Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log.tmp.2ebcaf17-f5e2-4eb9-bdc2-ade5e45de891
- %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log.tmp.9ceabdff-fb2f-4757-8888-4746fcb21d26
- %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log
- %ALLUSERSPROFILE%\avast software\icarus\logs\report.log
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\avast-tu\icarus.exe
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\avast-tu\icarus_product.dll
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\avast-tu\icarus_ui.exe
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\common\icarus_ui.exe
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\avast-tu\icarus_rvrt.exe
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\avast-tu\bug_report.exe
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\avast-tu\product-def.xml
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\avast-tu\setupui.cont
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\avast-tu\product-info.xml
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\avast-tu\config.def
- <SYSTEM32>\icarus_rvrt.exe
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\ecoo.edat
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\icarus-info.xml
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\common\setupui.cont
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\common\b8ba6806-466c-4dec-ac57-9ec351b9eacd
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\common\product-def.xml
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\common\62f48159-0bf2-4bef-b34e-675434ed329a
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\common\product-info.xml
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\common\993f9d2e-821c-4c86-8c43-a86c1d32706f
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\common\icarus.exe
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\common\2dfc6ec7-0820-402f-831a-885f4a161453
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\common\icarus_product.dll
- %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log.tmp.6def9ab1-bcbc-436e-9dea-f74751cd7969
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\avast-tu\dump_process.exe
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\common\3671a3f8-d651-4bae-9df4-3a3052532530
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\common\icarus_rvrt.exe
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\common\9f983a90-8987-4780-bd0d-5faa147d7b04
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\common\dump_process.exe
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\common\48f738d9-f1b3-42f0-852b-234f168dd3f8
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\common\bug_report.exe
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\common\7c5978dd-b8f3-4be0-beef-d935af0b8a3b
- %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log
- %WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\common\596b8e56-7c07-40f6-b993-4d5b938433c3
- %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log
Moves the following files
- from %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log.tmp.2ebcaf17-f5e2-4eb9-bdc2-ade5e45de891 to %ALLUSERSPROFILE%\avast software\icarus\logs\sfx.log
- from %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log.tmp.9ceabdff-fb2f-4757-8888-4746fcb21d26 to %ALLUSERSPROFILE%\avast software\icarus\logs\icarus.log
- from %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log.tmp.6def9ab1-bcbc-436e-9dea-f74751cd7969 to %ALLUSERSPROFILE%\avast software\icarus\logs\sui.log
Network activity
Connects to
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'ho####.avcdn.net':80
- 'sh#####d.ff.avast.com':443
TCP
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'sh#####d.ff.avast.com':443
UDP
- DNS ASK an#####cs.ff.avast.com
- DNS ASK ho####.avcdn.net
- DNS ASK sh#####d.ff.avast.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\icarus-info.xml /install
- '%WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\avast-tu\icarus.exe' /er_master:master_ep_1df1a586-5367-474a-a33e-ce1007b9422e /er_ui:ui_ep_595fc143-6d68-4c2e-95c9-c37a54aa0a17 /er_slave:avast-tu_slave_ep_c8050f6c-4d25-4baa-ae8c-efec60406cd3 /slave:avast-tu
- '%WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\common\icarus_ui.exe' /er_master:master_ep_1df1a586-5367-474a-a33e-ce1007b9422e /er_ui:ui_ep_595fc143-6d68-4c2e-95c9-c37a54aa0a17
- '%WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\avast-tu\icarus.exe' /er_master:master_ep_1df1a586-5367-474a-a33e-ce1007b9422e /er_ui:ui_ep_595fc143-6d68-4c2e-95c9-c37a54aa0a17 /er_slave:avast-tu_slave_ep_c8050f6c-4d25-4baa-ae8c-efec60406cd3 /slave:avast-tu' (with hidden window)
- '%WINDIR%\temp\asw-c7464c10-f9ac-49e8-9ba4-f5c8dab7b64c\common\icarus_ui.exe' /er_master:master_ep_1df1a586-5367-474a-a33e-ce1007b9422e /er_ui:ui_ep_595fc143-6d68-4c2e-95c9-c37a54aa0a17' (with hidden window)
