Analysis
- user interaction
yes - max time kernel
1050s - max time network
1043s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
24/05/2026, 02:42
General
- Target CurseForge - Installer.exe
- Size 2.9MB
- Sample260524-c63mtaaz2v
- SHA256 fc7565f81f0613a00335c5714f82201a9504aaf64ab2fefd8a44b049fa9f112d
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 3 IoCs
- Downloads MZ/PE file 1 IoCs
- Drops desktop.ini file(s) 3 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Checks computer location settings 2 TTPs 13 IoCs
Looks up country code configured in the registry, likely geofence.
- Detected potential entity reuse from brand GOOGLE. 1 IoCs
- Drops file in System32 directory 64 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 32 IoCs
- Executes dropped EXE 49 IoCs
- Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Loads dropped DLL 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 17 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 27 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 9 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 44 IoCs
- Suspicious use of SendNotifyMessage 34 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\CurseForge - Installer.exe"C:\Users\Admin\AppData\Local\Temp\CurseForge - Installer.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\temp\nsh2C7A.tmp\OWinstaller.exe"C:\ProgramData\temp\nsh2C7A.tmp\OWinstaller.exe" Sel=1&Partner=4047&Extension=cchhcaiapeikjbdbpfplgmpobbcdkdaphclbmkbj&Name=CurseForge&Thanks=https%3A%2F%2Fgo.overwolf.com%2Fcurseforge-thank-you%2F&UtmTerm=eyJkb21haW4iOiJjZi13ZWIifQ%3D%3D&Referer=www.curseforge.com&Browser=chrome -partnerCustomizationLevel 0 -customPromoPages --app-name="CurseForge" -exepath C:\Users\Admin\AppData\Local\Temp\CurseForge - Installer.exe2⤵
- Adds Run key to start application
- Checks computer location settings
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\DxDiag.exe"C:\Windows\System32\DxDiag.exe" /xC:\Users\Admin\AppData\Local\Overwolf\Temp\DxDiagOutput.xml3⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.12 --user-data-dir="C:\ProgramData\temp\nsh2C7A.tmp\OWinstaller.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --high-dpi-support=1 --mojo-named-platform-channel-pipe=1236.4176.167326222930559065163⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\temp\nsh2C7A.tmp\OWinstaller.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\temp\nsh2C7A.tmp\OWinstaller.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff9cea7b078,0x7ff9cea7b084,0x7ff9cea7b0904⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\temp\nsh2C7A.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1824,i,15942197446809723957,4974684771517246047,262144 --variations-seed-version --mojo-platform-channel-handle=1816 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\temp\nsh2C7A.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1936,i,15942197446809723957,4974684771517246047,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:34⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\temp\nsh2C7A.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2376,i,15942197446809723957,4974684771517246047,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\temp\nsh2C7A.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3588,i,15942197446809723957,4974684771517246047,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\temp\nsh2C7A.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4036,i,15942197446809723957,4974684771517246047,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\temp\nsh2C7A.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4980,i,15942197446809723957,4974684771517246047,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\temp\nsh2C7A.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5268,i,15942197446809723957,4974684771517246047,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\temp\nsh2C7A.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5428,i,15942197446809723957,4974684771517246047,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\ProgramData\Overwolf\Setup\0.300.0.11\OverwolfSetup.exe"C:\ProgramData\Overwolf\Setup\0.300.0.11\OverwolfSetup.exe" /S "/TargetDir=C:\Program Files (x86)\Overwolf\" -ignoredotnet3⤵
- Downloads MZ/PE file
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe"C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe" /UpdateFWRules "C:\Program Files (x86)\Overwolf\\0.300.0.11\OverwolfBrowser.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe"C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe" /Register4⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\sc.exe"sc" sdshow OverwolfUpdater5⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\sc.exe"sc" sdset OverwolfUpdater D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;S-1-5-18)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\sc.exe"sc" sdshow OverwolfUpdater5⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\sc.exe"sc" sdset OverwolfUpdater D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;SY)(A;;RPWPCR;;;S-1-5-19)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\sc.exe"sc" sdshow OverwolfUpdater5⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\sc.exe"sc" sdset OverwolfUpdater D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;SY)(A;;RPWPCR;;;LS)(A;;RPWPCR;;;S-1-5-20)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\sc.exe"sc" sdshow OverwolfUpdater5⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\sc.exe"sc" sdset OverwolfUpdater D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;SY)(A;;RPWPCR;;;LS)(A;;RPWPCR;;;NS)(A;;RPWPCR;;;S-1-5-21-1108628292-2849104889-3743975892-1000)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\sc.exe"sc" sdshow OverwolfUpdater5⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\sc.exe"sc" sdset OverwolfUpdater D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;SY)(A;;RPWPCR;;;LS)(A;;RPWPCR;;;NS)(A;;RPWPCR;;;S-1-5-21-1108628292-2849104889-3743975892-1000)(A;;RPWPCR;;;S-1-1-0)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\Common Files\Overwolf\Teamspeak\OverwolfTSHelper.exe"C:\Program Files (x86)\Common Files\Overwolf\Teamspeak\OverwolfTSHelper.exe" /RegServer4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\ProgramData\Overwolf\Setup\checkRedist.exe"C:\ProgramData\Overwolf\Setup\checkRedist.exe"4⤵
- Executes dropped EXE
-
-
C:\ProgramData\Overwolf\Setup\vcredist.exe"C:\ProgramData\Overwolf\Setup\vcredist.exe" /q /norestart /repair4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{868079E3-0EA2-4AC9-9902-7C3304050DAB}\.cr\vcredist.exe"C:\Windows\Temp\{868079E3-0EA2-4AC9-9902-7C3304050DAB}\.cr\vcredist.exe" -burn.clean.room="C:\ProgramData\Overwolf\Setup\vcredist.exe" -burn.filehandle.attached=696 -burn.filehandle.self=660 /q /norestart /repair5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{345ACF42-EC76-453E-9A5A-5146CEFE83EC}\.be\VC_redist.x64.exe"C:\Windows\Temp\{345ACF42-EC76-453E-9A5A-5146CEFE83EC}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{F05D4BCE-2128-460A-B361-298555A32787} {C72C8476-01A9-4E06-9DCE-C8EAB0C67715} 18086⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1400 -burn.embedded BurnPipe.{A194CDBF-568B-4382-939C-255F956B8527} {C114A33C-3275-4BE1-8CB3-80CABFA5AE43} 76367⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1400 -burn.embedded BurnPipe.{A194CDBF-568B-4382-939C-255F956B8527} {C114A33C-3275-4BE1-8CB3-80CABFA5AE43} 76368⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{C7E0E442-5FA3-4AA2-912C-FD0051B526AB} {F4D2E7A0-2DA1-4D3F-BDC4-22D50500508C} 36969⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://go.overwolf.com/curseforge-thank-you/?muid=82b1ae86-0d56-462d-9db6-fa42f7c652a1&extensionId=cchhcaiapeikjbdbpfplgmpobbcdkdaphclbmkbj"3⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff9d036c728,0x7ff9d036c734,0x7ff9d036c7404⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1632,i,15601013913945734608,5103328958015220472,524288 --field-trial-handle=2136,i,9448030817874655409,8989992382430096547,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2264 /prefetch:34⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1752,i,10835556463486862565,10428709425366164527,262144 --field-trial-handle=2136,i,9448030817874655409,8989992382430096547,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2132 /prefetch:24⤵
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,13407197312665702647,7614900130911342152,524288 --field-trial-handle=2136,i,9448030817874655409,8989992382430096547,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2840 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3312,i,3180612771933082302,16242194702120248913,2097152 --field-trial-handle=2136,i,9448030817874655409,8989992382430096547,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3368 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3316,i,16782685652768424188,4049428925185670109,2097152 --field-trial-handle=2136,i,9448030817874655409,8989992382430096547,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3400 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4376,i,2602825732822304681,12213286547248577969,2097152 --field-trial-handle=2136,i,9448030817874655409,8989992382430096547,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4408 /prefetch:24⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,7274526853085710283,15228934198808158823,524288 --field-trial-handle=2136,i,9448030817874655409,8989992382430096547,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5532 /prefetch:84⤵
-
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Drops desktop.ini file(s)
- Detected potential entity reuse from brand GOOGLE.
