Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\System\CurrentControlSet\Control\Session Manager] 'BootExecute' = 'autocheck autochk *\nicarus_rvrt.exe'
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log.tmp.cf540f6c-b8a6-45f4-8c4c-ccd1fabd9cbf
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\icarus-info.xml
- %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log.tmp.a1c89fa8-0aae-410b-9c01-b4660773a888
- %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log
- %ALLUSERSPROFILE%\avg\icarus\logs\report.log
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\avg-du\icarus.exe
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\avg-du\icarus_product.dll
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\avg-du\icarus_ui.exe
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\avg-du\icarus_rvrt.exe
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\avg-du\dump_process.exe
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\avg-du\bug_report.exe
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\avg-du\product-def.xml
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\avg-du\setupui.cont
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\avg-du\product-info.xml
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\avg-du\config.def
- <SYSTEM32>\icarus_rvrt.exe
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\common\setupui.cont
- %ALLUSERSPROFILE%\avg\icarus\logs\sui.log.tmp.eba67a53-f39b-4f2d-87a7-fb205be6d0ec
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\common\ad372feb-8d9a-49c3-ae78-a59e0052ae63
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\common\e9cb11a9-0d3d-45c8-9dae-26053402d5a6
- %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\common\88a34d47-e8c3-4677-a9b9-4a731b0fb75e
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\common\product-info.xml
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\common\3063b309-1be4-4bdf-98ff-69f933d45de8
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\common\icarus.exe
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\common\9d7f45c0-b0fd-4716-95b1-783d29f182d5
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\common\icarus_product.dll
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\common\eda24470-a64d-4609-92ed-1c1211b2bcc3
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\common\icarus_ui.exe
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\common\de065b21-4420-4df9-843c-4fd41d6d8636
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\common\icarus_rvrt.exe
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\common\04740695-20b8-430b-8e9f-3e3f00bb1339
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\common\dump_process.exe
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\common\4c46a8be-2560-476a-9445-7e46dbc1d9d8
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\common\bug_report.exe
- %WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\common\product-def.xml
- %ALLUSERSPROFILE%\avg\icarus\logs\sui.log
Moves the following files
- from %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log.tmp.cf540f6c-b8a6-45f4-8c4c-ccd1fabd9cbf to %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log
- from %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log.tmp.a1c89fa8-0aae-410b-9c01-b4660773a888 to %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log
- from %ALLUSERSPROFILE%\avg\icarus\logs\sui.log.tmp.eba67a53-f39b-4f2d-87a7-fb205be6d0ec to %ALLUSERSPROFILE%\avg\icarus\logs\sui.log
Network activity
Connects to
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'ho####.avcdn.net':80
- 'sh#####d.ff.avast.com':443
TCP
- 'an#####cs.ff.avast.com':443
- 'ho####.avcdn.net':443
- 'sh#####d.ff.avast.com':443
UDP
- DNS ASK an#####cs.ff.avast.com
- DNS ASK ho####.avcdn.net
- DNS ASK sh#####d.ff.avast.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\icarus-info.xml /install /sssid:2884
- '%WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\avg-du\icarus.exe' /sssid:2884 /er_master:master_ep_27790807-f95b-4254-ba30-7c53355bef58 /er_ui:ui_ep_2fff8563-62b9-4897-b6b8-8709dd45bef0 /er_slave:avg-du_slave_ep_85e171d8-ee96-4eb9-bb21-f8c0446bb5f5 /slave:avg...
- '%WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\common\icarus_ui.exe' /sssid:2884 /er_master:master_ep_27790807-f95b-4254-ba30-7c53355bef58 /er_ui:ui_ep_2fff8563-62b9-4897-b6b8-8709dd45bef0
- '%WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\avg-du\icarus.exe' /sssid:2884 /er_master:master_ep_27790807-f95b-4254-ba30-7c53355bef58 /er_ui:ui_ep_2fff8563-62b9-4897-b6b8-8709dd45bef0 /er_slave:avg-du_slave_ep_85e171d8-ee96-4eb9-bb21-f8c0446bb5f5 /slave:avg...' (with hidden window)
- '%WINDIR%\temp\asw-cf60aa4b-44b6-47b4-9f22-192d0af15c04\common\icarus_ui.exe' /sssid:2884 /er_master:master_ep_27790807-f95b-4254-ba30-7c53355bef58 /er_ui:ui_ep_2fff8563-62b9-4897-b6b8-8709dd45bef0' (with hidden window)
