Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log.tmp.ca306495-d878-485d-b7b9-d24fa3763f89
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\ecoo.edat
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\icarus-info.xml
- %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log.tmp.94a5e293-ca30-47ec-911d-48eb92e377dc
- %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log
- %ALLUSERSPROFILE%\avg\icarus\logs\report.log
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\avg-du\icarus.exe
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\avg-du\icarus_product.dll
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\avg-du\icarus_rvrt.exe
- %ALLUSERSPROFILE%\avg\icarus\logs\sui.log.tmp.0c6f188d-966c-4331-8ffa-0229bde0c8da
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\avg-du\dump_process.exe
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\avg-du\bug_report.exe
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\avg-du\product-def.xml
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\avg-du\setupui.cont
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\avg-du\product-info.xml
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\avg-du\config.def
- <SYSTEM32>\icarus_rvrt.exe
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\trid.edat
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\avg-du\icarus_ui.exe
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\common\setupui.cont
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\common\ecd4d959-a312-4961-b732-13d18582ac9a
- %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\common\daff04ad-82a0-4917-b5be-f4721e040573
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\common\product-info.xml
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\common\233cddf8-01d0-486d-9b92-a7abd6299238
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\common\icarus.exe
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\common\8a1c450c-c1ab-4f7c-9c2e-6913713eeb77
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\common\icarus_product.dll
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\common\icarus_ui.exe
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\common\product-def.xml
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\common\90bec6d1-8311-455a-b2e3-e540d13a559f
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\common\icarus_rvrt.exe
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\common\aec3c6cf-1ac4-46be-8406-d36a985246c9
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\common\dump_process.exe
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\common\4a93e693-2621-4149-a696-716c6560e520
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\common\bug_report.exe
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\common\0021c849-607c-4a35-a3b7-d2f9d2fe82a2
- %WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\common\354a8764-fc7c-4286-9cb7-a4704b4c4d8c
- %ALLUSERSPROFILE%\avg\icarus\logs\sui.log
Moves the following files
- from %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log.tmp.ca306495-d878-485d-b7b9-d24fa3763f89 to %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log
- from %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log.tmp.94a5e293-ca30-47ec-911d-48eb92e377dc to %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log
- from %ALLUSERSPROFILE%\avg\icarus\logs\sui.log.tmp.0c6f188d-966c-4331-8ffa-0229bde0c8da to %ALLUSERSPROFILE%\avg\icarus\logs\sui.log
Network activity
Connects to
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'ho####.avcdn.net':80
- 'sh#####d.ff.avast.com':443
TCP
Other
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'sh#####d.ff.avast.com':443
UDP
- DNS ASK an#####cs.ff.avast.com
- DNS ASK ho####.avcdn.net
- DNS ASK sh#####d.ff.avast.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\icarus-info.xml /install /sssid:2960
- '%WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\avg-du\icarus.exe' /sssid:2960 /er_master:master_ep_1a2db9b0-fdc1-480a-a51d-e14b4e9d298b /er_ui:ui_ep_3cb68f22-d25d-4595-9a68-7cbef1db2286 /er_slave:avg-du_slave_ep_4810fae0-cc7a-4da8-96a6-8b8b39071734 /slave:avg...
- '%WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\common\icarus_ui.exe' /sssid:2960 /er_master:master_ep_1a2db9b0-fdc1-480a-a51d-e14b4e9d298b /er_ui:ui_ep_3cb68f22-d25d-4595-9a68-7cbef1db2286
- '%WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\avg-du\icarus.exe' /sssid:2960 /er_master:master_ep_1a2db9b0-fdc1-480a-a51d-e14b4e9d298b /er_ui:ui_ep_3cb68f22-d25d-4595-9a68-7cbef1db2286 /er_slave:avg-du_slave_ep_4810fae0-cc7a-4da8-96a6-8b8b39071734 /slave:avg...' (with hidden window)
- '%WINDIR%\temp\asw-9b2b3a2c-e03e-49fe-b264-75a555248893\common\icarus_ui.exe' /sssid:2960 /er_master:master_ep_1a2db9b0-fdc1-480a-a51d-e14b4e9d298b /er_ui:ui_ep_3cb68f22-d25d-4595-9a68-7cbef1db2286' (with hidden window)
