118bfaf517c498f
SSDEEP 98304:g581CcBHoKjSnwPQYyZsU43lP51dnIBLaoXFpSaZ:g5gjSwPQYyqV51dIZagQm
TLSH
T1E6063344BE538E75FB350B706AEDB3A717F6B41846C2AC03472C6C6BD6612ADE40D193
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3604	overlord-desktop.exe

Loads dropped DLL 7 IoCs

pid	Process
564	Overlord_1.0.2_x64-setup.exe
564	Overlord_1.0.2_x64-setup.exe
564	Overlord_1.0.2_x64-setup.exe
564	Overlord_1.0.2_x64-setup.exe
564	Overlord_1.0.2_x64-setup.exe
564	Overlord_1.0.2_x64-setup.exe
564	Overlord_1.0.2_x64-setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	overlord-desktop.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Overlord\overlord-desktop.exe	Overlord_1.0.2_x64-setup.exe
File created	C:\Program Files\Overlord\uninstall.exe	Overlord_1.0.2_x64-setup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Overlord_1.0.2_x64-setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277354029589452"	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
564	Overlord_1.0.2_x64-setup.exe
564	Overlord_1.0.2_x64-setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2520	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeImpersonatePrivilege	564	Overlord_1.0.2_x64-setup.exe
Token: SeImpersonatePrivilege	564	Overlord_1.0.2_x64-setup.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3604	overlord-desktop.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 2520	3604	overlord-desktop.exe	93
PID 2520 wrote to memory of 4008	2520	msedgewebview2.exe	94
PID 2520 wrote to memory of 4804	2520	msedgewebview2.exe	95
PID 2520 wrote to memory of 4804	2520	msedgewebview2.exe	95
PID 2520 wrote to memory of 4804	2520	msedgewebview2.exe	95
PID 2520 wrote to memory of 4860	2520	msedgewebview2.exe	96
PID 2520 wrote to memory of 2524	2520	msedgewebview2.exe	97
PID 2520 wrote to memory of 2524	2520	msedgewebview2.exe	97
PID 2520 wrote to memory of 4624	2520	msedgewebview2.exe	98
PID 2520 wrote to memory of 4624	2520	msedgewebview2.exe	98
PID 2520 wrote to memory of 4624	2520	msedgewebview2.exe	98

C:\Users\Admin\AppData\Local\Temp\Overlord_1.0.2_x64-setup.exe
"C:\Users\Admin\AppData\Local\Temp\Overlord_1.0.2_x64-setup.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:564
- C:\Program Files\Overlord\overlord-desktop.exe
  "C:\Program Files\Overlord\overlord-desktop.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=overlord-desktop.exe --webview-exe-version=1.0.2 --user-data-dir="C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=OverlayScrollbar,FluentOverlayScrollbar --ignore-certificate-errors --lang=en-US --mojo-named-platform-channel-pipe=3604.1908.6062381500712358057
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffd6380b078,0x7ffd6380b084,0x7ffd6380b090
      4⤵
      PID:4008
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView" --webview-exe-name=overlord-desktop.exe --webview-exe-version=1.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1816,i,15551958730041900737,8686389784259366769,262144 --enable-features=FluentOverlayScrollbar,OverlayScrollbar --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:2
      4⤵
      PID:4804
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --ignore-certificate-errors --ignore-certificate-errors --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView" --webview-exe-name=overlord-desktop.exe --webview-exe-version=1.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1920,i,15551958730041900737,8686389784259366769,262144 --enable-features=FluentOverlayScrollbar,OverlayScrollbar --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
      4⤵
      PID:4860
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --ignore-certificate-errors --ignore-certificate-errors --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView" --webview-exe-name=overlord-desktop.exe --webview-exe-version=1.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2160,i,15551958730041900737,8686389784259366769,262144 --enable-features=FluentOverlayScrollbar,OverlayScrollbar --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:8
      4⤵
      PID:2524
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView" --webview-exe-name=overlord-desktop.exe --webview-exe-version=1.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3492,i,15551958730041900737,8686389784259366769,262144 --enable-features=FluentOverlayScrollbar,OverlayScrollbar --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
      4⤵
      PID:4624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

