Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log.tmp.526ea21e-9cc5-4c20-adfd-0f379c6011a3
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av\setupui.cont
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av\icarus_product.dll.lzma
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av\icarus_rvrt.exe.lzma
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av\aswoffertool.exe.lzma
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av\icarus_rvrt.exe
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av\aswoffertool.exe
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av-vps\icarus.exe.lzma
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av-vps\icarus_product.dll.lzma
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av-vps\icarus_rvrt.exe.lzma
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av-vps\dump_process.exe.lzma
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av-vps\bug_report.exe.lzma
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av-vps\icarus_rvrt.exe
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\common\bug_report.exe
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av-vps\product-def.xml.lzma
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av\icarus_product.dll
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av\product-info.xml
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av\config.def
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av-vps\icarus_product.dll
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av-vps\dump_process.exe
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av-vps\icarus.exe
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av-vps\bug_report.exe
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av-vps\product-info.xml
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av-vps\config.def
- %ALLUSERSPROFILE%\avg\icarus\logs\event_manager.log.tmp.3f888794-7f72-479d-a73a-2d2dfa73d938
- %ALLUSERSPROFILE%\avg\icarus\logs\event_manager.log
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av\gcapi_17142563152128.dll
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av\bug_report.exe
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av\product-def.xml
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av\dump_process.exe
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av\icarus_ui.exe
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av\icarus.exe
- %TEMP%\d566d7d7-dcd6-471c-8109-be0ad33199e3
- %TEMP%\6358c710-b89f-46b9-93f2-f6cac44f5286
- %TEMP%\f07d8c6a-04b6-4025-869c-70a788d7b5c0
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\common\00c4f64a-e06c-4cc9-934c-e55cfd047ff7
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\common\icarus_mod.dll
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\common\product-info.xml
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\common\0775a9f3-c868-4208-a666-3e2543e28b70
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\common\icarus.exe
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\common\d16a4c7a-849e-4ecf-aa5b-1d2b4de97707
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\common\icarus_ui.exe
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\common\408c5af0-ea60-43ab-a4b9-387f1a5eaa31
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\common\dump_process.exe
- C:\users\public\documents\aswoffertool.exe
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av-vps\product-def.xml
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\common\90a8e0a4-e008-4e30-8862-1faea0b38c15
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\common\product-def.xml
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\common\e9afa340-6702-44dc-9946-d91cae54ebae
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\common\setupui.cont
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av\edition.edat
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av\config.def.edat
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\icarus-info.xml
- %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log.tmp.cc1f5db0-02f9-42a3-9716-b73166763ac8
- %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log
- %ALLUSERSPROFILE%\avg\icarus\settings\proxy.ini
- %ALLUSERSPROFILE%\avg\icarus\logs\sui.log.tmp.858527a8-130d-4eb3-ab8b-4860a7f9a759
- %ALLUSERSPROFILE%\avg\icarus\logs\sui.log
- %ALLUSERSPROFILE%\avg\icarus\logs\report.log
- %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\common\2e7ef5c7-6e99-433a-9cfd-f3b12e92a04c
- C:\users\public\documents\gcapi_17142563171612.dll
Удаляет следующие файлы
- C:\users\public\documents\gcapi_17142563171612.dll
- C:\users\public\documents\aswoffertool.exe
- %WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av\gcapi_17142563152128.dll
Перемещает следующие файлы
- %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log.tmp.526ea21e-9cc5-4c20-adfd-0f379c6011a3 в %ALLUSERSPROFILE%\avg\icarus\logs\sfx.log
- %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log.tmp.cc1f5db0-02f9-42a3-9716-b73166763ac8 в %ALLUSERSPROFILE%\avg\icarus\logs\icarus.log
- %ALLUSERSPROFILE%\avg\icarus\logs\sui.log.tmp.858527a8-130d-4eb3-ab8b-4860a7f9a759 в %ALLUSERSPROFILE%\avg\icarus\logs\sui.log
- %ALLUSERSPROFILE%\avg\icarus\logs\event_manager.log.tmp.3f888794-7f72-479d-a73a-2d2dfa73d938 в %ALLUSERSPROFILE%\avg\icarus\logs\event_manager.log
Сетевая активность
Подключается к
- 'an####ics.avcdn.net':443
- 'ho####.avcdn.net':443
- 'pk#.goog':80
- 'an#####cs.ff.avast.com':443
- 'sh####rd.avcdn.net':443
TCP
Запросы HTTP GET
- http://pk#.goog/gsr1/gsr1.crt
Другие
- 'an####ics.avcdn.net':443
- 'ho####.avcdn.net':443
- 'sh####rd.avcdn.net':443
UDP
- DNS ASK an####ics.avcdn.net
- DNS ASK ho####.avcdn.net
- DNS ASK pk#.goog
- DNS ASK an#####cs.ff.avast.com
- DNS ASK sh####rd.avcdn.net
Другое
Создает и запускает на исполнение
- '%WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\icarus-info.xml /install /sssid:600
- '%WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\common\icarus_ui.exe' /sssid:600 /er_master:master_ep_60417a04-26a2-404d-99fc-218fd4ac4160 /er_ui:ui_ep_16d892ad-b92b-45c7-a51f-234d1eebb5b5
- '%WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av-vps\icarus.exe' /sssid:600 /er_master:master_ep_60417a04-26a2-404d-99fc-218fd4ac4160 /er_ui:ui_ep_16d892ad-b92b-45c7-a51f-234d1eebb5b5 /er_slave:avg-av-vps_slave_ep_0c6292f2-6891-4e67-a4f3-8c1c6abfa655 /slave:...
- '%WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av\icarus.exe' /sssid:600 /er_master:master_ep_60417a04-26a2-404d-99fc-218fd4ac4160 /er_ui:ui_ep_16d892ad-b92b-45c7-a51f-234d1eebb5b5 /er_slave:avg-av_slave_ep_fa40f43f-661b-407c-ad65-9c26efa70ef6 /slave:avg-...
- '%WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av\aswoffertool.exe' -checkChromeReactivation -elevated -bc=AWFA
- 'C:\users\public\documents\aswoffertool.exe' -checkChromeReactivation -bc=AWFA
- '%WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\common\icarus_ui.exe' /sssid:600 /er_master:master_ep_60417a04-26a2-404d-99fc-218fd4ac4160 /er_ui:ui_ep_16d892ad-b92b-45c7-a51f-234d1eebb5b5' (со скрытым окном)
- '%WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av-vps\icarus.exe' /sssid:600 /er_master:master_ep_60417a04-26a2-404d-99fc-218fd4ac4160 /er_ui:ui_ep_16d892ad-b92b-45c7-a51f-234d1eebb5b5 /er_slave:avg-av-vps_slave_ep_0c6292f2-6891-4e67-a4f3-8c1c6abfa655 /slave:...' (со скрытым окном)
- '%WINDIR%\temp\asw-18a1204d-62f2-47a9-bd00-09cd6ca8dc5e\avg-av\icarus.exe' /sssid:600 /er_master:master_ep_60417a04-26a2-404d-99fc-218fd4ac4160 /er_ui:ui_ep_16d892ad-b92b-45c7-a51f-234d1eebb5b5 /er_slave:avg-av_slave_ep_fa40f43f-661b-407c-ad65-9c26efa70ef6 /slave:avg-...' (со скрытым окном)
