b62bb99bc99ffa133d60820d2eb773285fcb47a168cea96896b00ce1faa87b7b

Analysis

user interaction
yes
max time kernel
688s
max time network
317s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/10/2026, 22:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Overlord.exe
Size 7.5MB
Sample261013-2xfjcsss5q
SHA256 b62bb99bc99ffa133d60820d2eb773285fcb47a168cea96896b00ce1faa87b7b
MD5 81ba608d959d0f6bb51ddf10457b3cc9
SHA1 8beef877972158fb625d43a3adcb653dbf820230
SHA512 ca3cad6654195d9d741eda65713118c374470e304dfd49144593010135996120f6d770aaee0bda211377c2dfbfe2a8da0ea350eff942c253cb1801b13b8853b6
SSDEEP 98304:GNA0VaZCPM1Tut84R9NdMN7e+POSkC8QOSEZn+Q:XeaZoW+XMJBBkn5R
TLSH
T16F869F03F6A1C1E9C09EC5B4835AA633E732B88D0920B2EF57D45B212F66F506F1D75A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Overlord.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
5864	GameBarPresenceWriter.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{7BDB3DE7-78E5-4ADF-970C-72B6C99EF6D9}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{4CA934E6-471B-48FF-B69B-605EC74F9D7B}	svchost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5824	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3396	Overlord.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2800	OpenWith.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 5824	3396	Overlord.exe	91
PID 5824 wrote to memory of 264	5824	msedgewebview2.exe	92
PID 5824 wrote to memory of 5844	5824	msedgewebview2.exe	94
PID 5824 wrote to memory of 5844	5824	msedgewebview2.exe	94
PID 5824 wrote to memory of 5844	5824	msedgewebview2.exe	94
PID 5824 wrote to memory of 5844	5824	msedgewebview2.exe	94
PID 5824 wrote to memory of 1324	5824	msedgewebview2.exe	95
PID 5824 wrote to memory of 6052	5824	msedgewebview2.exe	96
PID 5824 wrote to memory of 6052	5824	msedgewebview2.exe	96
PID 5824 wrote to memory of 6052	5824	msedgewebview2.exe	96
PID 5824 wrote to memory of 2220	5824	msedgewebview2.exe	97
PID 5824 wrote to memory of 2220	5824	msedgewebview2.exe	97
PID 5824 wrote to memory of 2220	5824	msedgewebview2.exe	97
PID 5824 wrote to memory of 2220	5824	msedgewebview2.exe	97
PID 5824 wrote to memory of 2220	5824	msedgewebview2.exe	97

C:\Users\Admin\AppData\Local\Temp\Overlord.exe
"C:\Users\Admin\AppData\Local\Temp\Overlord.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Overlord.exe --webview-exe-version=1.0.2 --user-data-dir="C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-features=msSmartScreenProtection --disable-http-cache --enable-features=MojoIpcz,OverlayScrollbar,FluentOverlayScrollbar --ignore-certificate-errors --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3396.4852.2871009967150937893 /pfhostedapp:03e98d2b22ae580b251c764ac9f746ee5d2aa542
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5824
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView /prefetch:4 /pfhostedapp:03e98d2b22ae580b251c764ac9f746ee5d2aa542 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x160,0x198,0x7ffd7cc25fd8,0x7ffd7cc25fe4,0x7ffd7cc25ff0
    3⤵
    PID:264
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView" --webview-exe-name=Overlord.exe --webview-exe-version=1.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1380 --field-trial-handle=1668,i,3229631595787605362,2986320781629059587,262144 --enable-features=FluentOverlayScrollbar,MojoIpcz,OverlayScrollbar --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:03e98d2b22ae580b251c764ac9f746ee5d2aa542
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --ignore-certificate-errors --ignore-certificate-errors --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView" --webview-exe-name=Overlord.exe --webview-exe-version=1.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2056 --field-trial-handle=1668,i,3229631595787605362,2986320781629059587,262144 --enable-features=FluentOverlayScrollbar,MojoIpcz,OverlayScrollbar --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:03e98d2b22ae580b251c764ac9f746ee5d2aa542
    3⤵
    PID:1324
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --ignore-certificate-errors --ignore-certificate-errors --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView" --webview-exe-name=Overlord.exe --webview-exe-version=1.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2184 --field-trial-handle=1668,i,3229631595787605362,2986320781629059587,262144 --enable-features=FluentOverlayScrollbar,MojoIpcz,OverlayScrollbar --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:03e98d2b22ae580b251c764ac9f746ee5d2aa542
    3⤵
    PID:6052
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView" --webview-exe-name=Overlord.exe --webview-exe-version=1.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3432 --field-trial-handle=1668,i,3229631595787605362,2986320781629059587,262144 --enable-features=FluentOverlayScrollbar,MojoIpcz,OverlayScrollbar --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:03e98d2b22ae580b251c764ac9f746ee5d2aa542 /prefetch:1
    3⤵
    PID:2220

