Technical Information
Modifies file system
Creates the following files
- %TEMP%\nssd10d.tmp\userinfo.dll
- %TEMP%\nssd10d.tmp\system.dll
- %TEMP%\nssd10d.tmp\uac.dll
- %TEMP%\nssd10d.tmp\inetc.dll
- %LOCALAPPDATA%\overwolf\owinstall.log
- %ALLUSERSPROFILE%\temp\nshd571.tmp\owinstaller.exe
- %ALLUSERSPROFILE%\temp\nshd571.tmp\newtonsoft.json.dll
- %ALLUSERSPROFILE%\temp\nshd571.tmp\log4net.dll
- %ALLUSERSPROFILE%\temp\nshd571.tmp\dotnetzip.dll
- %ALLUSERSPROFILE%\temp\nshd571.tmp\microsoft.win32.taskscheduler.dll
- %ALLUSERSPROFILE%\temp\nshd571.tmp\overwolf.client.commonutils.dll
- %ALLUSERSPROFILE%\temp\nshd571.tmp\sharpraven.dll
- %ALLUSERSPROFILE%\temp\nshd571.tmp\websocket-sharp.dll
- %ALLUSERSPROFILE%\temp\nshd571.tmp\commandline.dll
- %ALLUSERSPROFILE%\temp\nshd571.tmp\owinstaller.exe.config
- %ALLUSERSPROFILE%\temp\nshd571.tmp\utils.dll
- %ALLUSERSPROFILE%\temp\nshd571.tmp\nsis7z.dll
- %ALLUSERSPROFILE%\temp\nshd571.tmp\nsis7z64.dll
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\cmp.html
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\game_detection_database.json
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\index.html
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\manifest.json
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\progress.html
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\_locales\de\messages.json
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\_locales\en\messages.json
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\_locales\es\messages.json
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\_locales\fr\messages.json
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\_locales\it\messages.json
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\_locales\ja\messages.json
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\_locales\ko\messages.json
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\_locales\pl\messages.json
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\_locales\pt\messages.json
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\_locales\ru\messages.json
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\_locales\tr\messages.json
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\_locales\vi\messages.json
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\_locales\zh\messages.json
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\_locales\zh-tw\messages.json
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\assets\fonts\klavika\klavikawebbasicmedium.eot
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\assets\fonts\klavika\klavikawebbasicregular.eot
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\assets\fonts\lato\latolatin-regular.eot
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\css\styles.min.css
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\images\big-icon-fallback.png
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\images\bottom-arrow-hover.png
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\images\bottom-arrow.png
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\images\checkbox-checked.png
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\images\close-hover.png
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\images\close-normal.png
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\images\header-logo.png
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\images\icon-fallback.png
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\images\icon.ico
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\images\large-logo.png
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\images\minimize-hover.png
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\images\minimize-normal.png
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\images\more-info.png
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\images\plus.png
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\images\progress-01-overwolf.png
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\images\progress-02.png
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\images\progress-app-image-01.png
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\images\progress-app-image-02.png
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\images\progress-app-image-03.png
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\images\small-logo.png
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\images\tile-fallback.png
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\images\v-check.png
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\images\welcome-logo.png
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\js\app.js
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\js\block_inputs.js
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\js\libs\cmp.bundle.js
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\js\libs\jquery-1.10.2.min.js
