Analysis
- user interaction
yes - max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
20/06/2026, 03:49
General
- Target WonderWorks - Installer.exe
- Size 2.9MB
- Sample260620-edndjaet3t
- SHA256 7acb43073bc711d7ed3446df117050a70b01744e55d87a227731ee2e5a4b0b70
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 3 IoCs
- Downloads MZ/PE file 1 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Checks computer location settings 2 TTPs 10 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory 64 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 15 IoCs
- Executes dropped EXE 33 IoCs
- Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Loads dropped DLL 64 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 17 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 58 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\WonderWorks - Installer.exe"C:\Users\Admin\AppData\Local\Temp\WonderWorks - Installer.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\temp\nsh6F6E.tmp\OWinstaller.exe"C:\ProgramData\temp\nsh6F6E.tmp\OWinstaller.exe" Sel=1&Channel=web_dl_btn&Extension=hkpfjaejdimnamfkgckpapcfkmoiamenagbcclie&Name=WonderWorks&UtmSource=web_app_store&UtmContent=new-light&Referer=www.overwolf.com&Browser=chrome&EMd5=e21de6a2167b8b3fcc7b128d932dce9d&ESha1=131906d2fc0eeabbc908511377d931ee79978c5d&ESha256=5512fa874e06f60bef84220c7b620129014face36a96a8448a917d97c93ae8a8 -partnerCustomizationLevel 0 -exepath C:\Users\Admin\AppData\Local\Temp\WonderWorks - Installer.exe2⤵
- Adds Run key to start application
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\DxDiag.exe"C:\Windows\System32\DxDiag.exe" /xC:\Users\Admin\AppData\Local\Overwolf\Temp\DxDiagOutput.xml3⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --user-data-dir="C:\ProgramData\temp\nsh6F6E.tmp\OWinstaller.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --high-dpi-support=1 --mojo-named-platform-channel-pipe=4044.4184.41302014184981931513⤵
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\temp\nsh6F6E.tmp\OWinstaller.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\temp\nsh6F6E.tmp\OWinstaller.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7fffd845b078,0x7fffd845b084,0x7fffd845b0904⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\temp\nsh6F6E.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1724,i,13688316774751382365,14003458206897065237,262144 --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\temp\nsh6F6E.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1352,i,13688316774751382365,14003458206897065237,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:34⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\temp\nsh6F6E.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1720,i,13688316774751382365,14003458206897065237,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\temp\nsh6F6E.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3468,i,13688316774751382365,14003458206897065237,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\temp\nsh6F6E.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4016,i,13688316774751382365,14003458206897065237,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\temp\nsh6F6E.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4912,i,13688316774751382365,14003458206897065237,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:84⤵
-
-
-
C:\ProgramData\Overwolf\Setup\0.304.0.11\OverwolfSetup.exe"C:\ProgramData\Overwolf\Setup\0.304.0.11\OverwolfSetup.exe" /S "/TargetDir=C:\Program Files (x86)\Overwolf\" -ignoredotnet3⤵
- Downloads MZ/PE file
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe"C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe" /UpdateFWRules "C:\Program Files (x86)\Overwolf\\0.304.0.11\OverwolfBrowser.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe"C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe" /Register4⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\sc.exe"sc" sdshow OverwolfUpdater5⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\sc.exe"sc" sdset OverwolfUpdater D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;S-1-5-18)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\sc.exe"sc" sdshow OverwolfUpdater5⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\sc.exe"sc" sdset OverwolfUpdater D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;SY)(A;;RPWPCR;;;S-1-5-19)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\sc.exe"sc" sdshow OverwolfUpdater5⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\sc.exe"sc" sdset OverwolfUpdater D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;SY)(A;;RPWPCR;;;LS)(A;;RPWPCR;;;S-1-5-20)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\sc.exe"sc" sdshow OverwolfUpdater5⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\sc.exe"sc" sdset OverwolfUpdater D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;SY)(A;;RPWPCR;;;LS)(A;;RPWPCR;;;NS)(A;;RPWPCR;;;S-1-5-21-2937465464-4167303362-2236413517-1000)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\sc.exe"sc" sdshow OverwolfUpdater5⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\sc.exe"sc" sdset OverwolfUpdater D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;SY)(A;;RPWPCR;;;LS)(A;;RPWPCR;;;NS)(A;;RPWPCR;;;S-1-5-21-2937465464-4167303362-2236413517-1000)(A;;RPWPCR;;;S-1-1-0)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\Common Files\Overwolf\Teamspeak\OverwolfTSHelper.exe"C:\Program Files (x86)\Common Files\Overwolf\Teamspeak\OverwolfTSHelper.exe" /RegServer4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\ProgramData\Overwolf\Setup\checkRedist.exe"C:\ProgramData\Overwolf\Setup\checkRedist.exe"4⤵