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:5864

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:4824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3540

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1bf11533-fadd-472d-aa2d-0d04be140508.tmp

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\1bf11533-fadd-472d-aa2d-0d04be140508.tmp
Size 15KB
SHA256 d82bad9f6e508f55d31922382d09aab832cd5a21762de62eabeb4b76a2b41b30
MD5 5ca682ae40b7905f5c8d1d59f9f9e340
SHA1 1bb3d9688673c261fdaf43d75166de69dd9c53bc
SHA512 60736b92168f73c732e74f7676d49dc2b7c2d573f19646f1c9b76edeb4099d5d108f443620b3242d0366ca7dc23721a887fb929d661266c041d5636fac4f58fa
SSDEEP 384:z+aQikB+z/xvxjg/qhEiNBSJHWzk9iUIck3Qog9zw6:S/UxvxjgC+PxHk9gFw6
TLSH
T1FF729E3B55797E23D5F6E6047A59078BCEB99472A0C26EB88AEE5F0917C73D80302816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38d02b27-377f-46d1-83f6-bfbde254355b.tmp

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\38d02b27-377f-46d1-83f6-bfbde254355b.tmp
Size 3KB
SHA256 6bd8d58840b42103745a024654f314ac2cdc178c751fabcaab9acd5e7e23332a
MD5 422ee4b8427519fb1b4d66e816682cbd
SHA1 2501d753889443cded8c800c3975f04295670e6f
SHA512 f2624004748849330a24a66164039a5e262aa41cf2a3bd40b150e81cd5ac8995763acdfd6e7f140682d6dae2351f11862d91b3a478517a2d4e8630b1550f4260
TLSH
T12861863B6A74EA37CDF69A05B5C63B06AA655137F5853FA4C9EC0F0C01C72881341C27
MD5 SHA1 SHA512 TLSH

Submit Download

4138f4a4-6d46-49f9-9473-d71f0c62c7a3.tmp

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\4138f4a4-6d46-49f9-9473-d71f0c62c7a3.tmp
Size 16KB
SHA256 735f4ea9120e98b047606012fe38b3576082bbd8e01c9a9ac493f4c44e56b0f5
MD5 cae5a36cc293d02b658e89aeccf28428
SHA1 005eb56bc0fa5a2873d44606adfd1b1eeea28760
SHA512 835938f8105dbd0f691d61f1adea2484aa3f0e54bf390537cfbac49439950a51834aa4bef08a8cde8bedc91da59f818d6af3397a483d383a1f799cc1f69a58a8
SSDEEP 384:S+aQikB+z/xvxjg/qhEB3NBSJHW6v9iU4ck3Qog9zw6:9/UxvxjgC+BSx3k9gFw6
TLSH
T15F729E3B55797E22D5F7E6047A69078FCEB99472A0866EB889ED5F0907C73D80302816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 89d958470dc3eaefc2716c77a1292b7b5f8acbfb6d0e48ebf2dd1440c7472d28
MD5 5b90653b12f3b6275ab3c41a6e9cd25d
SHA1 2758babc2e4c8aa969add7460d63fac86a133627
SHA512 76d579e30a7f13636d0f53afafde9fef46887747a43fa6bcfc2d9e50da976cf3ec4e2bdc2763d9f2b78d9eab91cc38dd1bf981e7f646fee7fde70a5a27c138cb
TLSH
T1B3D0121376414138C0702033010373482451C54B400640046438851E1F840641907C81
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f9f0cd7330e1e91cad58c2bae327126525c738fcd3db6b46fcbe578ff7416fc6
MD5 d6e53067a9f6aea756c0239eed0d69a0
SHA1 b44d7b50ffa5f2d512115ca48a3307ea46d91742
SHA512 2065fe44db51c6c1839142bc48437dfe0663d2a0cd98257c3a63aed4318de7bc6e1989b67f6603968b26daf0302ad7e326e514f00d2c3158731f58ec1e735f89
TLSH
T197D02B6322150534C27031334182F3887011C51F000740042E35F91D0FC00F10C86C81
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 55a66f291c340a22b04f2eb66e60efd97ad3183cf23c09daf5cc94f4bb6cad66
MD5 1a44c68391a96de32253949117f0ab49
SHA1 9f5d8385e5dc14b6fbfaf692dd3e8d21cf632d16
SHA512 048c91edd36b2d94c20e7fb0bc2c73d96dafd214e15eae8a8c1c992f3c3d8b6af55eb45ff51bdb620c76c80e637a9f4827d1b57dd0f14a642dda95bf6a713b64
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