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27100 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {9fe4edae-8555-44f1-8648-9e09fd3205ed} -parentPid 4920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4920" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27136 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {3bd8d70a-7f26-4f8d-ad35-1a0a22807654} -parentPid 4920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3700 -prefsLen 27277 -prefMapHandle 3704 -prefMapSize 270279 -jsInitHandle 3708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3716 -initialChannelId {e3a5337c-41a0-4da6-9f4f-fd2ddbf2bbaa} -parentPid 4920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3892 -prefsLen 27277 -prefMapHandle 3896 -prefMapSize 270279 -ipcHandle 3700 -initialChannelId {9e6b82e1-3f0f-4ee3-abd2-19230cb1abb1} -parentPid 4920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4920" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4372 -prefsLen 34776 -prefMapHandle 4376 -prefMapSize 270279 -jsInitHandle 4380 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4360 -initialChannelId {5dca85b2-9f51-4c97-9c06-04f169aa2f3c} -parentPid 4920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4908 -prefsLen 35013 -prefMapHandle 4928 -prefMapSize 270279 -ipcHandle 4920 -initialChannelId {324ed3ab-4a98-48e5-b4c4-af33859d0f9b} -parentPid 4920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5160 -prefsLen 32900 -prefMapHandle 5164 -prefMapSize 270279 -jsInitHandle 5168 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5176 -initialChannelId {b3c8b439-8f43-4442-8701-4bf4c9b82306} -parentPid 4920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5188 -prefsLen 32900 -prefMapHandle 5192 -prefMapSize 270279 -jsInitHandle 5196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5204 -initialChannelId {a4277883-8c14-4059-afd6-5ca7db6162d0} -parentPid 4920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2904 -prefsLen 32900 -prefMapHandle 5496 -prefMapSize 270279 -jsInitHandle 5504 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5508 -initialChannelId {b80634c5-b7fe-484c-933f-5f272df24c8b} -parentPid 4920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5912 -prefsLen 33031 -prefMapHandle 6120 -prefMapSize 270279 -jsInitHandle 6088 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6112 -initialChannelId {bf5015ce-e189-4762-8781-882cbaed7ce8} -parentPid 4920 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4920" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
-
-
-
C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe"C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe" /RunningFrom SCM1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe"C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe" /RunningFrom FromService /SelfLaunched2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe"C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe-cs2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Overwolf\Overwolf.exe"C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe" -launchapp ojgnfnbjckbpfaciphphehonokbggjhpnnoafack2⤵
- Checks computer location settings
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\DxDiag.exe"C:\Windows\System32\DxDiag.exe" /xC:\Users\Admin\AppData\Local\Overwolf\Temp\DxDiagOutput.xml3⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe"C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe" --type=crashpad-handler --no-rate-limit --max-db-size=10 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Overwolf\User Data\Crashpad" --url=http://localhost:54288/ --annotation=platform=win64 --annotation=product=Overwolf --annotation=version=0.300.0.11 --initial-client-data=0xe78,0xe7c,0xe80,0xe74,0xe84,0x7ff9c0da4148,0x7ff9c0da4154,0x7ff9c0da41603⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe"C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe" --type=gpu-process --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Overwolf\CefBrowserCache" --locales-dir-path="C:\Program Files (x86)\Overwolf\0.300.0.11\Locales" --log-severity=disable --libcef-path="C:\Program Files (x86)\Overwolf\0.300.0.11\libcef.DLL" --ignore-certificate-errors --remote-allow-origins=* --ow-domain=www.overwolf.com --ow-process-id=7800 --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4860,i,7155179890453015233,9844731512201889492,262144 --field-trial-handle=5844,i,7175809346513849988,16337338419220422295,262144 --enable-features=AudioVideoTracks,IdleDetection --disable-features=HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --variations-seed-version --trace-process-track-uuid=3190708988185955192 --enable-logging=handle --log-file=5848 --mojo-platform-channel-handle=5840 /prefetch:23⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe"C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Overwolf\CefBrowserCache" --locales-dir-path="C:\Program Files (x86)\Overwolf\0.300.0.11\Locales" --log-severity=disable --libcef-path="C:\Program Files (x86)\Overwolf\0.300.0.11\libcef.DLL" --ignore-certificate-errors --remote-allow-origins=* --ow-domain=www.overwolf.com --ow-process-id=7800 --metrics-shmem-handle=5088,i,13527390855402240713,18433156722685662832,524288 --field-trial-handle=5844,i,7175809346513849988,16337338419220422295,262144 --enable-features=AudioVideoTracks,IdleDetection --disable-features=HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --variations-seed-version --trace-process-track-uuid=3190708989122997041 --enable-logging=handle --log-file=6184 --mojo-platform-channel-handle=6180 /prefetch:33⤵
- Executes dropped EXE
- System Time Discovery
-
-
C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe"C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Overwolf\CefBrowserCache" --locales-dir-path="C:\Program Files (x86)\Overwolf\0.300.0.11\Locales" --log-severity=disable --libcef-path="C:\Program Files (x86)\Overwolf\0.300.0.11\libcef.DLL" --ignore-certificate-errors --remote-allow-origins=* --ow-domain=www.overwolf.com --ow-process-id=7800 --metrics-shmem-handle=5256,i,3062415596155444820,8434524805862147616,524288 --field-trial-handle=5844,i,7175809346513849988,16337338419220422295,262144 --enable-features=AudioVideoTracks,IdleDetection --disable-features=HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --variations-seed-version --trace-process-track-uuid=3190708990060038890 --enable-logging=handle --log-file=6236 --mojo-platform-channel-handle=6232 /prefetch:83⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe"C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe" --type=ow-helper --command=Extract7Z --ow-process-id=7800 --file=C:\Users\Admin\AppData\Local\Overwolf\Temp\ggfmakpbllghoepnmfelddbminamnbmfelbahfdp_diff\305.1.2-to-305.1.3.diff.7z --output-folder=C:\Users\Admin\AppData\Local\Overwolf\Temp\ggfmakpbllghoepnmfelddbminamnbmfelbahfdp_diff3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe"C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Overwolf\CefBrowserCache" --locales-dir-path="C:\Program Files (x86)\Overwolf\0.300.0.11\Locales" --log-severity=disable --libcef-path="C:\Program Files (x86)\Overwolf\0.300.0.11\libcef.DLL" --uncaught-exception-stack-size=20 --owapp="CurseForge - background" --ow-enable-features=osr-software-rendering,use-override-ad-domain-as-referrer,cef-native-ua,use-www-domain,backup-cef-cache,extension-validation,read-opk-from-memory --uid=cchhcaiapeikjbdbpfplgmpobbcdkdaphclbmkbj --ow-allow-internal --ow-permissions=534768 --ignore-certificate-errors --remote-allow-origins=* --ow-domain=www.overwolf.com --enable-owc --uid=cchhcaiapeikjbdbpfplgmpobbcdkdaphclbmkbj --ow-process-id=7800 --no-sandbox --js-flags=--expose-gc --enable-blink-features=AudioVideoTracks --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=7540,i,7928657892033894485,10133996188317190701,2097152 --field-trial-handle=5844,i,7175809346513849988,16337338419220422295,262144 --enable-features=AudioVideoTracks,IdleDetection --disable-features=HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --variations-seed-version --trace-process-track-uuid=3190708990997080739 --enable-logging=handle --log-file=7568 --mojo-platform-channel-handle=7564 /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe"C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Overwolf\CefBrowserCache" --locales-dir-path="C:\Program Files (x86)\Overwolf\0.300.0.11\Locales" --log-severity=disable --libcef-path="C:\Program Files (x86)\Overwolf\0.300.0.11\libcef.DLL" --uncaught-exception-stack-size=20 --owapp="Overwolf Remote Configurations - index" --ow-enable-features=osr-software-rendering,use-override-ad-domain-as-referrer,cef-native-ua,use-www-domain,backup-cef-cache,extension-validation,read-opk-from-memory --uid=ppagiehdogdjlomggmoejfamedbjggdggnjbilhe --ow-allow-internal --ow-permissions=64 --ignore-certificate-errors --remote-allow-origins=* --ow-domain=www.overwolf.com --enable-owc --uid=ppagiehdogdjlomggmoejfamedbjggdggnjbilhe --ow-process-id=7800 --no-sandbox --js-flags=--expose-gc --disable-gpu-compositing --enable-blink-features=AudioVideoTracks --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=7620,i,10632049028558140141,15544753251606533857,2097152 --field-trial-handle=5844,i,7175809346513849988,16337338419220422295,262144 --enable-features=AudioVideoTracks,IdleDetection --disable-features=HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --variations-seed-version --trace-process-track-uuid=3190708991934122588 --enable-logging=handle --log-file=7676 --mojo-platform-channel-handle=7672 /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe"C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Overwolf\CefBrowserCache" --locales-dir-path="C:\Program Files (x86)\Overwolf\0.300.0.11\Locales" --log-severity=disable --libcef-path="C:\Program Files (x86)\Overwolf\0.300.0.11\libcef.DLL" --uncaught-exception-stack-size=20 --owapp="Overwolf General GameEvents Provider - index.html" --ow-enable-features=osr-software-rendering,use-override-ad-domain-as-referrer,cef-native-ua,use-www-domain,backup-cef-cache,extension-validation,read-opk-from-memory --owtk=2456.18446744072702792997 --uid=ggfmakpbllghoepnmfelddbminamnbmfelbahfdp --ow-allow-internal --ow-permissions=272528 --ignore-certificate-errors --remote-allow-origins=* --ow-domain=www.overwolf.com --enable-owc --uid=ggfmakpbllghoepnmfelddbminamnbmfelbahfdp --ow-process-id=7800 --no-sandbox --js-flags=--expose-gc --disable-gpu-compositing --enable-blink-features=AudioVideoTracks --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=7860,i,424583211436670882,1724545289839092011,2097152 --field-trial-handle=5844,i,7175809346513849988,16337338419220422295,262144 --enable-features=AudioVideoTracks,IdleDetection --disable-features=HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --variations-seed-version --trace-process-track-uuid=3190708992871164437 --enable-logging=handle --log-file=7912 --mojo-platform-channel-handle=7936 /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Common Files\Overwolf\0.300.0.11\OverwolfHelper.exe"C:\Program Files (x86)\Common Files\Overwolf\0.300.0.11\OverwolfHelper.exe" "path=C:\Program Files (x86)\Overwolf\0.300.0.11\win32\OWExplorerLauncher.dll pid=7800 gamelist=C:\Users\Admin\AppData\Local\Overwolf\Temp\gamelist.json"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Common Files\Overwolf\0.300.0.11\OverwolfHelper64.exe"C:\Program Files (x86)\Common Files\Overwolf\0.300.0.11\OverwolfHelper64.exe" "path=C:\Program Files (x86)\Overwolf\0.300.0.11\OWExplorerLauncher.dll pid=7800 gamelist=C:\Users\Admin\AppData\Local\Overwolf\Temp\gamelist.json"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe"C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Overwolf\CefBrowserCache" --locales-dir-path="C:\Program Files (x86)\Overwolf\0.300.0.11\Locales" --log-severity=disable --libcef-path="C:\Program Files (x86)\Overwolf\0.300.0.11\libcef.DLL" --ignore-certificate-errors --remote-allow-origins=* --ow-domain=www.overwolf.com --ow-process-id=7800 --metrics-shmem-handle=8932,i,15892385174823558752,4877896866526166101,524288 --field-trial-handle=5844,i,7175809346513849988,16337338419220422295,262144 --enable-features=AudioVideoTracks,IdleDetection --disable-features=HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --variations-seed-version --trace-process-track-uuid=3190708993808206286 --enable-logging=handle --log-file=8964 --mojo-platform-channel-handle=8968 /prefetch:83⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe"C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Overwolf\CefBrowserCache" --locales-dir-path="C:\Program Files (x86)\Overwolf\0.300.0.11\Locales" --log-severity=disable --libcef-path="C:\Program Files (x86)\Overwolf\0.300.0.11\libcef.DLL" --uncaught-exception-stack-size=20 --owapp="Overwolf notifications - background" --ow-enable-features=osr-software-rendering,use-override-ad-domain-as-referrer,cef-native-ua,use-www-domain,backup-cef-cache,extension-validation,read-opk-from-memory --uid=oldfhfbggeglgjgenidckaneodejpjkaggklojma --ow-allow-internal --ow-permissions=10448 --ignore-certificate-errors --remote-allow-origins=* --ow-domain=www.overwolf.com --enable-owc --uid=oldfhfbggeglgjgenidckaneodejpjkaggklojma --ow-process-id=7800 --no-sandbox --js-flags=--expose-gc --disable-gpu-compositing --enable-blink-features=AudioVideoTracks --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=7608,i,10302234739714557436,9689819087579969240,2097152 --field-trial-handle=5844,i,7175809346513849988,16337338419220422295,262144 --enable-features=AudioVideoTracks,IdleDetection --disable-features=HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --variations-seed-version --trace-process-track-uuid=3190708995682289984 --enable-logging=handle --log-file=9916 --mojo-platform-channel-handle=9920 /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe"C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Overwolf\CefBrowserCache" --locales-dir-path="C:\Program Files (x86)\Overwolf\0.300.0.11\Locales" --log-severity=disable --libcef-path="C:\Program Files (x86)\Overwolf\0.300.0.11\libcef.DLL" --uncaught-exception-stack-size=20 --owapp="Overwolf promotions - background" --ow-enable-features=osr-software-rendering,use-override-ad-domain-as-referrer,cef-native-ua,use-www-domain,backup-cef-cache,extension-validation,read-opk-from-memory --uid=bgahplehcohebablohmbilgjdnihhgfmfepkpgcj --ow-allow-internal --ow-permissions=10448 --ignore-certificate-errors --remote-allow-origins=* --ow-domain=www.overwolf.com --enable-owc --uid=bgahplehcohebablohmbilgjdnihhgfmfepkpgcj --ow-process-id=7800 --no-sandbox --js-flags=--expose-gc --disable-gpu-compositing --enable-blink-features=AudioVideoTracks --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=7888,i,16778341623919534706,2538310854016205102,2097152 --field-trial-handle=5844,i,7175809346513849988,16337338419220422295,262144 --enable-features=AudioVideoTracks,IdleDetection --disable-features=HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --variations-seed-version --trace-process-track-uuid=3190708996619331833 --enable-logging=handle --log-file=10128 --mojo-platform-channel-handle=10120 /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Overwolf\Extensions\ncfplpkmiejjaklknfnkgcpapnhkggmlcppckhcb\270.0.25\obs\bin\64bit\ow-obs.exe"C:\Users\Admin\AppData\Local\Overwolf\Extensions\ncfplpkmiejjaklknfnkgcpapnhkggmlcppckhcb\270.0.25\obs\bin\64bit\ow-obs.exe" --channel=7800.1.228063⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Overwolf\Extensions\ncfplpkmiejjaklknfnkgcpapnhkggmlcppckhcb\270.0.25\obs\bin\64bit\obs-qsv-test.exe"C:/Users/Admin/AppData/Local/Overwolf/Extensions/ncfplpkmiejjaklknfnkgcpapnhkggmlcppckhcb/270.0.25/obs/bin/64bit/obs-qsv-test.exe" 4f23 4fc84⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Overwolf\Extensions\ncfplpkmiejjaklknfnkgcpapnhkggmlcppckhcb\270.0.25\obs\data\obs-plugins\win-capture\get-graphics-offsets64.exe"../../data/obs-plugins/win-capture/get-graphics-offsets64.