- Executes dropped EXE
-
-
C:\ProgramData\Overwolf\Setup\vcredist.exe"C:\ProgramData\Overwolf\Setup\vcredist.exe" /q /norestart /repair4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{2D99FFD4-744B-4577-BECD-A5925196AE60}\.cr\vcredist.exe"C:\Windows\Temp\{2D99FFD4-744B-4577-BECD-A5925196AE60}\.cr\vcredist.exe" -burn.clean.room="C:\ProgramData\Overwolf\Setup\vcredist.exe" -burn.filehandle.attached=696 -burn.filehandle.self=700 /q /norestart /repair5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{F1C39A40-BBF0-47E0-B9A7-45E0987E2DB1}\.be\VC_redist.x64.exe"C:\Windows\Temp\{F1C39A40-BBF0-47E0-B9A7-45E0987E2DB1}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{83C90CC5-4772-4AF3-A010-36476556DCFA} {10627717-948C-4F4A-AC9C-20823FC0E156} 44526⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1096 -burn.embedded BurnPipe.{AD9AF9E0-E997-40C6-86E4-FE9C33B414BB} {60990624-0D67-4D46-A883-BD69AF2A276C} 58207⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1096 -burn.embedded BurnPipe.{AD9AF9E0-E997-40C6-86E4-FE9C33B414BB} {60990624-0D67-4D46-A883-BD69AF2A276C} 58208⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{143134C5-7535-4E49-98AC-76842221BE24} {EDCB754F-FDCE-42F1-A8D8-C3896E9E1E5C} 33609⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
-
-
-
-
-
C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe"C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe" /RunningFrom SCM1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe"C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe" /RunningFrom FromService /SelfLaunched2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe"C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe-cs2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Overwolf\Overwolf.exe"C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe" -launchapp ojgnfnbjckbpfaciphphehonokbggjhpnnoafack2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\DxDiag.exe"C:\Windows\System32\DxDiag.exe" /xC:\Users\Admin\AppData\Local\Overwolf\Temp\DxDiagOutput.xml3⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Overwolf\0.304.0.11\OverwolfBrowser.exe"C:\Program Files (x86)\Overwolf\0.304.0.11\OverwolfBrowser.exe" --type=crashpad-handler --no-rate-limit --max-db-size=10 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Overwolf\User Data\Crashpad" --url=http://localhost:54288/ --annotation=platform=win64 --annotation=product=Overwolf --annotation=version=0.304.0.11 --initial-client-data=0xe24,0xe0c,0xe28,0xe20,0xe10,0x7fffd71a4148,0x7fffd71a4154,0x7fffd71a41603⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Overwolf\0.304.0.11\OverwolfBrowser.exe"C:\Program Files (x86)\Overwolf\0.304.0.11\OverwolfBrowser.exe" --type=gpu-process --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Overwolf\CefBrowserCache" --locales-dir-path="C:\Program Files (x86)\Overwolf\0.304.0.11\Locales" --log-severity=disable --libcef-path="C:\Program Files (x86)\Overwolf\0.304.0.11\libcef.DLL" --remote-allow-origins=* --ow-domain=www.overwolf.com --ow-process-id=4040 --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4380,i,8777118673749489603,3933278539939632760,262144 --field-trial-handle=5396,i,13075480521795329199,5824381683690015465,262144 --enable-features=AudioVideoTracks,IdleDetection --disable-features=HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --variations-seed-version --trace-process-track-uuid=3190708988185955192 --enable-logging=handle --log-file=5400 --mojo-platform-channel-handle=5392 /prefetch:23⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Overwolf\0.304.0.11\OverwolfBrowser.exe"C:\Program Files (x86)\Overwolf\0.304.0.11\OverwolfBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Overwolf\CefBrowserCache" --locales-dir-path="C:\Program Files (x86)\Overwolf\0.304.0.11\Locales" --log-severity=disable --libcef-path="C:\Program Files (x86)\Overwolf\0.304.0.11\libcef.DLL" --remote-allow-origins=* --ow-domain=www.overwolf.com --ow-process-id=4040 --metrics-shmem-handle=4596,i,7461855408018689045,16416754005835100304,524288 --field-trial-handle=5396,i,13075480521795329199,5824381683690015465,262144 --enable-features=AudioVideoTracks,IdleDetection --disable-features=HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --variations-seed-version --trace-process-track-uuid=3190708989122997041 --enable-logging=handle --log-file=5548 --mojo-platform-channel-handle=5544 /prefetch:33⤵
- Executes dropped EXE
- System Time Discovery
-
-