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\js\models\notifications.js
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\js\utils\analytics.js
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\js\utils\commands.js
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\js\utils\cookies.js
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\js\utils\modal-events-delegate.js
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\js\utils\strings-loader.js
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\js\utils\utils.js
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\js\windows\cri\cri-controller.js
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\js\windows\cri\template.js
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\js\windows\finish\finish-controller.js
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\js\windows\finish\template.js
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\js\windows\finish-with-recommended-app\finish-with-recommended-app-controller.js
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\js\windows\finish-with-recommended-app\template.js
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\js\windows\main\main-controller.js
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\js\windows\main\template.js
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\js\windows\modal\modal-controller.js
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\js\windows\privacy\privacy-controller.js
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\js\windows\privacy\template.js
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\js\windows\progress\progress-1-controller.js
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\js\windows\progress\template.js
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\js\windows\settings\settings-controller.js
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\js\windows\settings\template.js
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\js\windows\welcome\template.js
- %ALLUSERSPROFILE%\temp\nshd571.tmp\app\js\windows\welcome\welcome-controller.js
- %LOCALAPPDATA%\overwolf\log\installertrace_2025-08-13_18-48_1636.log
- %LOCALAPPDATA%\overwolf\settings\settingspagebasic.xml
- %LOCALAPPDATA%\overwolf\settings\bak\settingspagebasic.xml.bak
- %LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
- %LOCALAPPDATA%\d3dscache\1f336d8ce05c79d2\f4eb2d6c-ed2b-4bdd-ad9d-f913287e6768.idx
- %LOCALAPPDATA%\d3dscache\1f336d8ce05c79d2\f4eb2d6c-ed2b-4bdd-ad9d-f913287e6768.lock
- %LOCALAPPDATA%\d3dscache\1f336d8ce05c79d2\f4eb2d6c-ed2b-4bdd-ad9d-f913287e6768.val
- %LOCALAPPDATA%\overwolf\temp\dxdiagoutput.xml
Network activity
Connects to
- 'an######snew.overwolf.com':80
- 'go#####a###ytics.com':80
- 'an######snew.overwolf.com':443
- 'co#####.overwolf.com':443
- 'oc##.###tg2.amazontrust.com':80
- 'oc##.####ca3.amazontrust.com':80
- 'st#####i.overwolf.com':443
- 'fo###.#oogleapis.com':443
- 'oc##.####ca1.amazontrust.com':80
- 'fo###.gstatic.com':443
TCP
HTTP GET requests
- http://an######snew.overwolf.com/a###ytics/Counter?Na#######################################################################################################################
- http://www.go#####a###ytics.com/__utm.gif?ut#####################################################################################################################################################...
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4d##############
- http://oc##.###tg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEowz8xPdLX1MG5U07e%2BCsM%3D
- http://oc##.####ca3.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRkNawYMzz%2BjKSfYbTyFR0AXuhs6QQUq7bb1waeN6wwhgeRcMecxBmxeMACEwdzEnA9eVH9TrLXPKuCavuqCA0%3D
- http://oc##.###tg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
- http://oc##.####ca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D
Other
- 'an######snew.overwolf.com':443
- 'co#####.overwolf.com':443
- 'st#####i.overwolf.com':443
- 'ov###olf.com':443
- 'co######apps.overwolf.com':443
- 'fo###.#oogleapis.com':443
- 'fo###.gstatic.com':443
UDP
- DNS ASK an######snew.overwolf.com
- DNS ASK go#####a###ytics.com
- DNS ASK co#####.overwolf.com
- DNS ASK oc##.###tg2.amazontrust.com
- DNS ASK oc##.####ca3.amazontrust.com
- DNS ASK st#####i.overwolf.com
- DNS ASK ov###olf.com
- DNS ASK co######apps.overwolf.com
- DNS ASK fo###.#oogleapis.com
- DNS ASK oc##.####ca1.amazontrust.com
- DNS ASK fo###.gstatic.com
Miscellaneous
Searches for the following windows
- ClassName: 'MPWClass' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%ALLUSERSPROFILE%\temp\nshd571.tmp\owinstaller.exe' Sel=1&Partner=4047&Extension=cchhcaiapeikjbdbpfplgmpobbcdkdaphclbmkbj&Name=CurseForge&Thanks=https%3A%2F%2Fgo.overwolf.com%2Fcurseforge-thank-you%2F&UtmTerm=eyJkb21haW4iOiJjZi13ZWIiLCJnYW1lSWQi...
Executes the following
- '<SYSTEM32>\dxdiag.exe' /x%LOCALAPPDATA%\Overwolf\Temp\DxDiagOutput.xml