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Overwolf\Extensions\ncfplpkmiejjaklknfnkgcpapnhkggmlcppckhcb\270.0.25\obs\data\obs-plugins\win-capture\get-graphics-offsets32.exe"../../data/obs-plugins/win-capture/get-graphics-offsets32.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe"C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Overwolf\CefBrowserCache" --locales-dir-path="C:\Program Files (x86)\Overwolf\0.300.0.11\Locales" --log-severity=disable --libcef-path="C:\Program Files (x86)\Overwolf\0.300.0.11\libcef.DLL" --uncaught-exception-stack-size=20 --owapp="Overwolf Remote Configurations - index" --ow-enable-features=osr-software-rendering,use-override-ad-domain-as-referrer,cef-native-ua,use-www-domain,backup-cef-cache,extension-validation,read-opk-from-memory --uid=ppagiehdogdjlomggmoejfamedbjggdggnjbilhe --ow-allow-internal --ow-permissions=64 --ignore-certificate-errors --remote-allow-origins=* --ow-domain=www.overwolf.com --enable-owc --uid=ppagiehdogdjlomggmoejfamedbjggdggnjbilhe --ow-process-id=7800 --no-sandbox --js-flags=--expose-gc --disable-gpu-compositing --enable-blink-features=AudioVideoTracks --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=10404,i,16412206756574494546,2328009354941231352,2097152 --field-trial-handle=5844,i,7175809346513849988,16337338419220422295,262144 --enable-features=AudioVideoTracks,IdleDetection --disable-features=HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --variations-seed-version --trace-process-track-uuid=3190708997556373682 --enable-logging=handle --log-file=10504 --mojo-platform-channel-handle=10500 /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe"C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Overwolf\CefBrowserCache" --locales-dir-path="C:\Program Files (x86)\Overwolf\0.300.0.11\Locales" --log-severity=disable --libcef-path="C:\Program Files (x86)\Overwolf\0.300.0.11\libcef.DLL" --ignore-certificate-errors --remote-allow-origins=* --ow-domain=www.overwolf.com --ow-process-id=7800 --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=9064,i,5696695421386635273,6076315632726785146,262144 --field-trial-handle=5844,i,7175809346513849988,16337338419220422295,262144 --enable-features=AudioVideoTracks,IdleDetection --disable-features=HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --variations-seed-version --trace-process-track-uuid=3190708998493415531 --enable-logging=handle --log-file=8932 --mojo-platform-channel-handle=9088 /prefetch:83⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Overwolf\0.300.0.11\owver64.exe"C:\Program Files (x86)\Overwolf\0.300.0.11\owver64.exe" -apply "C:\Users\Admin\AppData\Local\Overwolf\Temp\ggfmakpbllghoepnmfelddbminamnbmfelbahfdp_diff\app_uncompress.pkg" "C:\Users\Admin\AppData\Local\Overwolf\Temp\ggfmakpbllghoepnmfelddbminamnbmfelbahfdp_diff\305.1.2-to-305.1.3.diff" "C:\Users\Admin\AppData\Local\Overwolf\Temp\ggfmakpbllghoepnmfelddbminamnbmfelbahfdp_diff\uncompressed_newapp.pkg"3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe"C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Overwolf\CefBrowserCache" --locales-dir-path="C:\Program Files (x86)\Overwolf\0.300.0.11\Locales" --log-severity=disable --libcef-path="C:\Program Files (x86)\Overwolf\0.300.0.11\libcef.DLL" --ignore-certificate-errors --remote-allow-origins=* --ow-domain=www.overwolf.com --ow-process-id=7800 --metrics-shmem-handle=9940,i,12958986901975268467,3830193118672997225,524288 --field-trial-handle=5844,i,7175809346513849988,16337338419220422295,262144 --enable-features=AudioVideoTracks,IdleDetection --disable-features=HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --variations-seed-version --trace-process-track-uuid=3190708999430457380 --enable-logging=handle --log-file=10696 --mojo-platform-channel-handle=2904 /prefetch:83⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe"C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Overwolf\CefBrowserCache" --locales-dir-path="C:\Program Files (x86)\Overwolf\0.300.0.11\Locales" --log-severity=disable --libcef-path="C:\Program Files (x86)\Overwolf\0.300.0.11\libcef.DLL" --uncaught-exception-stack-size=20 --owapp="Overwolf General GameEvents Provider - index.html" --ow-enable-features=osr-software-rendering,use-override-ad-domain-as-referrer,cef-native-ua,use-www-domain,backup-cef-cache,extension-validation,read-opk-from-memory --owtk=2456.18446744072596245582 --uid=ggfmakpbllghoepnmfelddbminamnbmfelbahfdp --ow-allow-internal --ow-permissions=272528 --ignore-certificate-errors --remote-allow-origins=* --ow-domain=www.overwolf.com --enable-owc --uid=ggfmakpbllghoepnmfelddbminamnbmfelbahfdp --ow-process-id=7800 --no-sandbox --js-flags=--expose-gc --disable-gpu-compositing --enable-blink-features=AudioVideoTracks --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=10612,i,14913764193757232136,968435560626880031,2097152 --field-trial-handle=5844,i,7175809346513849988,16337338419220422295,262144 --enable-features=AudioVideoTracks,IdleDetection --disable-features=HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --variations-seed-version --trace-process-track-uuid=3190709000367499229 --enable-logging=handle --log-file=3120 --mojo-platform-channel-handle=10628 /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe"C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Overwolf\CefBrowserCache" --locales-dir-path="C:\Program Files (x86)\Overwolf\0.300.0.11\Locales" --log-severity=disable --libcef-path="C:\Program Files (x86)\Overwolf\0.300.0.11\libcef.DLL" --ignore-certificate-errors --remote-allow-origins=* --ow-domain=www.overwolf.com --ow-process-id=7800 --metrics-shmem-handle=8136,i,17169693539472582608,12595897059864456532,524288 --field-trial-handle=5844,i,7175809346513849988,16337338419220422295,262144 --enable-features=AudioVideoTracks,IdleDetection --disable-features=HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --variations-seed-version --trace-process-track-uuid=3190709001304541078 --enable-logging=handle --log-file=8308 --mojo-platform-channel-handle=3632 /prefetch:83⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe"C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Overwolf\CefBrowserCache" --locales-dir-path="C:\Program Files (x86)\Overwolf\0.300.0.11\Locales" --log-severity=disable --libcef-path="C:\Program Files (x86)\Overwolf\0.300.0.11\libcef.DLL" --ignore-certificate-errors --remote-allow-origins=* --ow-domain=www.overwolf.com --ow-process-id=7800 --metrics-shmem-handle=4880,i,14524867470290232483,9328217396097248835,524288 --field-trial-handle=5844,i,7175809346513849988,16337338419220422295,262144 --enable-features=AudioVideoTracks,IdleDetection --disable-features=HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --variations-seed-version --trace-process-track-uuid=3190709002241582927 --enable-logging=handle --log-file=8028 --mojo-platform-channel-handle=6336 /prefetch:83⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe"C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Overwolf\CefBrowserCache" --locales-dir-path="C:\Program Files (x86)\Overwolf\0.300.0.11\Locales" --log-severity=disable --libcef-path="C:\Program Files (x86)\Overwolf\0.300.0.11\libcef.DLL" --ignore-certificate-errors --remote-allow-origins=* --ow-domain=www.overwolf.com --ow-process-id=7800 --metrics-shmem-handle=6956,i,9330866396619259014,3318623954750339606,524288 --field-trial-handle=5844,i,7175809346513849988,16337338419220422295,262144 --enable-features=AudioVideoTracks,IdleDetection --disable-features=HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --variations-seed-version --trace-process-track-uuid=3190709003178624776 --enable-logging=handle --log-file=944 --mojo-platform-channel-handle=4300 /prefetch:83⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe"C:\Program Files (x86)\Overwolf\0.300.0.11\OverwolfBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Overwolf\CefBrowserCache" --locales-dir-path="C:\Program Files (x86)\Overwolf\0.300.0.11\Locales" --log-severity=disable --libcef-path="C:\Program Files (x86)\Overwolf\0.300.0.11\libcef.DLL" --ignore-certificate-errors --remote-allow-origins=* --ow-domain=www.overwolf.com --ow-process-id=7800 --metrics-shmem-handle=944,i,12533549476177609527,7767157408230239539,524288 --field-trial-handle=5844,i,7175809346513849988,16337338419220422295,262144 --enable-features=AudioVideoTracks,IdleDetection --disable-features=HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --variations-seed-version --trace-process-track-uuid=3190709004115666625 --enable-logging=handle --log-file=10460 --mojo-platform-channel-handle=10644 /prefetch:83⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260524034420.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260524034420.log"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{843A5784-FABA-4CCE-8D77-557EAC34A28A} {04A40BB0-091D-47E1-997F-F972F9E98306} 59164⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
C:\Program Files (x86)\Common Files\Overwolf\Teamspeak\OverwolfTSHelper.exe"C:\Program Files (x86)\Common Files\Overwolf\Teamspeak\OverwolfTSHelper.exe" -Embedding1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe"C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe" /RunningFrom SCM1⤵
- Drops file in System32 directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe"C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe" /RunningFrom FromService /SelfLaunched /OriginRunningFrom Overwolf2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe"C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe" /RunningFrom SCM1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe"C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe" /RunningFrom FromService /SelfLaunched /OriginRunningFrom Overwolf2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
e5a476f.rbs
e5a477b.rbs
e5a4782.rbs
e5a4791.rbs
OverwolfUpdater.InstallLog
SetupInfo.ini
SetupInfo.ini
1ab7aa1b854459a7.v2
4545d6ee7b176b7d.v2
62281a72182c4ba6.v2
6a755cdc9e6092ae.v2
7a6e3fecabdd460d.v2
7f0084f9c4106e16.v2
8d390f4ad08d5c53.v2
9ea4a251d7aa3c18.v2
cd9cfd09db70c3cd.v2
CommandLine.dll
Microsoft.Web.WebView2.Core.dll
Microsoft.Web.WebView2.WinForms.dll
Newtonsoft.Json.dll
OWInstaller.exe
settings.dat
settings.dat
throttle_store.dat
83c72cbd-c517-4e34-82b0-409cb0c2259c.tmp
the-real-index
the-real-index~RFe58bd50.TMP
CURRENT
MANIFEST-000001
Network Persistent State
Network Persistent State~RFe595431.TMP
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
TransportSecurity~RFe589640.TMP
Preferences
Preferences
data_0
data_1
data_2
data_3
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State~RFe583989.TMP
OWinstaller.exe.config
OverWolf.Client.CommonUtils.dll
SharpRaven.dll
WebView2Loader.dll
messages.json
LatoLatin-Regular.woff
Montserrat-Bold.woff
icon.ico
index.html
app.js
block_inputs.js
cmp.bundle.js
notifications.js
analytics.js
commands.js
cookies.js
modal-events-delegate.js
strings-loader.js
utils.js
cri-controller.js
template.js
cris-controller.js
template.js
finish-with-recommended-app-controller.js
template.js
finish-controller.js
template.js
main-controller.js
template.js
modal-controller.js
privacy-controller.js
template.js
progress-1-controller.js
template.js
settings-controller.js
template.js
template.js
welcome-controller.js
manifest.json
log4net.dll
utils.dll
websocket-sharp.dll
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
the-real-index
Network Persistent State
TransportSecurity
Preferences
Secure Preferences
the-real-index
the-real-index~RFe5a3c5e.TMP
Local State
Local State
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
activity-stream.contile.json
activity-stream.discovery_stream.json
10787
12050
13242
13549
14680
18360
19490
25198
28140
28793
32445
4666
6388
6D89348819C8881868053197CA0754F36784BF5F
C5643FFFEA92A5665EA3F3F42C97FA8CC3904334
F58F0605C722D0D848D03D88AC8E3E50223F57B0
nb_model_build_attachment_arts_and_entertainment.json
nb_model_build_attachment_autos_and_vehicles.json
nb_model_build_attachment_beauty_and_fitness.json
nb_model_build_attachment_blogging_resources_and_services.json
nb_model_build_attachment_books_and_literature.json
nb_model_build_attachment_business_and_industrial.json
nb_model_build_attachment_computers_and_electronics.json
nb_model_build_attachment_finance.json
nb_model_build_attachment_food_and_drink.json
nb_model_build_attachment_games.json
nb_model_build_attachment_health.json
nb_model_build_attachment_hobbies_and_leisure.json
nb_model_build_attachment_home_and_garden.json
nb_model_build_attachment_internet_and_telecom.json
nb_model_build_attachment_jobs_and_education.json
nb_model_build_attachment_law_and_government.json
nb_model_build_attachment_online_communities.json
nb_model_build_attachment_people_and_society.json
nb_model_build_attachment_pets_and_animals.json
nb_model_build_attachment_real_estate.json
nb_model_build_attachment_reference.json
nb_model_build_attachment_science.json
nb_model_build_attachment_shopping.json
nb_model_build_attachment_sports.json
nb_model_build_attachment_travel.json
recipe_attachment.json
f_000005
index
index
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Preferences
Preferences
Preferences
Preferences~RFe5b2b91.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State~RFe5b0358.TMP
metadata.json
metadata.json
metadata.json
metadata.json
verified_contents.json
manifest.json
verified_contents.json
background.html
background.js
background.js.LICENSE.txt
coms.html
promotion.html
promotion.js
tester.html
tester.js
manifest.json
verified_contents.json
manifest.json
simple-io-plugin64.dll
verified_contents.json
manifest.json
verified_contents.json
codmw2-menu.bmp
game_e.bmp
game_n.bmp
game_ne.bmp
game_s.bmp
game_se.bmp
game_sw.bmp
game_w.bmp
ingame-mw2.bmp
victory.bmp
victory_ar.bmp
victory_du.bmp
victory_fr.bmp
victory_it.bmp
victory_po.bmp
victory_pr.bmp
victory_ru.bmp
victory_sp.bmp
champion_hill.bmp
death-bright-vg.bmp
death-vg.bmp
dt_arms_race.bmp
ingame-vg.bmp
kill-high-vg.bmp
kill-vg.bmp
lobby-coin-vg.bmp
mode-control.bmp
mode-domination.bmp
mode-freeforall.bmp
mode-hardpoint.bmp
mode-kill-confirmed.bmp
mode-patrol.bmp
mode-search-destroy.bmp
mode-team-deathmatch.bmp
codmw3-menu.bmp
mw3.bmp
victory.bmp
victory_ar.bmp
victory_du.bmp
victory_fr.bmp
victory_it.bmp
victory_po.bmp
victory_ru.bmp
victory_sp.bmp
manifest.json
gep_hearthstone.dll
libowgameevents.dll
gep_2xko.dll
gep_apex.dll
gep_arknights.dll
gep_bedrock.dll
gep_bg3.dll
gep_cs2ext.dll
gep_darkndarker.dll
gep_deadlock.dll
gep_diablo.dll
gep_diablo4.dll
gep_dota.dll
gep_finalxiv.dll
gep_fortnite.dll
gep_genshinimpact.dll
gep_leaguex64.dll
gep_lolarena.dll
gep_lostark.dll
gep_marvelrivals.dll
gep_minecraft.dll
gep_mtga.dll
gep_newworld.dll
gep_overwatch2.dll
gep_palworld.dll
gep_pathofexile.dll
gep_poe2.dll
gep_pubg.dll
gep_rainbowsixsiege.dll
gep_rematch.dll
gep_rl.dll
gep_schedule.dll
gep_sotf.dll
gep_supervive.dll
gep_tarkov.dll
gep_tftx64.dll
gep_valorant.dll
gep_warframeext.dll
gep_wow.dll
gep_xfortnite.dll
libowgameevents64.dll
GEPPlugin.dll
GEPPlugin64.dll
OwDota2GameEvents.dll
experimental-plugin.dll
simple-io-plugin.dll
vgep.dll
FeaturesHandler.js
gsi_utils.js
HashesListener.js
InfoDBContainer.js
ac_monitor.js
analytics.js
base_utils.js
batch_tracking.js
game_events_monitor.js
game_monitoring_util.js
game_native_monitoring_util.js
gep_internal_info_tracker.js
goop_installer.js
io_plugin.js
monitoring_statics.js
overwolfPlugin.js
ow-api.js
path_utils.js
game_plugin.js
game_plugin_base.js
game_plugin_gep.js
game_plugin_goop.js
plugin_constants.js
plugin_type.js
registry_utils.js
simple_event.js
version_compare.js
wait_for_stable_fps.js
verified_contents.json
manifest.json
avcodec-61.dll
avdevice-61.dll
avfilter-10.dll
avformat-61.dll
avutil-59.dll
concrt140.dll
ffmpeg.exe
ffprobe.exe
libcurl.dll
libobs-d3d11.dll
libobs-opengl.dll
libobs-winrt.dll
librist.dll
libx264-164.dll
msvcp140.dll
msvcp140_1.dll
msvcp140_2.dll
obs-amf-test.exe
obs-nvenc-test.exe
obs-qsv-test.exe
obs-scripting.dll
obs.dll
ow-obs.exe
owobs-ffmpeg-mux.exe
postproc-58.dll
srt.dll
swresample-5.dll
swscale-8.dll
vcruntime140.dll
vcruntime140_1.dll
