Technical Information
Modifies file system
Creates the following files
- %TEMP%\nsef62f.tmp\userinfo.dll
- %TEMP%\nsef62f.tmp\app\js\utils\cookies.js
- %TEMP%\nsef62f.tmp\app\js\utils\commands.js
- %TEMP%\nsef62f.tmp\app\js\utils\analytics.js
- %TEMP%\nsef62f.tmp\app\js\models\notifications.js
- %TEMP%\nsef62f.tmp\app\js\libs\jquery-1.10.2.min.js
- %TEMP%\nsef62f.tmp\app\js\libs\cmp.bundle.js
- %TEMP%\nsef62f.tmp\app\js\block_inputs.js
- %TEMP%\nsef62f.tmp\app\js\app.js
- %TEMP%\nsef62f.tmp\app\images\welcome-logo.png
- %TEMP%\nsef62f.tmp\app\images\v-check.png
- %TEMP%\nsef62f.tmp\app\images\tile-fallback.png
- %TEMP%\nsef62f.tmp\app\images\progress-app-image-03.png
- %TEMP%\nsef62f.tmp\app\js\utils\strings-loader.js
- %TEMP%\nsef62f.tmp\app\images\progress-app-image-02.png
- %TEMP%\nsef62f.tmp\app\images\progress-app-image-01.png
- %TEMP%\nsef62f.tmp\app\images\progress-02.png
- %TEMP%\nsef62f.tmp\app\images\progress-01-overwolf.png
- %TEMP%\nsef62f.tmp\app\images\plus.png
- %TEMP%\nsef62f.tmp\app\images\more-info.png
- %TEMP%\nsef62f.tmp\app\images\minimize-normal.png
- %TEMP%\nsef62f.tmp\app\images\minimize-hover.png
- %TEMP%\nsef62f.tmp\app\images\large-logo.png
- %TEMP%\nsef62f.tmp\app\images\icon.ico
- %TEMP%\nsef62f.tmp\app\images\small-logo.png
- %TEMP%\nsef62f.tmp\app\css\reset.css
- %TEMP%\nsef62f.tmp\app\js\utils\utils.js
- %LOCALAPPDATA%\overwolf\installercache\welcometextheader_0_en.png
- %LOCALAPPDATA%\overwolf\installercache\welcomebackground_0.jpg
- %LOCALAPPDATA%\overwolf\settings\bak\settingspagebasic.xml.bak
- %LOCALAPPDATA%\overwolf\settings\settingspagebasic.xml
- %LOCALAPPDATA%\overwolf\installercache\owresources.dll
- %LOCALAPPDATA%\overwolf\log\installertrace_2920_2020-06-18_14-04.log
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %TEMP%\nsef62f.tmp\app\js\windows\welcome\welcome-controller.js
- %TEMP%\nsef62f.tmp\app\js\windows\welcome\template.js
- %TEMP%\nsef62f.tmp\app\js\windows\settings\template.js
- %TEMP%\nsef62f.tmp\app\images\icon-fallback.png
- %TEMP%\nsef62f.tmp\app\js\utils\modal-events-delegate.js
- %TEMP%\nsef62f.tmp\app\js\windows\progress\progress-1-controller.js
- %TEMP%\nsef62f.tmp\app\js\windows\privacy\template.js
- %TEMP%\nsef62f.tmp\app\js\windows\privacy\privacy-controller.js
- %TEMP%\nsef62f.tmp\app\js\windows\modal\modal-controller.js
- %TEMP%\nsef62f.tmp\app\js\windows\main\template.js
- %TEMP%\nsef62f.tmp\app\js\windows\main\main-controller.js
- %TEMP%\nsef62f.tmp\app\js\windows\finish-with-recommended-app\template.js
- %TEMP%\nsef62f.tmp\app\js\windows\finish-with-recommended-app\finish-with-recommended-app-controller.js
- %TEMP%\nsef62f.tmp\app\js\windows\finish\template.js
- %TEMP%\nsef62f.tmp\app\js\windows\finish\finish-controller.js
- %TEMP%\nsef62f.tmp\app\js\windows\cri\template.js
- %TEMP%\nsef62f.tmp\app\js\windows\progress\template.js
- %TEMP%\nsef62f.tmp\app\js\windows\cri\cri-controller.js
- %TEMP%\nsef62f.tmp\app\images\header-logo.png
- %TEMP%\nsef62f.tmp\app\images\gs-placeholder.png
- %TEMP%\nsef62f.tmp\app\images\game-summary-logo-55px.png
- %TEMP%\nsef62f.tmp\app\_locales\de\messages.json
- %TEMP%\nsef62f.tmp\app\_locales\vi\messages.json
- %TEMP%\nsef62f.tmp\app\_locales\tr\messages.json
- %TEMP%\nsef62f.tmp\app\_locales\ru\messages.json
- %TEMP%\nsef62f.tmp\app\_locales\pt\messages.json
- %TEMP%\nsef62f.tmp\app\_locales\pl\messages.json
- %TEMP%\nsef62f.tmp\app\_locales\ko\messages.json
- %TEMP%\nsef62f.tmp\app\_locales\ja\messages.json
- %TEMP%\nsef62f.tmp\app\_locales\it\messages.json
- %TEMP%\nsef62f.tmp\app\_locales\fr\messages.json
- %TEMP%\nsef62f.tmp\app\_locales\es\messages.json
- %LOCALAPPDATA%\overwolf\installercache\welcometextheader_0_de.png
- %TEMP%\nsef62f.tmp\app\assets\fonts\klavika\klavikawebbasicmedium.eot
- %TEMP%\nsef62f.tmp\app\progress.html
- %TEMP%\nsef62f.tmp\app\manifest.json
- %TEMP%\nsef62f.tmp\app\index.html
- %TEMP%\nsef62f.tmp\app\cmp.html
- %TEMP%\nsef62f.tmp\nsis7z.dll
- %TEMP%\nsef62f.tmp\utils.dll
- %TEMP%\nsef62f.tmp\owinstaller.exe.config
- %TEMP%\nsef62f.tmp\owinstaller.exe
- %TEMP%\nsef62f.tmp\inetc.dll
- %TEMP%\nsef62f.tmp\uac.dll
- %TEMP%\nsef62f.tmp\system.dll
- %TEMP%\nsef62f.tmp\app\_locales\en\messages.json
- %TEMP%\nsef62f.tmp\app\js\windows\settings\settings-controller.js
- %TEMP%\nsef62f.tmp\app\assets\fonts\klavika\klavikawebbasicregular.eot
- %TEMP%\nsef62f.tmp\app\css\finish-with-gs.css
- %TEMP%\nsef62f.tmp\app\assets\fonts\lato\latolatin-regular.eot
- %TEMP%\nsef62f.tmp\app\images\game-summary-logo-48px.png
- %TEMP%\nsef62f.tmp\app\images\game-summary-logo-40px.png
- %TEMP%\nsef62f.tmp\app\images\close-normal.png
- %TEMP%\nsef62f.tmp\app\images\close-hover.png
- %TEMP%\nsef62f.tmp\app\images\checkbox-checked.png
- %TEMP%\nsef62f.tmp\app\images\bottom-arrow.png
- %TEMP%\nsef62f.tmp\app\images\bottom-arrow-hover.png
- %TEMP%\nsef62f.tmp\app\images\big-icon-fallback.png
- %TEMP%\nsef62f.tmp\app\css\welcome.css
- %TEMP%\nsef62f.tmp\app\css\welcome-general.css
- %TEMP%\nsef62f.tmp\app\css\cri.css
- %TEMP%\nsef62f.tmp\app\css\style.css
- %TEMP%\nsef62f.tmp\app\_locales\zh\messages.json
- %TEMP%\nsef62f.tmp\app\css\progress.css
- %TEMP%\nsef62f.tmp\app\css\privacy.css
- %TEMP%\nsef62f.tmp\app\css\notification.css
- %TEMP%\nsef62f.tmp\app\css\header.css
- %TEMP%\nsef62f.tmp\app\css\gs-b.css
- %TEMP%\nsef62f.tmp\app\css\gs-a.css
- %TEMP%\nsef62f.tmp\app\css\footer.css
- %TEMP%\nsef62f.tmp\app\css\fonts.css
- %TEMP%\nsef62f.tmp\app\css\finish.css
- %TEMP%\nsef62f.tmp\app\css\finish-with-recommended-app.css
- %TEMP%\nsef62f.tmp\app\css\settings.css
- %LOCALAPPDATA%\overwolf\installercache\welcometextheader_0_pt.png
Deletes the following files
- %LOCALAPPDATA%\overwolf\settings\bak\settingspagebasic.xml.bak
Substitutes the following files
- %LOCALAPPDATA%\overwolf\settings\bak\settingspagebasic.xml.bak
Network activity
TCP
HTTP GET requests
- http://an######snew.overwolf.com/analytics/Counter?Na######################################################################################################################
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://an######snew.overwolf.com/analytics/Counter?Cu############################################################################################################################################...
- http://www.go#####analytics.com/__utm.gif?ut#####################################################################################################################################################...
UDP
- DNS ASK an######snew.overwolf.com
- DNS ASK go#####analytics.com
Miscellaneous
Searches for the following windows
- ClassName: 'MPWClass' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\nsef62f.tmp\owinstaller.exe' Channel=website&Extension=ickccnpponhhndcdifkkhefenihjcjbbikkeamhk&Name=Legendary%20Builds&Sel=1 -partnerCustomizationLevel 0 -exepath <Full path to file>
Executes the following
- '%WINDIR%\syswow64\dxdiag.exe' /t%LOCALAPPDATA%\Overwolf\Temp\DxDiagOutput.txt
