Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\avg\overseer
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\temp\cabc4b5.tmp
- %WINDIR%\temp\tard376.tmp
- %WINDIR%\temp\cabd375.tmp
- %WINDIR%\temp\tard326.tmp
- %WINDIR%\temp\cabd325.tmp
- %WINDIR%\temp\tard269.tmp
- %WINDIR%\temp\tard414.tmp
- %WINDIR%\temp\cabd268.tmp
- %WINDIR%\temp\cabd15d.tmp
- %WINDIR%\temp\tard082.tmp
- %WINDIR%\temp\cabd081.tmp
- %WINDIR%\temp\tard041.tmp
- %WINDIR%\temp\cabd031.tmp
- %WINDIR%\temp\tarcf84.tmp
- %WINDIR%\temp\tard15e.tmp
- %WINDIR%\temp\tarcbdf.tmp
- %WINDIR%\temp\cabd444.tmp
- %WINDIR%\temp\tardbb3.tmp
- %WINDIR%\temp\cabdbb2.tmp
- %WINDIR%\temp\tardb34.tmp
- %WINDIR%\temp\cabdb33.tmp
- %WINDIR%\temp\tarda48.tmp
- %WINDIR%\temp\cabda47.tmp
- %WINDIR%\temp\cabcf83.tmp
- %WINDIR%\temp\cabd413.tmp
- %WINDIR%\temp\tard8dd.tmp
- %WINDIR%\temp\cabd8dc.tmp
- %WINDIR%\temp\tard83f.tmp
- %WINDIR%\temp\cabd83e.tmp
- %WINDIR%\temp\tard522.tmp
- %WINDIR%\temp\cabd521.tmp
- %WINDIR%\temp\cabd8fd.tmp
- %WINDIR%\temp\tard445.tmp
- %WINDIR%\temp\tarcf53.tmp
- %WINDIR%\temp\cabcf52.tmp
- %WINDIR%\temp\tarcea5.tmp
- %WINDIR%\temp\tarc642.tmp
- %WINDIR%\temp\tarc4b6.tmp
- %WINDIR%\temp\cabc5b0.tmp
- %WINDIR%\temp\tarc5b1.tmp
- %WINDIR%\temp\cabc600.tmp
- %WINDIR%\temp\tarc601.tmp
- %WINDIR%\temp\cabdc31.tmp
- %WINDIR%\temp\cabc641.tmp
- %WINDIR%\temp\tarc84d.tmp
- %WINDIR%\temp\tarc673.tmp
- %WINDIR%\temp\cabc72f.tmp
- %WINDIR%\temp\tarc730.tmp
- %WINDIR%\temp\cabc76f.tmp
- %WINDIR%\temp\tarc770.tmp
- %WINDIR%\temp\cabc672.tmp
- %WINDIR%\temp\tard8fe.tmp
- %WINDIR%\temp\cabc88c.tmp
- %WINDIR%\temp\tarc95a.tmp
- %WINDIR%\temp\tarc88d.tmp
- %WINDIR%\temp\cabce95.tmp
- %WINDIR%\temp\tarcd8b.tmp
- %WINDIR%\temp\cabcd8a.tmp
- %WINDIR%\temp\tarccdd.tmp
- %WINDIR%\temp\cabccdc.tmp
- %WINDIR%\temp\cabc959.tmp
- %WINDIR%\temp\tarcc9d.tmp
- %WINDIR%\temp\cabc84c.tmp
- %WINDIR%\temp\cabcbde.tmp
- %WINDIR%\temp\tarcb9f.tmp
- %WINDIR%\temp\cabcb9e.tmp
- %WINDIR%\temp\tarcae2.tmp
- %WINDIR%\temp\cabcae1.tmp
- %WINDIR%\temp\cabcc9c.tmp
- %WINDIR%\temp\tardc32.tmp
Удаляет следующие файлы
- %WINDIR%\temp\cabc4b5.tmp
- %WINDIR%\temp\tard376.tmp
- %WINDIR%\temp\cabd375.tmp
- %WINDIR%\temp\tard326.tmp
- %WINDIR%\temp\cabd325.tmp
- %WINDIR%\temp\tard269.tmp
- %WINDIR%\temp\tard414.tmp
- %WINDIR%\temp\cabd268.tmp
- %WINDIR%\temp\cabd15d.tmp
- %WINDIR%\temp\tard082.tmp
- %WINDIR%\temp\cabd081.tmp
- %WINDIR%\temp\tard041.tmp
- %WINDIR%\temp\cabd031.tmp
- %WINDIR%\temp\tarcf84.tmp
- %WINDIR%\temp\tard15e.tmp
- %WINDIR%\temp\tarcbdf.tmp
- %WINDIR%\temp\cabd444.tmp
- %WINDIR%\temp\tardbb3.tmp
- %WINDIR%\temp\cabdbb2.tmp
- %WINDIR%\temp\tardb34.tmp
- %WINDIR%\temp\cabdb33.tmp
- %WINDIR%\temp\tarda48.tmp
- %WINDIR%\temp\cabda47.tmp
- %WINDIR%\temp\cabcf83.tmp
- %WINDIR%\temp\cabd413.tmp
- %WINDIR%\temp\tard8dd.tmp
- %WINDIR%\temp\cabd8dc.tmp
- %WINDIR%\temp\tard83f.tmp
- %WINDIR%\temp\cabd83e.tmp
- %WINDIR%\temp\tard522.tmp
- %WINDIR%\temp\cabd521.tmp
- %WINDIR%\temp\cabd8fd.tmp
- %WINDIR%\temp\tard445.tmp
- %WINDIR%\temp\tarcf53.tmp
- %WINDIR%\temp\cabcf52.tmp
- %WINDIR%\temp\tarcea5.tmp
- %WINDIR%\temp\tarc642.tmp
- %WINDIR%\temp\tarc4b6.tmp
- %WINDIR%\temp\cabc5b0.tmp
- %WINDIR%\temp\tarc5b1.tmp
- %WINDIR%\temp\cabc600.tmp
- %WINDIR%\temp\tarc601.tmp
- %WINDIR%\temp\cabdc31.tmp
- %WINDIR%\temp\cabc641.tmp
- %WINDIR%\temp\tarc84d.tmp
- %WINDIR%\temp\tarc673.tmp
- %WINDIR%\temp\cabc72f.tmp
- %WINDIR%\temp\tarc730.tmp
- %WINDIR%\temp\cabc76f.tmp
- %WINDIR%\temp\tarc770.tmp
- %WINDIR%\temp\cabc672.tmp
- %WINDIR%\temp\tard8fe.tmp
- %WINDIR%\temp\cabc88c.tmp
- %WINDIR%\temp\tarc95a.tmp
- %WINDIR%\temp\tarc88d.tmp
- %WINDIR%\temp\cabce95.tmp
- %WINDIR%\temp\tarcd8b.tmp
- %WINDIR%\temp\cabcd8a.tmp
- %WINDIR%\temp\tarccdd.tmp
- %WINDIR%\temp\cabccdc.tmp
- %WINDIR%\temp\cabc959.tmp
- %WINDIR%\temp\tarcc9d.tmp
- %WINDIR%\temp\cabc84c.tmp
- %WINDIR%\temp\cabcbde.tmp
- %WINDIR%\temp\tarcb9f.tmp
- %WINDIR%\temp\cabcb9e.tmp
- %WINDIR%\temp\tarcae2.tmp
- %WINDIR%\temp\cabcae1.tmp
- %WINDIR%\temp\cabcc9c.tmp
- %WINDIR%\temp\tardc32.tmp
Сетевая активность
Подключается к
- 's-#####eer.avcdn.net':443
- 'ov######.tools.avcdn.net':80
- 'an####ics.avcdn.net':443
- 'v7#####.stats.avast.com':443
- 'pk#.goog':80
TCP
Запросы HTTP GET
- http://ov######.tools.avcdn.net/tools/avg/overseer/x64/overseer.exe.def
- http://pk#.goog/gsr1/gsr1.crt
Другие
- 's-#####eer.avcdn.net':443
- 'an####ics.avcdn.net':443
UDP
- DNS ASK s-#####eer.avcdn.net
- DNS ASK ov######.tools.avcdn.net
- DNS ASK an####ics.avcdn.net
- DNS ASK v7#####.stats.avast.com
- DNS ASK pk#.goog