C:\Program Files (x86)\Overwolf\0.304.0.11\OverwolfBrowser.exe"C:\Program Files (x86)\Overwolf\0.304.0.11\OverwolfBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" --no-pre-read-main-dll --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Overwolf\CefBrowserCache" --locales-dir-path="C:\Program Files (x86)\Overwolf\0.304.0.11\Locales" --log-severity=disable --libcef-path="C:\Program Files (x86)\Overwolf\0.304.0.11\libcef.DLL" --remote-allow-origins=* --ow-domain=www.overwolf.com --ow-process-id=4040 --metrics-shmem-handle=4672,i,5341512130344676572,13572468358611716129,524288 --field-trial-handle=5396,i,13075480521795329199,5824381683690015465,262144 --enable-features=AudioVideoTracks,IdleDetection --disable-features=HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --variations-seed-version --trace-process-track-uuid=3190708990060038890 --enable-logging=handle --log-file=5624 --mojo-platform-channel-handle=5620 /prefetch:83⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Common Files\Overwolf\0.304.0.11\OverwolfHelper.exe"C:\Program Files (x86)\Common Files\Overwolf\0.304.0.11\OverwolfHelper.exe" "path=C:\Program Files (x86)\Overwolf\0.304.0.11\win32\OWExplorerLauncher.dll pid=4040 gamelist=C:\Users\Admin\AppData\Local\Overwolf\Temp\gamelist.json"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Common Files\Overwolf\0.304.0.11\OverwolfHelper64.exe"C:\Program Files (x86)\Common Files\Overwolf\0.304.0.11\OverwolfHelper64.exe" "path=C:\Program Files (x86)\Overwolf\0.304.0.11\OWExplorerLauncher.dll pid=4040 gamelist=C:\Users\Admin\AppData\Local\Overwolf\Temp\gamelist.json"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Overwolf\0.304.0.11\OverwolfBrowser.exe"C:\Program Files (x86)\Overwolf\0.304.0.11\OverwolfBrowser.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Overwolf\CefBrowserCache" --locales-dir-path="C:\Program Files (x86)\Overwolf\0.304.0.11\Locales" --log-severity=disable --libcef-path="C:\Program Files (x86)\Overwolf\0.304.0.11\libcef.DLL" --uncaught-exception-stack-size=20 --owapp="Overwolf Remote Configurations - index" --ow-enable-features=osr-software-rendering,use-override-ad-domain-as-referrer,cef-native-ua,use-www-domain,backup-cef-cache,extension-validation,read-opk-from-memory --uid=ppagiehdogdjlomggmoejfamedbjggdggnjbilhe --ow-allow-internal --ow-permissions=64 --remote-allow-origins=* --ow-domain=www.overwolf.com --enable-owc --uid=ppagiehdogdjlomggmoejfamedbjggdggnjbilhe --ow-process-id=4040 --no-sandbox --js-flags=--expose-gc --enable-blink-features=AudioVideoTracks --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=7888,i,2123982585464569312,17452388835645860978,2097152 --field-trial-handle=5396,i,13075480521795329199,5824381683690015465,262144 --enable-features=AudioVideoTracks,IdleDetection --disable-features=HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --variations-seed-version --trace-process-track-uuid=3190708990997080739 --enable-logging=handle --log-file=7912 --mojo-platform-channel-handle=7908 /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Overwolf\0.304.0.11\OverwolfBrowser.exe"C:\Program Files (x86)\Overwolf\0.304.0.11\OverwolfBrowser.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Overwolf\CefBrowserCache" --locales-dir-path="C:\Program Files (x86)\Overwolf\0.304.0.11\Locales" --log-severity=disable --libcef-path="C:\Program Files (x86)\Overwolf\0.304.0.11\libcef.DLL" --uncaught-exception-stack-size=20 --owapp="Overwolf General GameEvents Provider - index.html" --ow-enable-features=osr-software-rendering,use-override-ad-domain-as-referrer,cef-native-ua,use-www-domain,backup-cef-cache,extension-validation,read-opk-from-memory --owtk=4756.1738723518796907072 --uid=ggfmakpbllghoepnmfelddbminamnbmfelbahfdp --ow-allow-internal --ow-permissions=272528 --remote-allow-origins=* --ow-domain=www.overwolf.com --enable-owc --uid=ggfmakpbllghoepnmfelddbminamnbmfelbahfdp --ow-process-id=4040 --no-sandbox --js-flags=--expose-gc --disable-gpu-compositing --enable-blink-features=AudioVideoTracks --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=7608,i,7548014091692819738,3541025164962462969,2097152 --field-trial-handle=5396,i,13075480521795329199,5824381683690015465,262144 --enable-features=AudioVideoTracks,IdleDetection --disable-features=HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --variations-seed-version --trace-process-track-uuid=3190708991934122588 --enable-logging=handle --log-file=8244 --mojo-platform-channel-handle=8240 /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Overwolf\0.304.0.11\OverwolfBrowser.exe"C:\Program Files (x86)\Overwolf\0.304.0.11\OverwolfBrowser.