Trojan.Hosts.51908

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%ALLUSERSPROFILE%\piriform\icarus\logs\sfx.log.tmp.d83eee94-ecf8-4c6e-a071-3077f3e2acde
%ALLUSERSPROFILE%\piriform\icarus\logs\sui.log.tmp.59559055-246c-4985-b7eb-77cc35a91cc5
%ALLUSERSPROFILE%\piriform\icarus\logs\sui.log
%ALLUSERSPROFILE%\piriform\icarus\logs\report.log
%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\piriform-atrk\icarus.exe
%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\piriform-atrk\icarus_ui.exe
%ALLUSERSPROFILE%\piriform\icarus\logs\icarus.log
%ALLUSERSPROFILE%\piriform\icarus\settings\proxy.ini
%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\piriform-atrk\dump_process.exe
%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\piriform-atrk\setupui.cont
%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\piriform-atrk\icarus_rvrt.exe.lzma
%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\piriform-atrk\icarus_product.dll.lzma
%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\piriform-atrk\icarus_rvrt.exe
%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\piriform-atrk\icarus_product.dll
%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\piriform-atrk\bug_report.exe
%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\piriform-atrk\product-def.xml
%ALLUSERSPROFILE%\piriform\icarus\logs\icarus.log.tmp.9676a033-9664-40bf-aff9-06f2cb5d38b0
%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\icarus-info.xml
%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\ecoo.edat
%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\common\9191aea1-6b20-49a8-bc8e-20d22b6c3cf5
%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\common\product-info.xml
%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\common\0ef6b988-b965-4be2-b00b-565a3362ece5
%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\common\icarus.exe
%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\common\f2ebaa4b-0b76-4c34-a951-c025ba2fcad1
%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\common\icarus_ui.exe
%ALLUSERSPROFILE%\piriform\icarus\logs\sfx.log
%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\common\7763f62e-e577-4cf2-9823-88679849b78b
%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\common\b8e9f6ee-b2c1-4ed4-97aa-ed8bfe1120f5
%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\common\bug_report.exe
%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\common\fd8262f0-06b7-40d1-8a28-81b8ff17f120
%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\common\product-def.xml
%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\common\b10a4346-5528-479b-a944-af12bbe5694b
%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\common\setupui.cont
%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\common\dump_process.exe
%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\piriform-atrk\product-info.xml
%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\piriform-atrk\config.def

Перемещает следующие файлы

%ALLUSERSPROFILE%\piriform\icarus\logs\sfx.log.tmp.d83eee94-ecf8-4c6e-a071-3077f3e2acde в %ALLUSERSPROFILE%\piriform\icarus\logs\sfx.log
%ALLUSERSPROFILE%\piriform\icarus\logs\icarus.log.tmp.9676a033-9664-40bf-aff9-06f2cb5d38b0 в %ALLUSERSPROFILE%\piriform\icarus\logs\icarus.log
%ALLUSERSPROFILE%\piriform\icarus\logs\sui.log.tmp.59559055-246c-4985-b7eb-77cc35a91cc5 в %ALLUSERSPROFILE%\piriform\icarus\logs\sui.log

Изменяет файл HOSTS.

Сетевая активность

Подключается к

'an#####cs.ff.avast.com':443
'pk#.goog':80
'ho####.avcdn.net':443
'ho####.avcdn.net':80
'sh#####d.ff.avast.com':443

TCP

Запросы HTTP GET

http://ho####.avcdn.net/dll/piriform-atrk/x86/icarus_mod.dll.lzma

Другие

'an#####cs.ff.avast.com':443
'ho####.avcdn.net':443
'sh#####d.ff.avast.com':443

UDP

DNS ASK an#####cs.ff.avast.com
DNS ASK pk#.goog
DNS ASK ho####.avcdn.net
DNS ASK sh#####d.ff.avast.com

Другое

Создает и запускает на исполнение

'%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\icarus-info.xml /install /sssid:2780
'%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\common\icarus_ui.exe' /sssid:2780 /er_master:master_ep_d0b26c22-27da-4454-aad2-c266f79c371e /er_ui:ui_ep_3610f526-db37-4b63-9d90-07a1b9431929
'%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\piriform-atrk\icarus.exe' /sssid:2780 /er_master:master_ep_d0b26c22-27da-4454-aad2-c266f79c371e /er_ui:ui_ep_3610f526-db37-4b63-9d90-07a1b9431929 /er_slave:piriform-atrk_slave_ep_5dbee67c-e31e-42f3-bfcc-a34368b0ea3d /sl...

Запускает на исполнение

'%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\common\icarus_ui.exe' /sssid:2780 /er_master:master_ep_d0b26c22-27da-4454-aad2-c266f79c371e /er_ui:ui_ep_3610f526-db37-4b63-9d90-07a1b9431929 (со скрытым окном)
'%WINDIR%\temp\asw-d3512ce8-e769-48a6-8972-a88da9effb36\piriform-atrk\icarus.exe' /sssid:2780 /er_master:master_ep_d0b26c22-27da-4454-aad2-c266f79c371e /er_ui:ui_ep_3610f526-db37-4b63-9d90-07a1b9431929 /er_slave:piriform-atrk_slave_ep_5dbee67c-e31e-42f3-bfcc-a34368b0ea3d /sl... (со скрытым окном)