overlord-desktop.exe

Path C:\Program Files\Overlord\overlord-desktop.exe
Size 6.3MB
SHA256 49aefc526891e5e20f7f106495e7ed4b0f17a499aa928ccf7e88b386dbe24864
MD5 faa5f862d1654a1be6bf0ff1851a49af
SHA1 b4cc3841da12a59b288ad94ec63014dbeaee7ee2
SHA512 782a830b1d25db054d079f983eb93898b9e3b9efc5ba82fc5e0fa1878c5e6f89b36626b5b7bbcfbbb379183b72596bf875313870d602291144b4c1105b4d8961
SSDEEP 98304:qYkIhokWFxafcHxOw+ugzdUy9NdMN7e+P01kC8QOFan+C/o:VhsxMOgzzXMJBqkmm
TLSH
T18E66AF03F6A180ECC06EC1B5C35AA633EB32B889493476EB57E41B212F5AF506F1D759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg7B76.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsg7B76.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg7B76.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg7B76.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3068f126b135567439d016570de01629d6a56a8cc00a1421632d982fe6da2b1e
MD5 b20f2c966346173afc7b77967764fc9a
SHA1 53951e108de85aad4e9ff56b648a3be66280caa7
SHA512 fc4089f192fafbf2aaf1c6050f4841864155c58a587f870b5bfd0cf438f879ac56c3dedefa0df65aeb91f58be010c4d0ac8dc01a18aa3524c9e146ded2167a4d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 19350dafe882f027dd8addd829415be2dbfc5e9d776c1ab91e9a5d6ee3d46af4
MD5 ffaa71f014dd11a997ec50420707b521
SHA1 9a0d7e088c0d3753a5785c9fd38b6af59d961284
SHA512 4de373c5e88fdf5212a99f679d1057e2fb1eb58c4e14702a9445b761dbea3d5d9b525dd031d65be1ef9cafbc0006d4b21e1bd6126bda9b5fa7b3f9e4d5a4013a
TLSH
T173D0121376018379C41020330013660C0641C10F810540C45828C61D6A444540903493
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 9d1434249b3a2a28c66f0a9f8359483a94815d45177c147dda7b217deaca0f32
MD5 3bbe3ca1c3343d6acb5777d1521b577b
SHA1 931c21875c21a205ec065f5dfdfb486102cfcfee
SHA512 f0a134d414343844292001718a6028776a639961eb983b521ce371f42c3120ddaa515e1237f617fe373866f08a6feeb1a0b1586811a27371c3df7d4d62f5ba3f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 d32c7d2ca9dd58617a41ab8939190ed4e6153ebd6a5140a4027256f3fe2e4939
MD5 7f4ab4cf83daa4042329ccc7f341ead8
SHA1 523dd1df67fcfe4fbd13e3097183a48dfbce5d43
SHA512 69d74d9689f83c6c87f558294399ee10d4b883104f694ba2564bf19f56e3a55c4c39dfe9ad8e6384984330293311a65f8474de592d747192bd9eb4ef5928b322
TLSH
T147A0027007B43143F144437954D163D972214B70399A0F418094C264CC52250A651409
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Default\Extension Scripts\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Local State
Size 1KB
SHA256 c6113a2f10143a9dfdd780a64a3496cea4c27be17cf63840f2dfcc9fe9f25d47
MD5 ee6b6662c39bb4d81641970abc1db751
SHA1 2c8c9bbd0e06c1670861f88e6c3cd4718f76a93d
SHA512 0bfddb0cfde5a0df6b49de12c4233585ff5aba9f137ad7d503a54fe59e8aa5769ad07573e8fdca3398466270740031a15f7a860cee6c65237cc37cb341d65888
TLSH
T16D3179F3D494AF7368C1D9667001BE9B5E203155C2505E4492DD8F0D02E71DDE11BD37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Local State
Size 2KB
SHA256 943bcc70195874a3c26eec71d6dcf0f76d21086de66b35cccd3ae4bfd3c16474
MD5 5621c5290c3fc066b5d07de2b3630a52
SHA1 be6dc306289b94b7e91f77ca45a87f0e82f7bdb9
SHA512 3c32f53e1ff679e88cbb1cf6def866041c760e22ddfd051cf62a9424dbdd8500311d0d27ea206556805549d9b7dc0700a44de4550cf923a8497d887ac7bf68e7
TLSH
T13E51B8B36818AA7748E3C918B8053F67DB3562559B913FA097DD0F0C02DB19D2306C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Local State
Size 3KB
SHA256 54ba344926de24d59fe779d75cf95441ca03a2a2700d0ac30d1a151ff6d4d597
MD5 e24968c8f12db26a495d8f3f1cf91ff0
SHA1 ded30c0d64b49f8af3267d04965220e910d4ee4b
SHA512 f9cae4adff1727a2313450f47ac5a61b5a6fcf0906764b25c35d8c58ff723614a3c8cf9dc7e37d0fd0619b639dc07d83f83ed2bb0d166368a7885f2bb7342ba8
TLSH
T17B71B6676868E9774DE3DD14B8853B17A7656227D6D03FA4C6EC0F0C02DB2D92342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58bf92.TMP