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Overwolf\CefBrowserCache" --locales-dir-path="C:\Program Files (x86)\Overwolf\0.304.0.11\Locales" --log-severity=disable --libcef-path="C:\Program Files (x86)\Overwolf\0.304.0.11\libcef.DLL" --uncaught-exception-stack-size=20 --owapp="Krabby Krew - background" --ow-enable-features=osr-software-rendering,use-override-ad-domain-as-referrer,cef-native-ua,use-www-domain,backup-cef-cache,extension-validation,read-opk-from-memory --uid=hkpfjaejdimnamfkgckpapcfkmoiamenagbcclie --ow-permissions=665840 --remote-allow-origins=* --ow-domain=www.overwolf.com --enable-owc --uid=hkpfjaejdimnamfkgckpapcfkmoiamenagbcclie --ow-process-id=4040 --no-sandbox --js-flags=--expose-gc --disable-gpu-compositing --enable-blink-features=AudioVideoTracks --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=8468,i,5332091152183822219,16398870942425375448,2097152 --field-trial-handle=5396,i,13075480521795329199,5824381683690015465,262144 --enable-features=AudioVideoTracks,IdleDetection --disable-features=HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --variations-seed-version --trace-process-track-uuid=3190708992871164437 --enable-logging=handle --log-file=8484 --mojo-platform-channel-handle=8480 /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Overwolf\0.304.0.11\OverwolfBrowser.exe"C:\Program Files (x86)\Overwolf\0.304.0.11\OverwolfBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Overwolf\CefBrowserCache" --locales-dir-path="C:\Program Files (x86)\Overwolf\0.304.0.11\Locales" --log-severity=disable --libcef-path="C:\Program Files (x86)\Overwolf\0.304.0.11\libcef.DLL" --remote-allow-origins=* --ow-domain=www.overwolf.com --ow-process-id=4040 --metrics-shmem-handle=9948,i,12249490240942267703,320685215796159537,524288 --field-trial-handle=5396,i,13075480521795329199,5824381683690015465,262144 --enable-features=AudioVideoTracks,IdleDetection --disable-features=HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --variations-seed-version --trace-process-track-uuid=3190708994745248135 --enable-logging=handle --log-file=10052 --mojo-platform-channel-handle=10056 /prefetch:83⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Overwolf\0.304.0.11\OverwolfBrowser.exe"C:\Program Files (x86)\Overwolf\0.304.0.11\OverwolfBrowser.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Overwolf\CefBrowserCache" --locales-dir-path="C:\Program Files (x86)\Overwolf\0.304.0.11\Locales" --log-severity=disable --libcef-path="C:\Program Files (x86)\Overwolf\0.304.0.11\libcef.DLL" --uncaught-exception-stack-size=20 --ow-enable-features=osr-software-rendering,use-override-ad-domain-as-referrer,cef-native-ua,use-www-domain,backup-cef-cache,extension-validation,read-opk-from-memory --remote-allow-origins=* --ow-domain=www.overwolf.com --enable-owc --disable-oopifs-console --ow-process-id=4040 --no-sandbox --js-flags=--expose-gc --disable-gpu-compositing --enable-blink-features=AudioVideoTracks --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=10144,i,11603260725126690023,12812933510574268713,2097152 --field-trial-handle=5396,i,13075480521795329199,5824381683690015465,262144 --enable-features=AudioVideoTracks,IdleDetection --disable-features=HeavyAdIntervention,HeavyAdPrivacyMitigations,LocalNetworkAccessChecks,PictureInPicture,ProcessSharingWithDefaultSiteInstances,SpareRendererForSitePerProcess,UseModernMediaControls,WinUseBrowserSpellChecker --variations-seed-version --trace-process-track-uuid=3190708996619331833 --enable-logging=handle --log-file=9424 --mojo-platform-channel-handle=9404 /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260620045142.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=524 -burn.filehandle.self=544 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260620045142.log"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{DCCD063A-F059-456D-AAC6-BA08E084235D} {E15FF2FC-94A5-4838-9F66-559378C7720F} 46524⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
C:\Program Files (x86)\Common Files\Overwolf\Teamspeak\OverwolfTSHelper.exe"C:\Program Files (x86)\Common Files\Overwolf\Teamspeak\OverwolfTSHelper.exe" -Embedding1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe"C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe" /RunningFrom SCM1⤵
- Drops file in System32 directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe"C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe" /RunningFrom FromService /SelfLaunched /OriginRunningFrom Overwolf2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe"C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe" -launchapp hkpfjaejdimnamfkgckpapcfkmoiamenagbcclie -from-desktop1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
e5a25ed.rbs
e5a25f9.rbs
e5a2600.rbs
e5a260f.rbs
OverwolfUpdater.InstallLog
OverwolfUpdater.InstallLog
hyph-af.hyb
hyph-as.hyb
hyph-hi.hyb
hyph-nb.hyb
manifest.json
SetupInfo.ini
CommandLine.dll
Microsoft.Web.WebView2.Core.dll
Microsoft.Web.WebView2.WinForms.dll
Newtonsoft.Json.dll
OWInstaller.exe
settings.dat
settings.dat
throttle_store.dat
the-real-index
the-real-index
the-real-index~RFe58cf61.TMP
data_1
data_0
data_2
data_3
MANIFEST-000001
Network Persistent State
Network Persistent State~RFe599745.TMP
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity~RFe59a81d.TMP
Preferences
Preferences
Preferences~RFe5918ed.TMP
CURRENT
Local State
Local State
Local State
Local State
Local State
Local State
Local State~RFe587a8a.TMP
OWinstaller.exe.config
OverWolf.Client.CommonUtils.dll
SharpRaven.dll
WebView2Loader.dll
messages.json
LatoLatin-Regular.woff
Montserrat-Bold.woff
icon.ico
index.html
app.js
block_inputs.js
cmp.bundle.js
notifications.js
analytics.js
commands.js
cookies.js
modal-events-delegate.js
strings-loader.js
