Trojan.Hosts.51944

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%ALLUSERSPROFILE%\piriform\icarus\logs\sfx.log.tmp.946f49a9-4864-4010-b540-0c620d75fcd2
%ALLUSERSPROFILE%\piriform\icarus\logs\sui.log.tmp.355a1198-14e5-4edf-aca9-47fb4cd43082
%ALLUSERSPROFILE%\piriform\icarus\logs\sui.log
%ALLUSERSPROFILE%\piriform\icarus\logs\report.log
%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\piriform-atrk\icarus.exe
%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\piriform-atrk\icarus_ui.exe
%ALLUSERSPROFILE%\piriform\icarus\logs\icarus.log
%ALLUSERSPROFILE%\piriform\icarus\settings\proxy.ini
%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\piriform-atrk\dump_process.exe
%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\piriform-atrk\setupui.cont
%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\piriform-atrk\icarus_rvrt.exe.lzma
%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\piriform-atrk\icarus_rvrt.exe
%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\piriform-atrk\icarus_product.dll.lzma
%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\piriform-atrk\icarus_product.dll
%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\piriform-atrk\bug_report.exe
%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\piriform-atrk\product-def.xml
%ALLUSERSPROFILE%\piriform\icarus\logs\icarus.log.tmp.e1077077-b52d-4ddf-804b-0d0cacb11ba3
%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\icarus-info.xml
%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\ecoo.edat
%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\common\1727d0df-405b-4b0e-9e2d-11fefc810911
%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\common\product-info.xml
%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\common\e4d589cc-8e45-4c36-b91c-6f2e6b33f0cd
%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\common\icarus.exe
%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\common\3be9bf46-1c88-424f-8730-c4b1bce758f3
%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\common\icarus_ui.exe
%ALLUSERSPROFILE%\piriform\icarus\logs\sfx.log
%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\common\bc792cbe-fbda-4800-a4a0-0f04ed1e2282
%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\common\2e61c9ad-aa14-46b6-901f-509588cb5219
%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\common\bug_report.exe
%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\common\8cb516df-1334-4cec-8313-582af4895af1
%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\common\product-def.xml
%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\common\bee37ff5-b4f6-408d-b55a-ed60ea762aab
%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\common\setupui.cont
%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\common\dump_process.exe
%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\piriform-atrk\product-info.xml
%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\piriform-atrk\config.def

Перемещает следующие файлы

%ALLUSERSPROFILE%\piriform\icarus\logs\sfx.log.tmp.946f49a9-4864-4010-b540-0c620d75fcd2 в %ALLUSERSPROFILE%\piriform\icarus\logs\sfx.log
%ALLUSERSPROFILE%\piriform\icarus\logs\icarus.log.tmp.e1077077-b52d-4ddf-804b-0d0cacb11ba3 в %ALLUSERSPROFILE%\piriform\icarus\logs\icarus.log
%ALLUSERSPROFILE%\piriform\icarus\logs\sui.log.tmp.355a1198-14e5-4edf-aca9-47fb4cd43082 в %ALLUSERSPROFILE%\piriform\icarus\logs\sui.log

Изменяет файл HOSTS.

Сетевая активность

Подключается к

'an#####cs.ff.avast.com':443
'pk#.goog':80
'ho####.avcdn.net':443
'ho####.avcdn.net':80
'sh#####d.ff.avast.com':443

TCP

Запросы HTTP GET

http://pk#.goog/gsr1/gsr1.crt
http://ho####.avcdn.net/dll/piriform-atrk/x86/icarus_mod.dll.lzma

Другие

'an#####cs.ff.avast.com':443
'ho####.avcdn.net':443
'sh#####d.ff.avast.com':443

UDP

DNS ASK an#####cs.ff.avast.com
DNS ASK pk#.goog
DNS ASK ho####.avcdn.net
DNS ASK sh#####d.ff.avast.com

Другое

Создает и запускает на исполнение

'%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\common\icarus.exe' /icarus-info-path:%WINDIR%\Temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\icarus-info.xml /install /sssid:1988
'%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\common\icarus_ui.exe' /sssid:1988 /er_master:master_ep_a5c8cd6b-0fe2-440e-a383-15aed65bd413 /er_ui:ui_ep_35e4354f-c564-4cb7-91e8-c45fa1d50e19
'%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\piriform-atrk\icarus.exe' /sssid:1988 /er_master:master_ep_a5c8cd6b-0fe2-440e-a383-15aed65bd413 /er_ui:ui_ep_35e4354f-c564-4cb7-91e8-c45fa1d50e19 /er_slave:piriform-atrk_slave_ep_55c05a9f-f149-4a31-a9af-de0146db08b1 /sl...

Запускает на исполнение

'%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\common\icarus_ui.exe' /sssid:1988 /er_master:master_ep_a5c8cd6b-0fe2-440e-a383-15aed65bd413 /er_ui:ui_ep_35e4354f-c564-4cb7-91e8-c45fa1d50e19 (со скрытым окном)
'%WINDIR%\temp\asw-12af8bf6-984a-4b50-b753-25cc1c126d39\piriform-atrk\icarus.exe' /sssid:1988 /er_master:master_ep_a5c8cd6b-0fe2-440e-a383-15aed65bd413 /er_ui:ui_ep_35e4354f-c564-4cb7-91e8-c45fa1d50e19 /er_slave:piriform-atrk_slave_ep_55c05a9f-f149-4a31-a9af-de0146db08b1 /sl... (со скрытым окном)