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Local State~RFe58bf92.TMP
Size 1KB
SHA256 b96d7c5ec26485480a1201faa1bb3c476b22f9f1f2089d0865baacd1839e6e6e
MD5 f18a83e7a8e054e17c13bededfd99c00
SHA1 50330a7495c49ffc0d50f69d57e382b37559f4bd
SHA512 c4c37eed0599623e2fcf02977e406f762d70e43713d66954cbed0f579a93e91f9b4ac565e459e93a0f68d35ac9c2f9d65ad5d106bc17bcd23171fa667ea26805
TLSH
T1F12135B3C494AEB76885CD65B012BEDB5E20715582506E54D2DD8F1D02EB0EDD22BC37
MD5 SHA1 SHA512 TLSH

Submit Download

ce1f7e35-4b67-4bd6-8d74-43d1688b6002.tmp

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\ce1f7e35-4b67-4bd6-8d74-43d1688b6002.tmp
Size 16KB
SHA256 edc3a77f9553b4282492f56c7f56dc03fb9f68f8a4cdeec4dc878bc3e1d2dbe5
MD5 7eb565e06890c091d9238ec34d7a8480
SHA1 b99922152eb5441f114edd087633ac6c4faa7c66
SHA512 47526d3c19fee85ad22582a3eb7e17c20bebcde30c02ced076cfacc88351a0930ae98b5aa0a367f9cd98ab891a7470929eb7358ea64c0cead8f8de190e68f165
SSDEEP 384:zesrv+89zHqlDNP9oid93Nbln/ScEAjAfb1NB:lrv+4UNbd9r6AjAfpNB
TLSH
T1F8729E33A57CAA376CF6D848B4467A0B7B74615695C20BE4D9D90F8D42DF0DA230BE13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2524-145-0x00007FFD7F900000-0x00007FFD7F901000-memory.dmp

Download

memory/2524-146-0x00007FFD7F940000-0x00007FFD7F941000-memory.dmp

Download

memory/4624-147-0x00007FFD803A0000-0x00007FFD803A1000-memory.dmp

Download

memory/4624-379-0x0000025208600000-0x0000025208953000-memory.dmp

Download

memory/4804-78-0x00007FFD803A0000-0x00007FFD803A1000-memory.dmp

Download

memory/4804-390-0x000002057AE00000-0x000002057B153000-memory.dmp

Download