utils.js
cri-controller.js
template.js
cris-controller.js
template.js
finish-with-recommended-app-controller.js
template.js
finish-controller.js
template.js
main-controller.js
template.js
modal-controller.js
privacy-controller.js
template.js
progress-1-controller.js
template.js
settings-controller.js
template.js
template.js
welcome-controller.js
manifest.json
log4net.dll
utils.dll
websocket-sharp.dll
hkpfjaejdimnamfkgckpapcfkmoiamenagbcclie.ico
f_000003
index
Preferences
Preferences~RFe5ab121.TMP
data_1
Local State
Local State
Local State~RFe5a6e7a.TMP
verified_contents.json
manifest.json
verified_contents.json
manifest.json
verified_contents.json
manifest.json
simple-io-plugin64.dll
verified_contents.json
manifest.json
verified_contents.json
SupportedGames.js
game_constants.js
hud_parser.js
backpack_items.js
weapons.js
english.js
french.js
german.js
italian.js
japanese.js
korean.js
languages.js
mspanish.js
polish.js
portuguese.js
russian.js
schinese.js
spanish.js
tchinese.js
main.js
plugin.js
plugin_whitelists.js
legend_select_manager.js
roster_manager.js
team_manager.js
supported_features.js
main.js
plugin.js
plugin_whitelist.js
supported_features.js
main.js
plugin.js
plugin_whitelist.js
supported_features.js
goop-all.json
codmw2-menu.bmp
game_e.bmp
game_n.bmp
game_ne.bmp
game_s.bmp
game_se.bmp
game_sw.bmp
game_w.bmp
ingame-mw2.bmp
victory.bmp
victory_ar.bmp
victory_du.bmp
victory_fr.bmp
victory_it.bmp
victory_po.bmp
victory_pr.bmp
victory_ru.bmp
victory_sp.bmp
main.js
plugin.js
plugin_whitelist.js
supported_features.js
gsi_manager.js
main.js
plugin.js
plugin_whitelist.js
supported_features.js
main.js
plugin.js
plugin_whitelist.js
supported_features.js
game_constants.js
main.js
plugin.js
plugin_whitelist.js
supported_features.js
main.js
plugin.js
plugin_whitelists.js
supported_features.js
main.js
plugin.js
plugin_whitelist.js
supported_features.js
DotaGsiEvents.js
DotaGsiListener.js
gsi_checks.js
hero_detection.js
main.js
plugin.js
plugin_whitelist.js
supported_features.js
log_listener.js
log_parser.js
main.js
plugin.js
plugin_whitelist.js
supported_features.js
main.js
plugin.js
plugin_whitelist.js
supported_features.js
game_state_manager.js
state_airfield.js
state_freefly.js
state_loading.js
state_lobby.js
state_replay.js
inventory_manager.js
log_listener.js
log_parser.js
main.js
plugin.js
plugin_whitelists.js
roster_manager.js
supported_features.js
log_listener.js
log_parser.js
main.js
plugin.js
plugin_whitelist.js
supported_features.js
adventure_stats_handler.js
decks_handler.js
log_configuration.js
log_listener.js
log_parser.js
main.js
plugin.js
plugin_whitelists.js
supported_features.js
log_listener.js
log_parser.js
main.js
plugin.js
plugin_whitelist.js
supported_features.js
lor_live_client_data.js
main.js
plugin.js
plugin_whitelist.js
supported_features.js
ARENA_handler.js
SummonerIdParser.js
SummonerInfoFetcher.js
TFT_handler.js
kill_event_handler.js
lol_live_client_data.js
main.js
match_fetcher.js
match_id_parser.js
crash_dmp_monitor.js
monitoring_util.js
plugin.js
plugin_whitelist.js
spectator_detection.js
supported_features.js
main.js
plugin.js
plugin_whitelists.js
supported_features.js
game_constants.js
main.js
plugin.js
plugin_whitelist.js
supported_features.js
main.js
plugin.js
plugin_whitelist.js
main.js
plugin.js
plugin_whitelist.js
main.js
plugin.js
plugin_whitelists.js
supported_features.js
main.js
native_sdk_game.js
log_listener.js
main.js
plugin.js
plugin_whitelist.js
supported_features.js
game_constants.js
main.js
plugin.js
plugin_whitelist.js
supported_features.js
main.js
plugin.js
plugin_whitelist.js
supported_features.js
game_constants.js
main.js
plugin.js
plugin_whitelists.js
supported_features.js
game_constants.js
main.js
plugin.js
plugin_whitelists.js
supported_features.js
log_listener.js
log_parser.js
main.js
plugin.js
plugin_whitelist.js
supported_features.js
game-state.js
game_state_manager.js
state_aircraft.js
state_airfield.js
state_freefly.js
state_landed.js
state_loading.js
state_lobby.js
state_starting.js
main.js
plugin.js
plugin_whitelists.js
roster_manager.js
supported_features.js
logs_manager.js
main.js
plugin.js
plugin_whitelists.js
roster_manager.js
supported_features.js
log_listener.js
log_parser.js
main.js
plugin.js
plugin_whitelist.js
supported_features.js
experience_tracker.js
goop-config.json
goop_universe_ids.js
log_listener.js
log_parser.js
main.js
plugin.js
plugin_whitelist.js
supported_features.js
main.js
playerFetcher.js
playersInfoService.js
plugin.js
plugin_whitelist.js
roster-handler.js
supported_features.js
victory-defeat-handler.js
log_listener.js
log_parser.js
main.js
plugin.js
plugin_whitelist.js
supported_features.js
GameService.js
PluginHandler.js
main.js
plugin.js
plugin_whitelist.js
supported_features.js
goop-config.json
log_listener.js
log_parser.js
main.js
plugin.js
plugin_whitelist.js
supported_features.js
main.js
plugin.js
plugin_whitelist.js
supported_features.js
tracking_config.js
crash_dmp_monitor.js
eligibility-tester.js
game_constants.js
log_listener.js
log_parser.js
main.js
plugin.js
plugin_whitelist.js
supported_features.js
goop-config.json
champion_hill.bmp
death-bright-vg.bmp
death-vg.bmp
dt_arms_race.bmp
goop.json
ingame-vg.bmp
kill-high-vg.bmp
kill-vg.bmp
lobby-coin-vg.bmp
mode-control.bmp
mode-domination.bmp
mode-freeforall.bmp
mode-hardpoint.bmp
mode-kill-confirmed.bmp
mode-patrol.bmp
mode-search-destroy.bmp
mode-team-deathmatch.bmp
main.js
plugin.js
plugin_whitelist.js
supported_features.js
goop-config.json
main.js
plugin.js
goop-config.json
main.js
plugin.js
goop-config.json
main.js
codmw3-menu.bmp
mw3.bmp
victory.bmp
victory_ar.bmp
victory_du.bmp
victory_fr.bmp
victory_it.bmp
victory_po.bmp
victory_ru.bmp
victory_sp.bmp
plugin.js
goop-config.json
main.js
plugin.js
goop-config.json
main.js
plugin.js
general_plugin_whitelist.js
general_supported_features.js
goop-config.json
main.js
plugin.js
goop-config.json
main.js
plugin.js
goop-config.json
main.js
plugin.js
goop-config.json
main.js
plugin.js
goop-config.json
main.js
plugin.js
goop-config.json
main.js
plugin.js
goop-config.json
main.js
plugin.js
goop-config.json
main.js
plugin.js
goop-config.json
main.js
plugin.js
goop-config.json
main.js
plugin.js
goop-config.json
main.js
plugin.js
log_listener.js
log_parser.js
main.js
plugin.js
plugin_whitelist.js
supported_features.js
main.js
plugin.js
plugin_whitelist.js
supported_features.js
log_listener.js
log_parser.js
main.js
plugin.js
plugin_whitelist.js
supported_features.js
xko_live_client_data.js
index.html
bundle.min.js
js-uuid.js
marmottajax.js
require.min.js
underscore-min.js
main.js
manifest.json
gep_hearthstone.dll
libowgameevents.dll
gep_2xko.dll
gep_apex.dll
gep_arknights.dll
gep_bedrock.dll
gep_bg3.dll
gep_cs2ext.dll
gep_darkndarker.dll
gep_deadlock.dll
gep_diablo.dll
gep_diablo4.dll
gep_dota.dll
gep_finalxiv.dll
gep_fortnite.dll
gep_genshinimpact.dll
gep_leaguex64.dll
gep_lolarena.dll
gep_lostark.dll
gep_marvelrivals.dll
gep_minecraft.dll
gep_mtga.dll
gep_newworld.dll
gep_overwatch2.dll
gep_palworld.dll
gep_pathofexile.dll
gep_poe2.dll
gep_pubg.dll
gep_rainbowsixsiege.dll
gep_rematch.dll
gep_rl.dll
gep_schedule.dll
gep_sotf.dll
gep_supervive.dll
gep_tarkov.dll
gep_tftx64.dll
gep_valorant.dll
gep_warframeext.dll
gep_wow.dll
gep_xfortnite.dll
libowgameevents64.dll
GEPPlugin.dll
GEPPlugin64.dll
OwDota2GameEvents.dll
experimental-plugin.dll
simple-io-plugin.dll
vgep.dll
FeaturesHandler.js
gsi_client.js
gsi_utils.js
HashesListener.js
InfoDBContainer.js
ac_monitor.js
analytics.js
base_utils.js
batch_tracking.js
game_events_monitor.js
game_monitoring_util.js
game_native_monitoring_util.js
gep_internal_info_tracker.js
goop_installer.js
io_plugin.js
monitoring_statics.js
overwolfPlugin.js
ow-api.js
path_utils.js
game_plugin.js
game_plugin_base.js
game_plugin_gep.js
game_plugin_goop.js
plugin_constants.js
plugin_type.js
registry_utils.js
simple_event.js
version_compare.js
wait_for_stable_fps.js
verified_contents.json
manifest.json
avcodec-61.dll
avdevice-61.dll
avfilter-10.dll
avformat-61.dll
avutil-59.dll
concrt140.dll
ffmpeg.exe
ffprobe.exe
libcurl.dll
libobs-d3d11.dll
libobs-opengl.dll
libobs-winrt.dll
librist.dll
libx264-164.dll
msvcp140.dll
msvcp140_1.dll
msvcp140_2.dll
obs-amf-test.exe
obs-nvenc-test.exe
obs-qsv-test.exe
obs-scripting.dll
obs.dll
ow-obs.exe
owobs-ffmpeg-mux.exe
postproc-58.dll
srt.dll
swresample-5.dll
swscale-8.dll
vcruntime140.dll
vcruntime140_1.dll
w32-pthreads.dll
zlib.dll
area.effect
bicubic_scale.effect
bilinear_lowres_scale.effect
color.effect
default.effect
default_rect.effect
deinterlace_base.effect
deinterlace_blend.effect
deinterlace_blend_2x.effect
deinterlace_discard.effect
deinterlace_discard_2x.effect
deinterlace_linear.effect
deinterlace_linear_2x.effect
deinterlace_yadif.effect
deinterlace_yadif_2x.effect
format_conversion.effect
lanczos_scale.effect
opaque.effect
premultiplied_alpha.effect
repeat.effect
solid.effect
grayscale.cube
original.cube
blend_add_filter.effect
blend_mul_filter.effect
blend_sub_filter.effect
chroma_key_filter.effect
chroma_key_filter_v2.effect
color.effect
color_correction_filter.effect
color_grade_filter.effect
color_key_filter.effect
color_key_filter_v2.effect
crop_filter.effect
hdr_tonemap_filter.effect
luma_key_filter.effect
luma_key_filter_v2.effect
mask_alpha_filter.effect
mask_color_filter.effect
rtx_greenscreen.effect
sharpness.effect
fade_to_color_transition.effect
fade_transition.effect
luma_wipe_transition.effect
slide_transition.effect
stinger_matte_transition.effect
swipe_transition.effect
get-graphics-offsets32.exe
get-graphics-offsets64.exe
inject-helper32.exe
inject-helper64.exe
ow-graphics-hook32.dll
ow-graphics-hook64.dll
coreaudio-encoder.dll
image-source.dll
obs-ffmpeg.dll
obs-filters.dll
obs-nvenc.dll
obs-outputs.dll
obs-qsv11.dll
obs-transitions.dll
obs-x264.dll
rtmp-services.dll
win-capture.dll
win-dshow.dll
win-wasapi.dll
sprite.svg
verified_contents.json
ftue.webm
no_results.svg
check.svg
single-star.svg
slim-star.svg
stars.svg
subscription-bubble.svg
manifest.json
sprite.svg
wolfeye.svg
colors.scss
style.scss
error-view.scss
in-app-subs-main-window.scss
login-signup-form.scss
mini-profile-view.scss
subscription-window.scss
verification-window.scss
verified_contents.json
manifest.json
downloader.dll
simple-io-plugin.dll
