Technical Information
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log.tmp.d55d5fb4-ba0e-4077-aff8-4d8fab005f0c
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av-vps\icarus_product.dll.lzma
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av-vps\icarus_rvrt.exe.lzma
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av-vps\dump_process.exe.lzma
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av-vps\bug_report.exe.lzma
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av-vps\product-def.xml.lzma
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av-vps\product-def.xml
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av-vps\icarus_rvrt.exe
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av\product-def.xml
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av\setupui.cont
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av-vps\icarus_product.dll
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av-vps\dump_process.exe
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av-vps\bug_report.exe
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\common\bug_report.exe
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av\icarus_rvrt.exe.lzma
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av\icarus_product.dll.lzma
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av\aswoffertool.exe.lzma
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av-vps\icarus.exe
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av\aswoffertool.exe
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av\icarus_product.dll
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av-vps\product-info.xml
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av-vps\config.def
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av\product-info.xml
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av\config.def
- %ALLUSERSPROFILE%\avg\icarus\logs\event_manager.log.tmp.e083c670-8069-4249-8572-fcf3e32c1ac9
- %ALLUSERSPROFILE%\avg\icarus\logs\event_manager.log
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av\gcapi_17219553273020.dll
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av\bug_report.exe
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av-vps\icarus.exe.lzma
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av\dump_process.exe
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av\icarus_ui.exe
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av\icarus.exe
- %TEMP%\d566d7d7-dcd6-471c-8109-be0ad33199e3
- %TEMP%\6358c710-b89f-46b9-93f2-f6cac44f5286
- %TEMP%\f07d8c6a-04b6-4025-869c-70a788d7b5c0
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\common\f933949b-feb2-4b75-81f4-af2c6028cfa0
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\common\icarus_mod.dll
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\common\product-info.xml
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\common\3e540b35-0cc2-41c4-b1c9-30ea5d88982c
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\common\icarus.exe
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\common\027e7c23-65a1-457a-bf61-bb631b51111b
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\common\icarus_ui.exe
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\common\47e9689c-2801-4349-8255-5d4484aa20c5
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\common\dump_process.exe
- C:\users\public\documents\aswoffertool.exe
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av\icarus_rvrt.exe
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\common\cf588758-de5f-48c2-9431-322f2fce48f5
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\common\product-def.xml
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\common\2efed619-e396-4e6f-89f9-e61883a0783a
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\common\setupui.cont
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av\edition.edat
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av\config.def.edat
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\icarus-info.xml
- %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log.tmp.b78e3402-cecc-4744-a069-7f831374e41d
- %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log
- %ALLUSERSPROFILE%\avg\icarus\settings\proxy.ini
- %ALLUSERSPROFILE%\avg\icarus\logs\report.log
- %ALLUSERSPROFILE%\avg\icarus\logs\sui.log.tmp.6d05a2dc-7fd8-401d-8806-6acb30517b36
- %ALLUSERSPROFILE%\avg\icarus\logs\sui.log
- %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\common\1e416aae-9dc5-422a-ac18-c02ef3879b27
- C:\users\public\documents\gcapi_17219553283008.dll
Deletes the following files
- C:\users\public\documents\gcapi_17219553283008.dll
- C:\users\public\documents\aswoffertool.exe
- %WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av\gcapi_17219553273020.dll
Moves the following files
- from %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log.tmp.d55d5fb4-ba0e-4077-aff8-4d8fab005f0c to %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log
- from %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log.tmp.b78e3402-cecc-4744-a069-7f831374e41d to %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log
- from %ALLUSERSPROFILE%\avg\icarus\logs\sui.log.tmp.6d05a2dc-7fd8-401d-8806-6acb30517b36 to %ALLUSERSPROFILE%\avg\icarus\logs\sui.log
- from %ALLUSERSPROFILE%\avg\icarus\logs\event_manager.log.tmp.e083c670-8069-4249-8572-fcf3e32c1ac9 to %ALLUSERSPROFILE%\avg\icarus\logs\event_manager.log
Network activity
Connects to
- 'an####ics.avcdn.net':443
- 'ho####.avcdn.net':443
- 'pk#.goog':80
- 'an#####cs.ff.avast.com':443
- 'sh####rd.avcdn.net':443
TCP
HTTP GET requests
- http://pk#.goog/gsr1/gsr1.crt
Other
- 'an####ics.avcdn.net':443
- 'ho####.avcdn.net':443
- 'sh####rd.avcdn.net':443
UDP
- DNS ASK an####ics.avcdn.net
- DNS ASK ho####.avcdn.net
- DNS ASK pk#.goog
- DNS ASK an#####cs.ff.avast.com
- DNS ASK sh####rd.avcdn.net
Miscellaneous
Creates and executes the following
- '%WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\icarus-info.xml /install /sssid:1520
- '%WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\common\icarus_ui.exe' /sssid:1520 /er_master:master_ep_5bfcf590-7dc7-4015-9ddb-14b767c6c6bb /er_ui:ui_ep_1fe1332b-4333-4e0b-a769-14359e5d2b16
- '%WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av\icarus.exe' /sssid:1520 /er_master:master_ep_5bfcf590-7dc7-4015-9ddb-14b767c6c6bb /er_ui:ui_ep_1fe1332b-4333-4e0b-a769-14359e5d2b16 /er_slave:avg-av_slave_ep_01df7d68-7b71-45df-a298-6c2a22ef1627 /slave:avg...
- '%WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av-vps\icarus.exe' /sssid:1520 /er_master:master_ep_5bfcf590-7dc7-4015-9ddb-14b767c6c6bb /er_ui:ui_ep_1fe1332b-4333-4e0b-a769-14359e5d2b16 /er_slave:avg-av-vps_slave_ep_594ca8c1-4d95-4e85-bfad-1df4e17bb3f3 /slave...
- '%WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av\aswoffertool.exe' -checkChromeReactivation -elevated -bc=AWFA
- 'C:\users\public\documents\aswoffertool.exe' -checkChromeReactivation -bc=AWFA
Executes the following
- '%WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\common\icarus_ui.exe' /sssid:1520 /er_master:master_ep_5bfcf590-7dc7-4015-9ddb-14b767c6c6bb /er_ui:ui_ep_1fe1332b-4333-4e0b-a769-14359e5d2b16' (with hidden window)
- '%WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av\icarus.exe' /sssid:1520 /er_master:master_ep_5bfcf590-7dc7-4015-9ddb-14b767c6c6bb /er_ui:ui_ep_1fe1332b-4333-4e0b-a769-14359e5d2b16 /er_slave:avg-av_slave_ep_01df7d68-7b71-45df-a298-6c2a22ef1627 /slave:avg...' (with hidden window)
- '%WINDIR%\temp\asw-cdd00d98-4f94-4706-95ca-903db88e0593\avg-av-vps\icarus.exe' /sssid:1520 /er_master:master_ep_5bfcf590-7dc7-4015-9ddb-14b767c6c6bb /er_ui:ui_ep_1fe1332b-4333-4e0b-a769-14359e5d2b16 /er_slave:avg-av-vps_slave_ep_594ca8c1-4d95-4e85-bfad-1df4e17bb3f3 /slave...' (with hidden window)