2cc17ec7-151b-4d70-906b-cc7eb8c0cb0c.tmp

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Default\2cc17ec7-151b-4d70-906b-cc7eb8c0cb0c.tmp
Size 6KB
SHA256 ac819cec72cbdd14814e32f4b9d9874b8935a86c20d302f76edb2622a345218f
MD5 e8d1e213c17a696e134d8328c68410ae
SHA1 7f8be191e531e1b3b5787045be514fe88655d8a8
SHA512 2b8f945fa571737203f1fef12fe664727df55a8ee1573747b340994957337b5c7fa1f5448c5ad2791c13ce8696727bf48c24878bcf0cc13cc6b16897c96e7d8b
SSDEEP 96:st+/dBVrQOb9Uk+Co5h16Z0EsL+8/x+6MhmuecJ8FSj0jeMK+gUKlI8XM1C7K:stGpImonEsL3+Fd884jIdg6K
TLSH
T1B7D185469F24B97B8CCBE519BB65BB17E2F9603270902E48E7F8492C05D76DD630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 990ad79139f409629962f86f905771e20428bf68c2748ee549bde9dff0b5c6a0
MD5 9b15174123c91154107564cabbf5d030
SHA1 12b6b671dde7e0e24504e3d2d332db6c3131b707
SHA512 bf7225410e041da4170e74945ee74a62af4793a13330059dd3ac729c4e8b71ec97eeaedd5c51fe0e2fb722f4c7a4207cf887e58bdaf58884c733559bbe8af8e6
TLSH
T16DA002516390C206D1185B7450DD2284F6324E15179B8A0140D22AA4CCA9B449969104
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 48c3a9fb2c8f3fd6a959e9cd870fa243e44f164247713257f34dedf9b9142ab2
MD5 c6a69df25d3c4de3ed2099744f1709bc
SHA1 f4c6da23301db6a5045bd6d6ffe29cc40566aa46
SHA512 5ae91a666ae9ec3228dbadd934daaf77d13e398d413c7a8064dead6a6d81f7ae06040ede2bf74937fdc34479b4307017d19d0b6ebda158694ee74854d8ef706b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

ExtensionActivityComp

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Default\ExtensionActivityComp
Size 4KB
SHA256 9827429749037198cb3d19a851ccff2adafad344fbade7220aa022d3c9e2fa85
MD5 9088df5de5b8306c52e744141a100532
SHA1 0aea85a36ef3ddc53df198227fcaf212139ae1db
SHA512 96c0c8ee90bd8aec34ea905f48e76ed7dc370d24f64efaeadf36e9b59b9ff01856ed837b5169241ef2bd4a6b8fe2ee77de443b09b9ee604e39f9ba57929859e8
TLSH
T15C819285F7C02420DA346EF3A4824BBD5E72CA82A5124B93097002D0FCA74ECCC796AA
MD5 SHA1 SHA512 TLSH