sprite.svg
verified_contents.json
manifest.json
CSBlacklist.txt
IconMouseNormal.png
verified_contents.json
browser_rules.json
butils.dll
encoder_blacklist.json
extensions.json
features.json
Lato-Bold.woff2
Lato-Regular.woff2
sprite.svg
diablo4.js
experiment-patch.js
fortnite.js
index.html
index.js
lolpbe.js
lor.js
notification-style.css
notification.html
notification.js
notification.scss
notification.ts
io-plugin.js
vulkan-patch.js
general.json
gradar.json
hardware.json
hcm.json
highlights.json
manifest.json
simple-io-plugin.dll
index.html.log
index.html.log
index.html.log
index.html.log
index.html.log
InGameNotificationWindow.html.log
background.html.log
InstallerTrace_2026-06-20_04-50_4044.log
InstallerTrace_2026-06-20_04-50_4044.log
OWLog.cfg
Trace_2026-06-20_04-51_4040.log
app.opk
icon.ico
app.opk
SettingsPageBasic.xml
SettingsPageBasic.xml
SettingsPageBasic.xml
SettingsPageGeneral.xml
SettingsPageGeneral.xml
SettingsPageGeneral.xml
SettingsPageGeneral.xml
SettingsPageGeneral.xml
SettingsPageGeneral.xml
SettingsPageGeneral.xml
SettingsPageGeneral.xml
SettingsPageGeneral.xml.bak
SettingsPageGeneral.xml.bak
SettingsPageGeneral.xml.bak
000002.dbtmp
no-apps-icon.svg
SoundCheck_Drop.mp3
SoundCheck_PewPew.mp3
montserrat-500.woff2
montserrat-600.woff2
montserrat-700.woff2
montserrat-900.woff2
montserrat-regular.woff2
default_flag.png
search.svg
dev.svg
overwolf-text.svg
avatar-placeholder.svg
error.webp
chinese.svg
english.svg
french.svg
german.svg
italian.svg
japanese.svg
korean.svg
polish.svg
portuguese.svg
russian.svg
spanish.svg
turkish.svg
vietnamese.svg
more-info.svg
no-apps-icon.webp
no-capture-apps.svg
no-capture-apps.webp
no-games.svg
no-games.webp
no-results.svg
no-results.webp
no-subs.webp
owlogo.svg
permission.svg
screen-light-leg.svg
screen.svg
sprite.svg
subscription-bubblicon.svg
triangle-arrow.svg
supported_features.js
ingame-mw3.bmp
victory_pt.bmp
icon.png
DotNetZip-b5cmkxqe.tmp
KlavikaWebBasicLight.woff
KlavikaWebBasicMedium.woff
KlavikaWebBasicRegular.woff
cs-go-scout.png
dota-plus.png
hearth-arena-companion.png
hero-watch.png
lolwiz.png
tokens.css
support_taskbar_icon.png
desktopNotificationWindow.850454c8.js.LICENSE.txt
manifest.json
friendsListWindow.9863b5b0.css
inGameNotificationWindow.8ed7c3b1.css
taskbar_icon.png
IconMouseOver.png
background.js.LICENSE.txt
IconMouseOver.png
store-bg-blurred.jpg
giveaways.html
LatoLatin-Bold.woff2
LatoLatin-Regular.woff2
heart-sprite.png
eye-animation.webm
shield_animation.webm
gate_open.webm
gate_open_loop.webm
INetC.dll
System.dll
UserInfo.dll
uac.dll
nsExec.dll
nsisunz.dll
e5a25fa.msi
wixstdba.dll
license.rtf
thm.wxl
thm.xml
logo.png
VC_redist.x64.exe
memory/408-2113-0x0000000000740000-0x00000000007B7000-memory.dmp
memory/1528-402-0x000001AB81AE0000-0x000001AB81AE1000-memory.dmp
memory/1528-404-0x000001AB81AE0000-0x000001AB81AE1000-memory.dmp
memory/1528-392-0x000001AB81AE0000-0x000001AB81AE1000-memory.dmp
memory/1528-398-0x000001AB81AE0000-0x000001AB81AE1000-memory.dmp
memory/1528-399-0x000001AB81AE0000-0x000001AB81AE1000-memory.dmp
memory/1528-394-0x000001AB81AE0000-0x000001AB81AE1000-memory.dmp
memory/1528-400-0x000001AB81AE0000-0x000001AB81AE1000-memory.dmp
memory/1528-401-0x000001AB81AE0000-0x000001AB81AE1000-memory.dmp
memory/1528-393-0x000001AB81AE0000-0x000001AB81AE1000-memory.dmp
memory/1528-403-0x000001AB81AE0000-0x000001AB81AE1000-memory.dmp
memory/1904-232-0x00007FFFFEDC0000-0x00007FFFFEDC1000-memory.dmp
memory/1904-466-0x000002CD36940000-0x000002CD369DB000-memory.dmp
memory/2248-1653-0x000002F924A90000-0x000002F924B10000-memory.dmp
memory/2428-470-0x000001309BE10000-0x000001309BEAB000-memory.dmp
memory/3360-2112-0x0000000000740000-0x00000000007B7000-memory.dmp
memory/4040-2490-0x00007FFFFFBF0000-0x00007FFFFFBF5000-memory.dmp
memory/4040-2515-0x00007FFFFFD20000-0x00007FFFFFD25000-memory.dmp
memory/4040-1703-0x000000001CDD0000-0x000000001CDDA000-memory.dmp
memory/4040-1676-0x00007FFFFD950000-0x00007FFFFD952000-memory.dmp
memory/4040-1702-0x000000001CDE0000-0x000000001CE4A000-memory.dmp
memory/4040-1737-0x000000001CEA0000-0x000000001CEA8000-memory.dmp
memory/4040-1674-0x00007FFFFFBA0000-0x00007FFFFFBA5000-memory.dmp
memory/4040-1742-0x0000000020770000-0x0000000020EDA000-memory.dmp
memory/4040-1743-0x000000001F4D0000-0x000000001F4E2000-memory.dmp
memory/4040-1744-0x000000001CFF0000-0x000000001CFF8000-memory.dmp
memory/4040-1793-0x0000000020580000-0x000000002058A000-memory.dmp
memory/4040-6573-0x000000003C2F0000-0x000000003C441000-memory.dmp
memory/4040-1781-0x000000001F5F0000-0x000000001F600000-memory.dmp
memory/4040-9804-0x0000000027AA0000-0x0000000027AA6000-memory.dmp
memory/4040-9648-0x0000000045450000-0x0000000045458000-memory.dmp
memory/4040-9587-0x000000004B9A0000-0x000000004B9E0000-memory.dmp
memory/4040-1780-0x00000000205A0000-0x00000000205B4000-memory.dmp
memory/4040-1779-0x000000001F570000-0x000000001F578000-memory.dmp
memory/4040-1778-0x000000001F590000-0x000000001F5A2000-memory.dmp
memory/4040-1683-0x00007FFFFFBD0000-0x00007FFFFFBD2000-memory.dmp
memory/4040-1745-0x000000001F530000-0x000000001F56C000-memory.dmp
memory/4040-1748-0x00000000204F0000-0x0000000020534000-memory.dmp
memory/4040-2152-0x0000000023200000-0x000000002325E000-memory.dmp
memory/4040-2262-0x0000000022F80000-0x0000000022F88000-memory.dmp
memory/4040-2263-0x0000000022F90000-0x0000000022F9A000-memory.dmp
memory/4040-2264-0x0000000022FE0000-0x0000000022FEE000-memory.dmp
memory/4040-2265-0x0000000027800000-0x00000000278F2000-memory.dmp
memory/4040-1686-0x00007FFFFFBC0000-0x00007FFFFFBC5000-memory.dmp
memory/4040-2488-0x00007FFFFFBE0000-0x00007FFFFFBE5000-memory.dmp
memory/4040-2489-0x00007FFFFD960000-0x00007FFFFD965000-memory.dmp
memory/4040-1678-0x00007FFFFD940000-0x00007FFFFD945000-memory.dmp
memory/4040-2492-0x00007FFFFF960000-0x00007FFFFF965000-memory.dmp
memory/4040-2494-0x00007FFFFF980000-0x00007FFFFF985000-memory.dmp
memory/4040-7944-0x000000003F050000-0x000000003F058000-memory.dmp
memory/4040-7945-0x0000000045470000-0x00000000454A8000-memory.dmp
memory/4040-7946-0x000000003F070000-0x000000003F07E000-memory.dmp
memory/4040-7961-0x0000000045460000-0x0000000045468000-memory.dmp
memory/4040-8012-0x00000000454F0000-0x00000000454FA000-memory.dmp
memory/4040-2496-0x00007FFFFFC00000-0x00007FFFFFC05000-memory.dmp
memory/4040-2498-0x00007FFFFFC20000-0x00007FFFFFC25000-memory.dmp
memory/4040-2500-0x00007FFFFFC40000-0x00007FFFFFC45000-memory.dmp
memory/4040-2502-0x00007FFFFFC60000-0x00007FFFFFC65000-memory.dmp
memory/4040-2504-0x00007FFFFFC80000-0x00007FFFFFC85000-memory.dmp
memory/4040-2506-0x00007FFFFFCA0000-0x00007FFFFFCA5000-memory.dmp
memory/4040-2508-0x00007FFFFFCC0000-0x00007FFFFFCC5000-memory.dmp
memory/4040-2510-0x00007FFFFFCE0000-0x00007FFFFFCE5000-memory.dmp
memory/4040-2514-0x00007FFFFFD30000-0x00007FFFFFD32000-memory.dmp
memory/4040-2513-0x00007FFFFFD00000-0x00007FFFFFD05000-memory.dmp
memory/4040-2511-0x00007FFFFFD10000-0x00007FFFFFD12000-memory.dmp
memory/4040-1704-0x000000001CE90000-0x000000001CE9A000-memory.dmp
memory/4040-1697-0x00007FF755770000-0x00007FF755784000-memory.dmp
memory/4040-2533-0x00007FFFFE950000-0x00007FFFFE955000-memory.dmp
memory/4040-2556-0x000000003E5B0000-0x000000003E5D8000-memory.dmp
memory/4040-2562-0x000000003C2F0000-0x000000003C441000-memory.dmp
memory/4040-2561-0x000000001C550000-0x000000001C5D3000-memory.dmp
memory/4040-1750-0x000000001F5B0000-0x000000001F5E6000-memory.dmp
memory/4040-8958-0x000000003C2F0000-0x000000003C441000-memory.dmp
memory/4040-1751-0x000000001F510000-0x000000001F51C000-memory.dmp
memory/4040-8737-0x0000000046D40000-0x0000000046D50000-memory.dmp
memory/4040-1765-0x0000000020540000-0x000000002057C000-memory.dmp
memory/4040-1782-0x00000000206F0000-0x0000000020734000-memory.dmp
memory/4040-1699-0x000000001C8C0000-0x000000001C96A000-memory.dmp
memory/4040-1700-0x000000001CEB0000-0x000000001CFE8000-memory.dmp
memory/4040-8467-0x0000000046D30000-0x0000000046D3E000-memory.dmp
memory/4044-146-0x00000221FBAB0000-0x00000221FBB04000-memory.dmp
memory/4044-150-0x00000221FE090000-0x00000221FE13A000-memory.dmp
memory/4044-154-0x00000221FE2A0000-0x00000221FE2B0000-memory.dmp
memory/4044-1398-0x00000221FD7F0000-0x00000221FD86A000-memory.dmp
memory/4044-449-0x00000221FE2A0000-0x00000221FE2B0000-memory.dmp
memory/4044-1667-0x00000221FD7A0000-0x00000221FD7C4000-memory.dmp
memory/4044-204-0x00000221FE620000-0x00000221FE62E000-memory.dmp
memory/4044-160-0x00000221FD730000-0x00000221FD748000-memory.dmp
memory/4044-201-0x00000221FF650000-0x00000221FF672000-memory.dmp
memory/4044-156-0x00000221FDF40000-0x00000221FDF86000-memory.dmp
memory/4044-153-0x00000221FE670000-0x00000221FEB98000-memory.dmp
memory/4044-197-0x00000221FF6E0000-0x00000221FF770000-memory.dmp
memory/4044-152-0x00000221FD670000-0x00000221FD684000-memory.dmp
memory/4044-171-0x00000221FE3B0000-0x00000221FE460000-memory.dmp
memory/4504-297-0x00007FFFFEDC0000-0x00007FFFFEDC1000-memory.dmp
memory/4504-467-0x000001F72AA10000-0x000001F72AAAB000-memory.dmp
memory/4792-2325-0x000001ED29430000-0x000001ED29468000-memory.dmp
memory/4980-285-0x00007FFFFF5F0000-0x00007FFFFF5F1000-memory.dmp
memory/4980-286-0x00007FFFFF270000-0x00007FFFFF271000-memory.dmp
memory/5512-1242-0x0000000002760000-0x000000000277D000-memory.dmp
memory/5696-2110-0x0000000000740000-0x00000000007B7000-memory.dmp
memory/5952-2123-0x00000254F6990000-0x00000254F6991000-memory.dmp
memory/5952-2119-0x00000254F6990000-0x00000254F6991000-memory.dmp
memory/5952-2124-0x00000254F6990000-0x00000254F6991000-memory.dmp
memory/5952-2115-0x00000254F6990000-0x00000254F6991000-memory.dmp
memory/5952-2117-0x00000254F6990000-0x00000254F6991000-memory.dmp
memory/5952-2122-0x00000254F6990000-0x00000254F6991000-memory.dmp
memory/5952-2116-0x00000254F6990000-0x00000254F6991000-memory.dmp
memory/5952-2120-0x00000254F6990000-0x00000254F6991000-memory.dmp
memory/5952-2121-0x00000254F6990000-0x00000254F6991000-memory.dmp
memory/5980-1291-0x000002F154640000-0x000002F15488C000-memory.dmp
memory/6092-1378-0x0000026CD01A0000-0x0000026CD01D4000-memory.dmp
memory/6092-1350-0x0000026CD0160000-0x0000026CD019C000-memory.dmp
memory/6092-1349-0x0000026CD0100000-0x0000026CD0112000-memory.dmp
memory/7240-8168-0x000001ECFDDF0000-0x000001ECFDFB2000-memory.dmp
memory/8036-9805-0x000001CD328A0000-0x000001CD328BA000-memory.dmp