w32-pthreads.dll
zlib.dll
area.effect
bicubic_scale.effect
bilinear_lowres_scale.effect
color.effect
default.effect
default_rect.effect
deinterlace_base.effect
deinterlace_blend.effect
deinterlace_blend_2x.effect
deinterlace_discard.effect
deinterlace_discard_2x.effect
deinterlace_linear.effect
deinterlace_linear_2x.effect
deinterlace_yadif.effect
deinterlace_yadif_2x.effect
format_conversion.effect
lanczos_scale.effect
opaque.effect
premultiplied_alpha.effect
repeat.effect
solid.effect
grayscale.cube
original.cube
blend_add_filter.effect
blend_mul_filter.effect
blend_sub_filter.effect
chroma_key_filter.effect
chroma_key_filter_v2.effect
color.effect
color_correction_filter.effect
color_grade_filter.effect
color_key_filter.effect
color_key_filter_v2.effect
crop_filter.effect
hdr_tonemap_filter.effect
luma_key_filter.effect
luma_key_filter_v2.effect
mask_alpha_filter.effect
mask_color_filter.effect
rtx_greenscreen.effect
sharpness.effect
fade_to_color_transition.effect
fade_transition.effect
luma_wipe_transition.effect
slide_transition.effect
stinger_matte_transition.effect
swipe_transition.effect
get-graphics-offsets32.exe
get-graphics-offsets64.exe
inject-helper32.exe
inject-helper64.exe
ow-graphics-hook32.dll
ow-graphics-hook64.dll
coreaudio-encoder.dll
image-source.dll
obs-ffmpeg.dll
obs-filters.dll
obs-nvenc.dll
obs-outputs.dll
obs-qsv11.dll
obs-transitions.dll
obs-x264.dll
rtmp-services.dll
win-capture.dll
win-dshow.dll
win-wasapi.dll
sprite.svg
verified_contents.json
ftue.webm
no_results.svg
check.svg
single-star.svg
slim-star.svg
stars.svg
subscription-bubble.svg
manifest.json
sprite.svg
wolfeye.svg
colors.scss
style.scss
error-view.scss
in-app-subs-main-window.scss
login-signup-form.scss
mini-profile-view.scss
subscription-window.scss
verification-window.scss
verified_contents.json
background.html
background.js
notification.html
notification.js
tester.html
tester.js
manifest.json
downloader.dll
simple-io-plugin.dll
IconMouseNormal.png
verified_contents.json
butils.dll
features.json
Lato-Bold.woff2
Lato-Regular.woff2
sprite.svg
notification.scss
notification.ts
general.json
manifest.json
simple-io-plugin.dll
verified_contents.json
butils.dll
20260524034658-1E44.json
background.html.log
index.html.log
index.html.log
InstallerTrace_2026-05-24_03-42_1236.log
InstallerTrace_2026-05-24_03-42_1236.log
OWLog.cfg
Trace_2026-05-24_03-44_7800.log
app.opk
icon.ico
app.opk
icon.ico
SettingsPageBasic.xml
SettingsPageBasic.xml
SettingsPageCache.xml
SettingsPageGeneral.xml
SettingsPageGeneral.xml
SettingsPageGeneral.xml
SettingsPageGeneral.xml
SettingsPageGeneral.xml
SettingsPageGeneral.xml
SettingsPageGeneral.xml
SettingsPageGeneral.xml
SettingsPageGeneral.xml
SettingsPageGeneral.xml
SettingsPageGeneral.xml
SettingsPageGeneral.xml
000002.dbtmp
DotNetZip-dt005ayh.tmp
KlavikaWebBasicLight.woff
KlavikaWebBasicMedium.woff
KlavikaWebBasicRegular.woff
sprite.svg
fonts.css
global.css
notification.css
cs-go-scout.png
dota-plus.png
hearth-arena-companion.png
hero-watch.png
lolwiz.png
cs-go.png
dota-2.png
hearthstone.png
league-of-legends.png
overwatch.png
index.html
block_inputs.js
jquery-1.10.2.min.js
main.js
window-control.js
verified_contents.json
manifest.json
no-apps-icon.svg
SoundCheck_Drop.mp3
SoundCheck_PewPew.mp3
montserrat-500.woff2
montserrat-600.woff2
montserrat-700.woff2
montserrat-900.woff2
montserrat-regular.woff2
default_flag.png
search.svg
dev.svg
overwolf-text.svg
avatar-placeholder.svg
error.webp
chinese.svg
english.svg
french.svg
german.svg
italian.svg
japanese.svg
korean.svg
polish.svg
portuguese.svg
russian.svg
spanish.svg
turkish.svg
vietnamese.svg
more-info.svg
no-apps-icon.webp
no-capture-apps.svg
no-capture-apps.webp
no-games.svg
no-games.webp
no-results.svg
no-results.webp
no-subs.webp
owlogo.svg
permission.svg
screen-light-leg.svg
screen.svg
sprite.svg
subscription-bubblicon.svg
triangle-arrow.svg
IconMouseOver.png
supported_features.js
ingame-mw3.bmp
victory_pt.bmp
icon.png
DotNetZip-0jd0lcv1.tmp
DotNetZip-aor5ehdf.tmp
DotNetZip-feglf24c.tmp
DotNetZip-gjdqkbke.tmp
DotNetZip-npocliow.tmp
DotNetZip-rwyi35h4.tmp
DotNetZip-tf0by3xb.tmp
DotNetZip-xfa4hhvl.tmp
DotNetZip-0jwbojot.tmp
DotNetZip-2sfxjgvp.tmp
DotNetZip-at121ghe.tmp
DotNetZip-n0h5rfkr.tmp
DotNetZip-rep2bwu0.tmp
DotNetZip-wfmxatw3.tmp
DotNetZip-zzr0pecr.tmp
DotNetZip-ckaooxrp.tmp
DotNetZip-3uslrys2.tmp
DotNetZip-bxhnibr3.tmp
DotNetZip-xdznt3kw.tmp
DotNetZip-li2p1wzg.tmp
notification.js.LICENSE.txt
verified_contents.json
manifest.json
gep_pubg.dll
IconMouseOver.png
store-bg-blurred.jpg
giveaways.html
LatoLatin-Bold.woff2
LatoLatin-Regular.woff2
heart-sprite.png
eye-animation.webm
shield_animation.webm
gate_open.webm
gate_open_loop.webm
4dbfaf3403a8ff7c.webp
ce0e6579e2683a05.webp
game-dashboard.css
manifest.json
launchericon.ico
manifest.json
tokens.css
support_taskbar_icon.png
DotNetZip-byff3the.tmp
DotNetZip-fqx5coem.tmp
DotNetZip-kh5yeznq.tmp
DotNetZip-vbhk3ru2.tmp
DotNetZip-asy54qou.tmp
DotNetZip-i4hvqsez.tmp
DotNetZip-laghgze2.tmp
DotNetZip-nixssjri.tmp
DotNetZip-r0vnopc5.tmp
DotNetZip-zlzm1dlg.tmp
DotNetZip-4sbykejl.tmp
DotNetZip-tdhx4idm.tmp
DotNetZip-4gh4y5tu.tmp
DotNetZip-a1ko533x.tmp
DotNetZip-b1lidh3o.tmp
DotNetZip-b53wocst.tmp
DotNetZip-fk4hc2rn.tmp
DotNetZip-gpx2a0rp.tmp
DotNetZip-gubc1nut.tmp
DotNetZip-jlw3205n.tmp
DotNetZip-oz3fgpsc.tmp
DotNetZip-r5vloeh0.tmp
DotNetZip-sv302xme.tmp
DotNetZip-vg3pgfm1.tmp
DotNetZip-vknyiagw.tmp
DotNetZip-vvdfxsz0.tmp
DotNetZip-dbuat1xu.tmp
DotNetZip-nkyjeeo4.tmp
DotNetZip-pjle2qht.tmp
DotNetZip-e5xr3vxx.tmp
DotNetZip-f5tt34g5.tmp
DotNetZip-mz134qam.tmp
DotNetZip-phdg52hw.tmp
DotNetZip-ej1qe0ny.tmp
DotNetZip-et25auoh.tmp
DotNetZip-topssjht.tmp
DotNetZip-yoqcobxr.tmp
DotNetZip-augsopxq.tmp
DotNetZip-bdtd5mo2.tmp
DotNetZip-t4zfmfkm.tmp
DotNetZip-w5dfjw4a.tmp
DotNetZip-5meqfevj.tmp
DotNetZip-0sr1p3jx.tmp
DotNetZip-1ynvbm32.tmp
DotNetZip-3z2anajc.tmp
DotNetZip-bka2pdse.tmp
DotNetZip-d1234xo1.tmp
DotNetZip-awq0g1uq.tmp
DotNetZip-cdurhwyv.tmp
DotNetZip-d2thfbt4.tmp
DotNetZip-mdc3ydr5.tmp
DotNetZip-3a2mqxdj.tmp
DotNetZip-3pvymhkx.tmp
DotNetZip-hnic3w1f.tmp
DotNetZip-ivjnozul.tmp
DotNetZip-j5ztiud1.tmp
DotNetZip-1gn03sha.tmp
DotNetZip-h3gyv220.tmp
DotNetZip-x4beacjo.tmp
DotNetZip-yo2i4ozj.tmp
DotNetZip-2hb425gl.tmp
DotNetZip-lp1eue5l.tmp
DotNetZip-nc4f1v0g.tmp
DotNetZip-wonbcugj.tmp
DotNetZip-411klrnz.tmp
DotNetZip-4lp1wccj.tmp
DotNetZip-5xhob0to.tmp
DotNetZip-cooxyokg.tmp
DotNetZip-hshektyw.tmp
DotNetZip-jpvbvqra.tmp
DotNetZip-vv0juyqi.tmp
DotNetZip-xdjsenm4.tmp
DotNetZip-dz2v4tcw.tmp
DotNetZip-nzfzog0t.tmp
DotNetZip-wfhvin01.tmp
DotNetZip-yasmkrxe.tmp
DotNetZip-adt4iy3u.tmp
DotNetZip-fls0gek4.tmp
DotNetZip-dsxrhtyh.tmp
DotNetZip-n4w0ysuq.tmp
DotNetZip-tdfjdlhp.tmp
DotNetZip-veh0dbur.tmp
DotNetZip-2p1msjg2.tmp
DotNetZip-2rb2gohw.tmp
DotNetZip-koi52pqy.tmp
DotNetZip-nywe3fwp.tmp
DotNetZip-fzwrn4kc.tmp
DotNetZip-i353xeck.tmp
DotNetZip-ler0sofu.tmp
DotNetZip-q3gqkwpd.tmp
DotNetZip-qstketqp.tmp
DotNetZip-urc50u52.tmp
DotNetZip-llfm1c2a.tmp
DotNetZip-0b20inmo.tmp
DotNetZip-2lznkgze.tmp
DotNetZip-pifsjlnx.tmp
DotNetZip-5kwisc2y.tmp
DotNetZip-cbczvlaj.tmp
DotNetZip-ngpi1z0j.tmp
DotNetZip-weqz0uk5.tmp
DotNetZip-nsichqaj.tmp
DotNetZip-qa312elw.tmp
DotNetZip-5k35vxjz.tmp
DotNetZip-cwwzlojw.tmp
DotNetZip-gegnizol.tmp
DotNetZip-h3w0wmka.tmp
DotNetZip-jmsmyqz5.tmp
DotNetZip-vtaqrw2h.tmp
DotNetZip-yyhaodfh.tmp
DotNetZip-cdmkcd4y.tmp
DotNetZip-z1xdllfx.tmp
DotNetZip-iihxgbrq.tmp
DotNetZip-mrcmuguw.tmp
DotNetZip-psudiycx.tmp
DotNetZip-vdrsxnow.tmp
DotNetZip-mc1gq2jf.tmp
DotNetZip-v4002t1z.tmp
DotNetZip-40nyort2.tmp
DotNetZip-juzvzj1m.tmp
DotNetZip-qn2otzzm.tmp
DotNetZip-rikjvq5a.tmp
DotNetZip-wki4zrbg.tmp
DotNetZip-0uaernvv.tmp
DotNetZip-1dxfn2dw.tmp
DotNetZip-bm1fhclf.tmp
DotNetZip-bvs3b125.tmp
DotNetZip-ewsg1miw.tmp
DotNetZip-gqw0143y.tmp
DotNetZip-hmbiqusa.tmp
DotNetZip-oyt31wuv.tmp
DotNetZip-plitzlor.tmp
DotNetZip-uaflybh3.tmp
DotNetZip-xexnengz.tmp
DotNetZip-zo21i5cn.tmp
DotNetZip-2catu1jo.tmp
DotNetZip-nqdg3ue5.tmp
DotNetZip-ui2rvpqj.tmp
DotNetZip-1y2hv0qy.tmp
DotNetZip-3453yzcn.tmp
DotNetZip-truwvvfw.tmp