Submit Download

3d23a292-cef8-4169-8e4f-804d69fbf609.tmp

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Default\Network\3d23a292-cef8-4169-8e4f-804d69fbf609.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Default\Preferences
Size 6KB
SHA256 6e025a401ed34db03862ea38be73d8a3b47f8af7548264b8f61cb772a79d9702
MD5 917a3ceb54d3af021841832535032cce
SHA1 ccbf3f987f820ce4a09d667bbc37b475737ec96e
SHA512 407e9175603648941a2d1092d26aaef053e48a16ad26edc4adeb48f03afbb0b3998126c8189d95802ac6a092931666e5bcb4e3af5f90176057cbf1648df69b9e
SSDEEP 96:st+/dBVrQOb9Ukao5h16Z0Es7/x+6MhmuecJabS1ejeMK+gU028XM1C7K:stGpI1onEsV+Fda+QjIpG6K
TLSH
T174D194429F24797B8CCAF509BB29BA16E2F9603170D51E58E7F8452C05EA6DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

c951d4ef-a2ca-4de8-b0ee-ad25439bea76.tmp

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Default\c951d4ef-a2ca-4de8-b0ee-ad25439bea76.tmp
Size 6KB
SHA256 620961e3aac30c134bc1b183add399b38b823d8e5e51e24e556a0f8137c6f084
MD5 eb75b9806b5f3233009271b9dc3d9fb4
SHA1 f556d5e2da96ba61db0a9dd615b60b72981d3a04
SHA512 f3c8ee9143da29a0bb5d0aa83cb5b11258bface5b8cc6f80e8d7b16b6f2324eb9ce51c4e0885ee2b91c76e86edd72cdc3b2836d77865de53a2a09a2f6316e191
SSDEEP 96:st+/dBVrQOb9Ukao5h16Z0EsL+8/x+6MhmuecJ8FSj0jeMK+gUI28XM1C7K:stGpI1onEsL3+Fd884jIdG6K
TLSH
T1FFD195429F24797B8CCAE509BB69BB1BE2F9603170D01D58E7F8452C05EB6DC231780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\Local State
Size 1KB
SHA256 32803efff3e039b09790fd60bb6d606edd4beb96bab92830177cf861bbb4b836
MD5 31f8b6904e5cb73b06a1fb70c4567432
SHA1 971d737b2059d0c06642bf0e361cad12fdad09d4
SHA512 b3d4b35baa8e67f64b6349ae389f793dc784638745f8c878ee7791c894f2ea0e8a7c29b3b59289d7327ec2ae082e5932545047296de031e17c9f94c5b19d1b12
TLSH
T14F2165B7EA74AB31DDB96346B2A67A5B8D31223F91014E0895DF471C029318C9B6AC36
MD5 SHA1 SHA512 TLSH

Submit Download

a36ba76b-2834-4012-a027-771151132d16.tmp

Path C:\Users\Admin\AppData\Local\com.overlord.desktop\EBWebView\a36ba76b-2834-4012-a027-771151132d16.tmp
Size 2KB
SHA256 17421c0574c0a9089e10762ad4df603a4dce7c0d0283f45247bd492d20597e59
MD5 a2a42985b460da6344c01c67a99b8f46
SHA1 efa74886607492bb7e99591e8b628fbb63f7f1af
SHA512 7aa3779b395353434a496f463ba8054fe155dbe4a44ca2c5e979785b34bf25df3b476a880e6644fdbe3db9ba007587109640ca780496b325abfcb1b841680ad3
TLSH
T1DE51A7736924BB36C9B69704B69B3F13CE396166BA422F5099DD0B0C01C715C2741C3B
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2220-212-0x000001EC514F0000-0x000001EC51606000-memory.dmp

Download

memory/2220-112-0x00007FFD9EF80000-0x00007FFD9EF81000-memory.dmp

Download

memory/5844-191-0x000001E9C5C00000-0x000001E9C5D16000-memory.dmp

Download

memory/5844-236-0x000001E9C5C00000-0x000001E9C5D16000-memory.dmp

Download

memory/5844-97-0x00007FFD9EF80000-0x00007FFD9EF81000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads