Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\nsj4e90.tmp\userinfo.dll
- %TEMP%\nsj4e90.tmp\app\js\utils\cookies.js
- %TEMP%\nsj4e90.tmp\app\js\utils\commands.js
- %TEMP%\nsj4e90.tmp\app\js\utils\analytics.js
- %TEMP%\nsj4e90.tmp\app\js\models\notifications.js
- %TEMP%\nsj4e90.tmp\app\js\libs\jquery-1.10.2.min.js
- %TEMP%\nsj4e90.tmp\app\js\libs\cmp.bundle.js
- %TEMP%\nsj4e90.tmp\app\js\block_inputs.js
- %TEMP%\nsj4e90.tmp\app\js\app.js
- %TEMP%\nsj4e90.tmp\app\images\welcome-logo.png
- %TEMP%\nsj4e90.tmp\app\images\v-check.png
- %TEMP%\nsj4e90.tmp\app\images\tile-fallback.png
- %TEMP%\nsj4e90.tmp\app\images\progress-app-image-03.png
- %TEMP%\nsj4e90.tmp\app\js\utils\strings-loader.js
- %TEMP%\nsj4e90.tmp\app\images\progress-app-image-02.png
- %TEMP%\nsj4e90.tmp\app\images\progress-app-image-01.png
- %TEMP%\nsj4e90.tmp\app\images\progress-02.png
- %TEMP%\nsj4e90.tmp\app\images\progress-01-overwolf.png
- %TEMP%\nsj4e90.tmp\app\images\plus.png
- %TEMP%\nsj4e90.tmp\app\images\more-info.png
- %TEMP%\nsj4e90.tmp\app\images\minimize-normal.png
- %TEMP%\nsj4e90.tmp\app\images\minimize-hover.png
- %TEMP%\nsj4e90.tmp\app\images\large-logo.png
- %TEMP%\nsj4e90.tmp\app\images\icon.ico
- %TEMP%\nsj4e90.tmp\app\images\small-logo.png
- %TEMP%\nsj4e90.tmp\app\css\reset.css
- %TEMP%\nsj4e90.tmp\app\js\utils\utils.js
- %LOCALAPPDATA%\overwolf\installercache\welcometextheader_0_en.png
- %LOCALAPPDATA%\overwolf\installercache\welcomebackground_0.jpg
- %LOCALAPPDATA%\overwolf\settings\bak\settingspagebasic.xml.bak
- %LOCALAPPDATA%\overwolf\settings\settingspagebasic.xml
- %LOCALAPPDATA%\overwolf\installercache\owresources.dll
- %LOCALAPPDATA%\overwolf\log\installertrace_2204_2020-07-31_13-16.log
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %TEMP%\nsj4e90.tmp\app\js\windows\welcome\welcome-controller.js
- %TEMP%\nsj4e90.tmp\app\js\windows\welcome\template.js
- %TEMP%\nsj4e90.tmp\app\js\windows\settings\template.js
- %TEMP%\nsj4e90.tmp\app\images\icon-fallback.png
- %TEMP%\nsj4e90.tmp\app\js\utils\modal-events-delegate.js
- %TEMP%\nsj4e90.tmp\app\js\windows\progress\progress-1-controller.js
- %TEMP%\nsj4e90.tmp\app\js\windows\privacy\template.js
- %TEMP%\nsj4e90.tmp\app\js\windows\privacy\privacy-controller.js
- %TEMP%\nsj4e90.tmp\app\js\windows\modal\modal-controller.js
- %TEMP%\nsj4e90.tmp\app\js\windows\main\template.js
- %TEMP%\nsj4e90.tmp\app\js\windows\main\main-controller.js
- %TEMP%\nsj4e90.tmp\app\js\windows\finish-with-recommended-app\template.js
- %TEMP%\nsj4e90.tmp\app\js\windows\finish-with-recommended-app\finish-with-recommended-app-controller.js
- %TEMP%\nsj4e90.tmp\app\js\windows\finish\template.js
- %TEMP%\nsj4e90.tmp\app\js\windows\finish\finish-controller.js
- %TEMP%\nsj4e90.tmp\app\js\windows\cri\template.js
- %TEMP%\nsj4e90.tmp\app\js\windows\progress\template.js
- %TEMP%\nsj4e90.tmp\app\js\windows\cri\cri-controller.js
- %TEMP%\nsj4e90.tmp\app\images\header-logo.png
- %TEMP%\nsj4e90.tmp\app\images\gs-placeholder.png
- %TEMP%\nsj4e90.tmp\app\images\game-summary-logo-55px.png
- %TEMP%\nsj4e90.tmp\app\_locales\de\messages.json
- %TEMP%\nsj4e90.tmp\app\_locales\vi\messages.json
- %TEMP%\nsj4e90.tmp\app\_locales\tr\messages.json
- %TEMP%\nsj4e90.tmp\app\_locales\ru\messages.json
- %TEMP%\nsj4e90.tmp\app\_locales\pt\messages.json
- %TEMP%\nsj4e90.tmp\app\_locales\pl\messages.json
- %TEMP%\nsj4e90.tmp\app\_locales\ko\messages.json
- %TEMP%\nsj4e90.tmp\app\_locales\ja\messages.json
- %TEMP%\nsj4e90.tmp\app\_locales\it\messages.json
- %TEMP%\nsj4e90.tmp\app\_locales\fr\messages.json
- %TEMP%\nsj4e90.tmp\app\_locales\es\messages.json
- %LOCALAPPDATA%\overwolf\installercache\welcometextheader_0_de.png
- %TEMP%\nsj4e90.tmp\app\assets\fonts\klavika\klavikawebbasicmedium.eot
- %TEMP%\nsj4e90.tmp\app\progress.html
- %TEMP%\nsj4e90.tmp\app\manifest.json
- %TEMP%\nsj4e90.tmp\app\index.html
- %TEMP%\nsj4e90.tmp\app\cmp.html
- %TEMP%\nsj4e90.tmp\nsis7z.dll
- %TEMP%\nsj4e90.tmp\utils.dll
- %TEMP%\nsj4e90.tmp\owinstaller.exe.config
- %TEMP%\nsj4e90.tmp\owinstaller.exe
- %TEMP%\nsj4e90.tmp\inetc.dll
- %TEMP%\nsj4e90.tmp\uac.dll
- %TEMP%\nsj4e90.tmp\system.dll
- %TEMP%\nsj4e90.tmp\app\_locales\en\messages.json
- %TEMP%\nsj4e90.tmp\app\js\windows\settings\settings-controller.js
- %TEMP%\nsj4e90.tmp\app\assets\fonts\klavika\klavikawebbasicregular.eot
- %TEMP%\nsj4e90.tmp\app\css\finish-with-gs.css
- %TEMP%\nsj4e90.tmp\app\assets\fonts\lato\latolatin-regular.eot
- %TEMP%\nsj4e90.tmp\app\images\game-summary-logo-48px.png
- %TEMP%\nsj4e90.tmp\app\images\game-summary-logo-40px.png
- %TEMP%\nsj4e90.tmp\app\images\close-normal.png
- %TEMP%\nsj4e90.tmp\app\images\close-hover.png
- %TEMP%\nsj4e90.tmp\app\images\checkbox-checked.png
- %TEMP%\nsj4e90.tmp\app\images\bottom-arrow.png
- %TEMP%\nsj4e90.tmp\app\images\bottom-arrow-hover.png
- %TEMP%\nsj4e90.tmp\app\images\big-icon-fallback.png
- %TEMP%\nsj4e90.tmp\app\css\welcome.css
- %TEMP%\nsj4e90.tmp\app\css\welcome-general.css
- %TEMP%\nsj4e90.tmp\app\css\cri.css
- %TEMP%\nsj4e90.tmp\app\css\style.css
- %TEMP%\nsj4e90.tmp\app\_locales\zh\messages.json
- %TEMP%\nsj4e90.tmp\app\css\progress.css
- %TEMP%\nsj4e90.tmp\app\css\privacy.css
- %TEMP%\nsj4e90.tmp\app\css\notification.css
- %TEMP%\nsj4e90.tmp\app\css\header.css
- %TEMP%\nsj4e90.tmp\app\css\gs-b.css
- %TEMP%\nsj4e90.tmp\app\css\gs-a.css
- %TEMP%\nsj4e90.tmp\app\css\footer.css
- %TEMP%\nsj4e90.tmp\app\css\fonts.css
- %TEMP%\nsj4e90.tmp\app\css\finish.css
- %TEMP%\nsj4e90.tmp\app\css\finish-with-recommended-app.css
- %TEMP%\nsj4e90.tmp\app\css\settings.css
- %LOCALAPPDATA%\overwolf\installercache\welcometextheader_0_pt.png
Удаляет следующие файлы
- %LOCALAPPDATA%\overwolf\settings\bak\settingspagebasic.xml.bak
Подменяет следующие файлы
- %LOCALAPPDATA%\overwolf\settings\bak\settingspagebasic.xml.bak
Сетевая активность
Подключается к
- 'public-trust.com':80
TCP
Запросы HTTP GET
- http://an######snew.overwolf.com/analytics/Counter?Na######################################################################################################################
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://an######snew.overwolf.com/analytics/Counter?Cu############################################################################################################################################...
- http://www.go#####analytics.com/__utm.gif?ut#####################################################################################################################################################...
UDP
- DNS ASK an######snew.overwolf.com
- DNS ASK fo###.#oogleapis.com
- DNS ASK go#####analytics.com
- DNS ASK public-trust.com
Другое
Ищет следующие окна
- ClassName: 'MPWClass' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\nsj4e90.tmp\owinstaller.exe' Partner=3994&Extension=dehhmmabcacbdbhjelocjdfnpodomhalpkbhjjck&Name=The%202020%20Alienware%20Games&Thanks=https%3A%2F%2Fgo.overwolf.com%2Finstall-successful%2F&UtmSource=youtube&UtmMedium=cpc&...
Запускает на исполнение
- '%WINDIR%\syswow64\dxdiag.exe' /t%LOCALAPPDATA%\Overwolf\Temp\DxDiagOutput.txt