DotNetZip-tuzgwcqa.tmp
DotNetZip-ekgciabq.tmp
DotNetZip-kv20oln0.tmp
DotNetZip-w2iblaoc.tmp
DotNetZip-x32z0emy.tmp
DotNetZip-zghlegzs.tmp
DotNetZip-eruagdt4.tmp
DotNetZip-pcisbuyw.tmp
DotNetZip-romiotwk.tmp
DotNetZip-1u4j5opo.tmp
DotNetZip-lzlt5amx.tmp
DotNetZip-y1jmwi2h.tmp
DotNetZip-20dlijlm.tmp
DotNetZip-lvbzc3aj.tmp
DotNetZip-xlykt3ey.tmp
DotNetZip-zpwhpw5q.tmp
DotNetZip-4qiyevhw.tmp
DotNetZip-xdua0bsb.tmp
DotNetZip-1xh1oylc.tmp
DotNetZip-hjwxqdvs.tmp
DotNetZip-o5kmglrz.tmp
DotNetZip-rinyr0cm.tmp
DotNetZip-g2jphqzm.tmp
DotNetZip-awhmbd4s.tmp
DotNetZip-kwwswfc2.tmp
DotNetZip-opuclrgi.tmp
DotNetZip-szswben3.tmp
DotNetZip-uzbhff1w.tmp
DotNetZip-4pom245k.tmp
DotNetZip-btvrdey1.tmp
DotNetZip-dbzd5nj5.tmp
DotNetZip-yyfy5k50.tmp
DotNetZip-j42hzqj3.tmp
DotNetZip-mgrmtrxu.tmp
DotNetZip-sckfk20c.tmp
DotNetZip-snodd05j.tmp
DotNetZip-u3lo55bv.tmp
DotNetZip-lipiytg2.tmp
DotNetZip-mhxstndg.tmp
DotNetZip-pxcgdxtj.tmp
DotNetZip-rszce1ri.tmp
DotNetZip-ysvet4hu.tmp
DotNetZip-34zh0vf2.tmp
DotNetZip-c1k2hjlk.tmp
DotNetZip-fjg1iucq.tmp
DotNetZip-klzoysaw.tmp
DotNetZip-3m1yh0ip.tmp
DotNetZip-zwmxxk1h.tmp
DotNetZip-1ejtwlbi.tmp
DotNetZip-aslqvfx5.tmp
DotNetZip-iva0hpoc.tmp
DotNetZip-xej3yncx.tmp
DotNetZip-bbolqoum.tmp
DotNetZip-ch0g21vr.tmp
DotNetZip-ejlq11rt.tmp
DotNetZip-fmafq2r2.tmp
DotNetZip-mal42wtx.tmp
DotNetZip-nvhonuuu.tmp
DotNetZip-ox1kxoko.tmp
DotNetZip-scjmz1eq.tmp
DotNetZip-uh5pltg1.tmp
DotNetZip-bip4c25k.tmp
DotNetZip-cbo3h5fq.tmp
DotNetZip-j03fv552.tmp
DotNetZip-j2r3v0s0.tmp
DotNetZip-prnm50iz.tmp
DotNetZip-kgm4ftae.tmp
DotNetZip-eonndtea.tmp
DotNetZip-ptdgklrl.tmp
DotNetZip-ttbwdzdm.tmp
DotNetZip-ye2h3i43.tmp
DotNetZip-zf5wxpbo.tmp
DotNetZip-45gigche.tmp
DotNetZip-grts45ae.tmp
DotNetZip-4g2bfl1n.tmp
DotNetZip-5h0on3a1.tmp
DotNetZip-h55i1kwy.tmp
DotNetZip-i1ceyi01.tmp
DotNetZip-m0oqlgyy.tmp
DotNetZip-nakykgr5.tmp
DotNetZip-sijiycvx.tmp
DotNetZip-t1eguuxz.tmp
DotNetZip-zw4hll1i.tmp
DotNetZip-5bv3inui.tmp
DotNetZip-ejr1fsio.tmp
DotNetZip-ib5yl5ru.tmp
DotNetZip-kcmfvh0p.tmp
DotNetZip-od12oonb.tmp
DotNetZip-ordqtifx.tmp
DotNetZip-uqw22ol2.tmp
DotNetZip-uyowtd0m.tmp
DotNetZip-dwpughia.tmp
DotNetZip-kjoocbql.tmp
DotNetZip-lbxbnkwd.tmp
DotNetZip-rad5bozy.tmp
DotNetZip-bgwjtmq4.tmp
DotNetZip-ydcwcue1.tmp
DotNetZip-mwvblfvw.tmp
DotNetZip-nslxaiwy.tmp
DotNetZip-4fnswqy0.tmp
DotNetZip-gwxpwofy.tmp
DotNetZip-mru5ozez.tmp
DotNetZip-pdj5lozr.tmp
DotNetZip-5sax1qon.tmp
DotNetZip-g2uc1m5e.tmp
DotNetZip-lnacelxb.tmp
DotNetZip-oiqfoa3p.tmp
DotNetZip-qn2gxxnf.tmp
DotNetZip-k05a0co2.tmp
DotNetZip-l0mb10os.tmp
DotNetZip-mb0mle04.tmp
DotNetZip-o0pa1cfw.tmp
DotNetZip-uhfvki5h.tmp
DotNetZip-vmzz1f01.tmp
DotNetZip-1e0yu5h2.tmp
DotNetZip-24dapevy.tmp
DotNetZip-bf2lnd2r.tmp
DotNetZip-fz0pgeng.tmp
DotNetZip-plexmkwd.tmp
DotNetZip-q5o2z0ix.tmp
DotNetZip-qlsu5wz0.tmp
DotNetZip-uvfcecs5.tmp
DotNetZip-w5olejkn.tmp
DotNetZip-b1f1jtwb.tmp
DotNetZip-nquoekwz.tmp
DotNetZip-tipgzdjf.tmp
DotNetZip-z4h5gv1w.tmp
DotNetZip-z4wkc3wj.tmp
DotNetZip-dwsjikpf.tmp
DotNetZip-bgaih2jx.tmp
DotNetZip-bzcl0mid.tmp
DotNetZip-3h4amx0o.tmp
DotNetZip-ce0lgyoh.tmp
DotNetZip-fmp2wqhn.tmp
DotNetZip-1jqwdmhh.tmp
DotNetZip-55rwgc2i.tmp
DotNetZip-fwfgkgw2.tmp
DotNetZip-53mewlau.tmp
DotNetZip-c04bjehb.tmp
DotNetZip-k3fghc5h.tmp
DotNetZip-bfyke3cr.tmp
DotNetZip-wqfe5uqa.tmp
DotNetZip-zla4xb2v.tmp
DotNetZip-cktnpn3e.tmp
DotNetZip-hyndfygd.tmp
DotNetZip-uhygfbzd.tmp
DotNetZip-jd0cg3kx.tmp
DotNetZip-o2pq0gkb.tmp
DotNetZip-w1v5p3bn.tmp
DotNetZip-dd4p30hf.tmp
DotNetZip-n4unhx4p.tmp
DotNetZip-p0oapb2c.tmp
DotNetZip-adyknlgg.tmp
DotNetZip-kpbl2yip.tmp
DotNetZip-rqal3n1i.tmp
DotNetZip-ldotmh3e.tmp
DotNetZip-vkpk5vfu.tmp
DotNetZip-z31xrisd.tmp
DotNetZip-0ekmg1iw.tmp
DotNetZip-aln0kjsj.tmp
DotNetZip-k3uvohe3.tmp
DotNetZip-eez1jeoa.tmp
DotNetZip-qyp2r0ij.tmp
DotNetZip-steuv5vf.tmp
DotNetZip-fwrlv0ta.tmp
DotNetZip-qksxz3jb.tmp
DotNetZip-tubdj54s.tmp
DotNetZip-12bhoi5w.tmp
DotNetZip-12xmcprq.tmp
DotNetZip-3alisry4.tmp
DotNetZip-kpgmrtq1.tmp
DotNetZip-kt1uixnj.tmp
DotNetZip-miairl2z.tmp
DotNetZip-eenombs1.tmp
DotNetZip-gref41nx.tmp
DotNetZip-wq4kqkk2.tmp
DotNetZip-4kooo1cr.tmp
DotNetZip-lcvhqtwz.tmp
DotNetZip-vfptgqve.tmp
DotNetZip-55iyj3n3.tmp
DotNetZip-ddaoauuj.tmp
DotNetZip-h025jxlo.tmp
DotNetZip-pebxld00.tmp
DotNetZip-5mcccwyw.tmp
DotNetZip-orsjg45m.tmp
DotNetZip-bxxn2zua.tmp
DotNetZip-jyvdt5z2.tmp
DotNetZip-kcyrmcjt.tmp
DotNetZip-ql1uw4bq.tmp
DotNetZip-h0nfn4er.tmp
DotNetZip-hoqenwrm.tmp
DotNetZip-ns32cfwg.tmp
DotNetZip-vq3yvm5z.tmp
DotNetZip-ywbtefap.tmp
DotNetZip-moprcdd3.tmp
DotNetZip-w0w2sznt.tmp
DotNetZip-e0iv2rit.tmp
DotNetZip-h1rddmzf.tmp
DotNetZip-oty2tsgs.tmp
DotNetZip-sqymitqd.tmp
DotNetZip-uq2e4k5q.tmp
DotNetZip-rpjucxjz.tmp
7ebc1144-de35-4681-8f9e-54a7c7a8e7d7.zip
INetC.dll
System.dll
UserInfo.dll
uac.dll
nsExec.dll
nsisunz.dll
remote-settings-startup-bundle-
tmpaddon
tmpaddon
6824f4a902c78fbd.customDestinations-ms
ZCFAJ8ZVC11644Z96LVU.temp
AlternateServices.bin
addonStartup.json.lz4
bookmarks-2026-05-24_10_Ys4KhK94HtecoF_d97HCIC01yykY3j7CuCQkVwbEMIU=.jsonlz4
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
0098e3f5-8879-47cc-a993-2a94fd43b8af
060c9b25-5f01-4002-8389-1f4e1f85036b
7599ef66-72d3-47e7-8a61-447bcd78dfbc
7ab9c5ec-6e36-4ef2-a07a-7c5f6475c007
deb6cee3-f589-476e-9992-fb9d1e0abe6e
extension-preferences.json
extensions.json
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
prefs.js
prefs.js
recovery.baklz4
recovery.jsonlz4
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
e5a477c.msi
logo.png
VC_redist.x64.exe
license.rtf
thm.wxl
thm.xml
wixstdba.dll
memory/1056-7743-0x00000204DFE20000-0x00000204DFEA0000-memory.dmp
memory/1236-153-0x00000225F8ED0000-0x00000225F93F8000-memory.dmp
memory/1236-192-0x00000225F9890000-0x00000225F9920000-memory.dmp
memory/1236-154-0x00000225F88E0000-0x00000225F88F0000-memory.dmp
memory/1236-451-0x00000225F88E0000-0x00000225F88F0000-memory.dmp
memory/1236-160-0x00000225F8860000-0x00000225F8878000-memory.dmp
memory/1236-171-0x00000225F8E00000-0x00000225F8EB0000-memory.dmp
memory/1236-152-0x00000225F6860000-0x00000225F6874000-memory.dmp
memory/1236-156-0x00000225F8890000-0x00000225F88D6000-memory.dmp
memory/1236-196-0x00000225F9830000-0x00000225F9852000-memory.dmp
memory/1236-199-0x00000225F9800000-0x00000225F980E000-memory.dmp
memory/1236-150-0x00000225F88F0000-0x00000225F899A000-memory.dmp
memory/1236-7290-0x00000225F80F0000-0x00000225F8114000-memory.dmp
memory/1236-5877-0x00000225F8120000-0x00000225F819A000-memory.dmp
memory/1236-146-0x00000225F63F0000-0x00000225F6444000-memory.dmp
memory/1292-392-0x00000274F5B00000-0x00000274F5B01000-memory.dmp
memory/1292-404-0x00000274F5B00000-0x00000274F5B01000-memory.dmp
memory/1292-399-0x00000274F5B00000-0x00000274F5B01000-memory.dmp
memory/1292-401-0x00000274F5B00000-0x00000274F5B01000-memory.dmp
memory/1292-402-0x00000274F5B00000-0x00000274F5B01000-memory.dmp
memory/1292-400-0x00000274F5B00000-0x00000274F5B01000-memory.dmp
memory/1292-405-0x00000274F5B00000-0x00000274F5B01000-memory.dmp
memory/1292-394-0x00000274F5B00000-0x00000274F5B01000-memory.dmp
memory/1292-393-0x00000274F5B00000-0x00000274F5B01000-memory.dmp
memory/1292-403-0x00000274F5B00000-0x00000274F5B01000-memory.dmp
memory/1620-7778-0x00000171498B0000-0x00000171498B1000-memory.dmp
memory/1620-7786-0x00000171498B0000-0x00000171498B1000-memory.dmp
memory/1620-7783-0x00000171498B0000-0x00000171498B1000-memory.dmp
memory/1620-7781-0x00000171498B0000-0x00000171498B1000-memory.dmp
memory/1620-7782-0x00000171498B0000-0x00000171498B1000-memory.dmp
memory/1620-7779-0x00000171498B0000-0x00000171498B1000-memory.dmp
memory/1620-7777-0x00000171498B0000-0x00000171498B1000-memory.dmp
memory/1620-7785-0x00000171498B0000-0x00000171498B1000-memory.dmp
memory/1620-7784-0x00000171498B0000-0x00000171498B1000-memory.dmp
memory/3184-482-0x000001A4BD810000-0x000001A4BD8C0000-memory.dmp
memory/3472-883-0x000001686AE10000-0x000001686AEC0000-memory.dmp
memory/3472-314-0x00007FF9F1150000-0x00007FF9F1151000-memory.dmp
memory/3472-466-0x000001686AE10000-0x000001686AEC0000-memory.dmp
memory/3696-7615-0x00000000002B0000-0x0000000000327000-memory.dmp
memory/4184-5740-0x000001AE6B810000-0x000001AE6BA5C000-memory.dmp
memory/4456-7964-0x0000017709030000-0x0000017709068000-memory.dmp
memory/4616-5691-0x0000000004DC0000-0x0000000004DDD000-memory.dmp
memory/4636-6951-0x000001C892250000-0x000001C892251000-memory.dmp
memory/4636-6944-0x000001C892250000-0x000001C892251000-memory.dmp
memory/4636-6952-0x000001C892250000-0x000001C892251000-memory.dmp
memory/4636-6945-0x000001C892250000-0x000001C892251000-memory.dmp
memory/4636-6950-0x000001C892250000-0x000001C892251000-memory.dmp
memory/4636-6949-0x000001C892250000-0x000001C892251000-memory.dmp
memory/4636-6954-0x000001C892250000-0x000001C892251000-memory.dmp
memory/4636-6953-0x000001C892250000-0x000001C892251000-memory.dmp
memory/4636-6943-0x000001C892250000-0x000001C892251000-memory.dmp
memory/4752-294-0x00007FF9F2010000-0x00007FF9F2011000-memory.dmp
memory/4752-293-0x00007FF9F02D0000-0x00007FF9F02D1000-memory.dmp
memory/4840-7554-0x00000279FB010000-0x00000279FB0C0000-memory.dmp
memory/4840-281-0x00007FF9F1150000-0x00007FF9F1151000-memory.dmp
memory/4840-465-0x00000279FB010000-0x00000279FB0C0000-memory.dmp
memory/6788-5802-0x0000017166C80000-0x0000017166CBC000-memory.dmp
memory/6788-5801-0x0000017166C20000-0x0000017166C32000-memory.dmp
memory/6788-5825-0x0000017166D00000-0x0000017166D34000-memory.dmp
memory/7304-7613-0x00000000002B0000-0x0000000000327000-memory.dmp
memory/7748-15900-0x000001D34BE80000-0x000001D34BE9A000-memory.dmp
memory/7748-15938-0x000001D34CBE0000-0x000001D34CBEA000-memory.dmp
memory/7748-15902-0x000001D34BE20000-0x000001D34BE2C000-memory.dmp
memory/7748-15903-0x000001D34C750000-0x000001D34C7EE000-memory.dmp
memory/7748-15904-0x000001D34C430000-0x000001D34C44C000-memory.dmp
memory/7748-15906-0x000001D34C7F0000-0x000001D34C85E000-memory.dmp
memory/7748-15258-0x000001D34C480000-0x000001D34C642000-memory.dmp
memory/7748-15905-0x000001D34C6B0000-0x000001D34C6D8000-memory.dmp
memory/7748-15913-0x000001D34C9E0000-0x000001D34CAA0000-memory.dmp
memory/7748-15915-0x000001D34CAA0000-0x000001D34CB40000-memory.dmp
memory/7748-15916-0x000001D34C470000-0x000001D34C480000-memory.dmp
memory/7748-15930-0x000001D34CB60000-0x000001D34CB6C000-memory.dmp
memory/7748-15907-0x000001D34BE30000-0x000001D34BE3A000-memory.dmp
memory/7748-15908-0x000001D34C860000-0x000001D34C8C2000-memory.dmp
memory/7748-15909-0x000001D34BE40000-0x000001D34BE4A000-memory.dmp
memory/7748-15910-0x000001D34C8D0000-0x000001D34C8FE000-memory.dmp
memory/7748-15936-0x000001D34CE50000-0x000001D34CE9C000-memory.dmp
memory/7748-15901-0x000001D34C400000-0x000001D34C422000-memory.dmp
memory/7748-15942-0x000001D34CE20000-0x000001D34CE2E000-memory.dmp
memory/7748-15941-0x000001D34CBF0000-0x000001D34CBFA000-memory.dmp
memory/7748-15937-0x000001D34CE00000-0x000001D34CE1C000-memory.dmp
memory/7748-15929-0x000001D34C9D0000-0x000001D34C9DC000-memory.dmp
memory/7748-15911-0x000001D34C900000-0x000001D34C916000-memory.dmp
memory/7748-15912-0x000001D34C450000-0x000001D34C458000-memory.dmp
memory/7748-15914-0x000001D34C980000-0x000001D34C9DA000-memory.dmp
memory/7748-15917-0x000001D34C920000-0x000001D34C92A000-memory.dmp
memory/7748-15928-0x000001D34C9C0000-0x000001D34C9CC000-memory.dmp
memory/7748-15964-0x000001D34CE30000-0x000001D34CE3E000-memory.dmp
memory/7748-15918-0x000001D34C930000-0x000001D34C93C000-memory.dmp
memory/7748-15919-0x000001D34C940000-0x000001D34C94E000-memory.dmp
memory/7748-15920-0x000001D34C970000-0x000001D34C984000-memory.dmp
memory/7748-15921-0x000001D34C950000-0x000001D34C960000-memory.dmp
memory/7748-15922-0x000001D34C990000-0x000001D34C99C000-memory.dmp
memory/7748-15923-0x000001D34C960000-0x000001D34C970000-memory.dmp
memory/7748-15924-0x000001D34C9A0000-0x000001D34C9AE000-memory.dmp
memory/7748-15925-0x000001D34CB90000-0x000001D34CBD4000-memory.dmp
memory/7748-15926-0x000001D34C9B0000-0x000001D34C9BA000-memory.dmp
memory/7748-15927-0x000001D34CB40000-0x000001D34CB52000-memory.dmp
memory/7800-8049-0x00007FF9F03B0000-0x00007FF9F03B5000-memory.dmp
memory/7800-8051-0x00007FF9F03D0000-0x00007FF9F03D5000-memory.dmp
memory/7800-8055-0x00007FF9F0410000-0x00007FF9F0415000-memory.dmp
memory/7800-8053-0x00007FF9F03F0000-0x00007FF9F03F5000-memory.dmp
memory/7800-8057-0x00007FF9F05D0000-0x00007FF9F05D5000-memory.dmp
memory/7800-8047-0x00007FF9F0390000-0x00007FF9F0395000-memory.dmp
memory/7800-8059-0x00007FF9F0600000-0x00007FF9F0605000-memory.dmp
memory/7800-8061-0x00007FF9F2020000-0x00007FF9F2025000-memory.dmp
memory/7800-8043-0x00007FF9F0350000-0x00007FF9F0355000-memory.dmp
memory/7800-8220-0x0000000022AE0000-0x0000000022B08000-memory.dmp
memory/7800-8045-0x00007FF9F0370000-0x00007FF9F0375000-memory.dmp
memory/7800-8032-0x00007FF9F02E0000-0x00007FF9F02E5000-memory.dmp
memory/7800-8034-0x00007FF9F0310000-0x00007FF9F0315000-memory.dmp
memory/7800-8036-0x00007FF9F0330000-0x00007FF9F0335000-memory.dmp
memory/7800-8028-0x00007FF9F22A0000-0x00007FF9F22A5000-memory.dmp
memory/7800-8030-0x00007FF9F22B0000-0x00007FF9F22B5000-memory.dmp
memory/7800-8029-0x00007FF9EFFB0000-0x00007FF9EFFB5000-memory.dmp
memory/7800-13841-0x000000004D2A0000-0x000000004D2D8000-memory.dmp
memory/7800-15899-0x0000000020D80000-0x0000000020DD6000-memory.dmp
memory/7800-15834-0x0000000053C00000-0x0000000053C46000-memory.dmp
memory/7800-15835-0x000000004D730000-0x000000004D73A000-memory.dmp
memory/7800-15833-0x0000000051900000-0x0000000051912000-memory.dmp
memory/7800-7927-0x0000000027300000-0x00000000273F2000-memory.dmp
memory/7800-7924-0x0000000023080000-0x0000000023088000-memory.dmp
memory/7800-13840-0x00000000275F0000-0x00000000275F8000-memory.dmp
memory/7800-7925-0x0000000023090000-0x000000002309A000-memory.dmp
memory/7800-15677-0x000000004D740000-0x000000004D74E000-memory.dmp
memory/7800-7634-0x00007FF9F2280000-0x00007FF9F2285000-memory.dmp
memory/7800-7633-0x00007FF9F2290000-0x00007FF9F2292000-memory.dmp
memory/7800-7632-0x00007FF9EFF90000-0x00007FF9EFF95000-memory.dmp
memory/7800-7630-0x00007FF9EFFA0000-0x00007FF9EFFA2000-memory.dmp
memory/7800-7628-0x00007FF9F2260000-0x00007FF9F2265000-memory.dmp
memory/7800-7926-0x00000000230B0000-0x00000000230BE000-memory.dmp
memory/7800-13842-0x0000000027900000-0x000000002790E000-memory.dmp
memory/7800-15254-0x0000000027910000-0x000000002791A000-memory.dmp
memory/7800-7811-0x0000000022800000-0x000000002285E000-memory.dmp
memory/7800-7755-0x000000001E680000-0x000000001E71A000-memory.dmp
memory/7800-7756-0x000000001E720000-0x000000001E7A0000-memory.dmp
memory/7800-7691-0x000000001E7F0000-0x000000001E7FA000-memory.dmp
memory/7800-7682-0x0000000022330000-0x0000000022374000-memory.dmp
memory/7800-7681-0x000000001E7E0000-0x000000001E7F0000-memory.dmp
memory/7800-7678-0x000000001E120000-0x000000001E132000-memory.dmp
memory/7800-7680-0x000000001F690000-0x000000001F6A4000-memory.dmp
memory/7800-7679-0x000000001E050000-0x000000001E058000-memory.dmp
memory/7800-7674-0x000000001F6D0000-0x000000001F70C000-memory.dmp
memory/7800-7663-0x000000001E010000-0x000000001E01C000-memory.dmp
memory/7800-7662-0x000000001F650000-0x000000001F686000-memory.dmp
memory/7800-7661-0x000000001F600000-0x000000001F644000-memory.dmp
memory/7800-7644-0x000000001E020000-0x000000001E032000-memory.dmp
memory/7800-7645-0x000000001E000000-0x000000001E008000-memory.dmp
memory/7800-7646-0x000000001E0E0000-0x000000001E11C000-memory.dmp
memory/7800-7643-0x000000001F970000-0x00000000200DA000-memory.dmp
memory/7800-7642-0x00000000013E0000-0x00000000013E8000-memory.dmp
memory/7800-7641-0x000000001BD00000-0x000000001BD0A000-memory.dmp
memory/7800-7640-0x00000000013F0000-0x00000000013FA000-memory.dmp
memory/7800-7639-0x000000001E070000-0x000000001E0DA000-memory.dmp
memory/7800-7637-0x000000001E140000-0x000000001E276000-memory.dmp
memory/7800-7636-0x000000001BD10000-0x000000001BDBA000-memory.dmp
memory/7800-7635-0x00007FF7C71A0000-0x00007FF7C71B4000-memory.dmp
memory/7800-13868-0x0000000000FD0000-0x0000000000FE6000-memory.dmp
memory/7800-14048-0x0000000000FC0000-0x0000000000FC8000-memory.dmp
memory/8128-7616-0x00000000002B0000-0x0000000000327000-memory.dmp