Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1136 -dm 7 7 %TEMP%\WER02dd.dir00\svchost.exe.mdmp 16325836412032476
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\hltjtlne.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ketssrzn.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WER02dd.dir00\svchost.exe.mdmp
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\jjjthqtn.exe
- '19#.#49.115.62':445
- '19#.#49.63.183':445
- '19#.#49.229.229':445
- '19#.#49.8.72':445
- '19#.#49.64.232':445
- '19#.#49.207.44':445
- '19#.#49.57.100':445
- '19#.#49.37.40':445
- '19#.#49.90.171':445
- '19#.#49.33.5':445
- '19#.#49.225.99':445
- '19#.#49.155.216':445
- '19#.#49.118.191':445
- '19#.#49.239.93':445
- '19#.#49.193.6':445
- '19#.#49.245.192':445
- '19#.#49.138.40':445
- '19#.#49.209.29':445
- '19#.#49.93.214':445
- '19#.#49.222.224':445
- '19#.#49.167.245':445
- '19#.#49.203.38':445
- '19#.#49.21.41':445
- '19#.#49.6.117':445
- '19#.#49.117.21':445
- '19#.#49.209.57':139
- '19#.#49.189.122':139
- '19#.#49.92.209':139
- '19#.#49.196.20':139
- '19#.#49.19.167':139
- '19#.#49.33.224':139
- '19#.#49.104.38':139
- '19#.#49.250.229':445
- '19#.#49.231.135':445
- '19#.#49.71.50':139
- '19#.#49.202.67':139
- '19#.#49.16.85':139
- '19#.#49.20.210':139
- '19#.#49.16.112':139
- '19#.#49.90.40':139
- '19#.#49.216.252':139
- '19#.#49.11.91':445
- '19#.#49.250.229':139
- '19#.#49.231.135':139
- '19#.#49.94.209':139
- '19#.#49.23.126':139
- '19#.#49.45.188':139
- '19#.#49.81.79':139
- '19#.#49.96.162':139
- '19#.#49.54.200':139
- '19#.#49.142.106':445
- '19#.#49.209.8':139
- '19#.#49.142.106':139
- '19#.#49.138.40':139
- '19#.#49.253.89':445
- '19#.#49.43.49':445
- '19#.#49.197.95':139
- '19#.#49.21.41':139
- '19#.#49.222.224':139
- '19#.#49.117.21':139
- '19#.#49.209.29':139
- '19#.#49.239.93':139
- '19#.#49.93.214':139
- '19#.#49.68.137':445
- '19#.#49.4.41':445
- '19#.#49.100.172':445
- '19#.#49.73.183':445
- '19#.#49.39.68':445
- '19#.#49.94.160':445
- '19#.#49.219.98':445
- '19#.#49.103.21':445
- '19#.#49.83.75':445
- '19#.#49.123.69':445
- '19#.#49.73.3':445
- '19#.#49.72.139':445
- '19#.#49.126.3':445
- '19#.#49.93.152':139
- '19#.#49.57.100':139
- '19#.#49.37.40':139
- '19#.#49.225.99':139
- '19#.#49.13.106':139
- '19#.#49.155.216':139
- '19#.#49.93.152':445
- '19#.#49.197.95':445
- '19#.#49.209.8':445
- '19#.#49.90.171':139
- '19#.#49.13.106':445
- '19#.#49.11.91':139
- '19#.#49.33.5':139
- '19#.#49.167.245':139
- '19#.#49.203.38':139
- '19#.#49.118.191':139
- '19#.#49.193.6':139
- '19#.#49.245.192':139
- '19#.#49.6.117':139
- '19#.#49.229.229':139
- '19#.#49.63.183':139
- '19#.#49.207.44':139
- '19#.#49.8.72':139
- '19#.#49.64.232':139
- '19#.#49.115.62':139
- '19#.#49.60.155':445
- '19#.#49.226.42':445
- '19#.#49.157.5':445
- '19#.#49.62.132':445
- '19#.#49.38.30':445
- '19#.#49.193.137':445
- '19#.#49.102.213':445
- '19#.#49.201.109':445
- '19#.#49.21.158':445
- '19#.#49.245.225':445
- '19#.#49.179.168':445
- '19#.#49.44.138':445
- '19#.#49.119.251':445
- '19#.#49.40.197':445
- '19#.#49.19.218':445
- '19#.#49.211.6':445
- '19#.#49.207.27':445
- '19#.#49.129.207':445
- '19#.#49.158.102':445
- '19#.#49.66.12':445
- '19#.#49.49.97':445
- '19#.#49.63.99':445
- '19#.#49.227.138':445
- '19#.#49.35.36':445
- '19#.#49.189.165':445
- '19#.#49.28.156':139
- '19#.#49.51.28':139
- '19#.#49.98.251':139
- '19#.#49.251.125':139
- '19#.#49.222.197':139
- '19#.#49.156.21':139
- '19#.#49.6.13':139
- '19#.#49.68.234':139
- '19#.#49.152.33':139
- '19#.#49.28.65':139
- '19#.#49.12.236':139
- '19#.#49.251.125':445
- '19#.#49.134.73':139
- '19#.#49.93.17':139
- '19#.#49.200.26':139
- '19#.#49.63.24':139
- '19#.#49.216.221':445
- '19#.#49.82.43':445
- '19#.#49.94.250':139
- '19#.#49.182.124':139
- '19#.#49.98.118':139
- '19#.#49.184.88':139
- '19#.#49.231.229':445
- '19#.#49.159.89':139
- '19#.#49.57.160':139
- '19#.#49.27.253':445
- '19#.#49.71.50':445
- '19#.#49.202.67':445
- '19#.#49.16.85':445
- '19#.#49.209.57':445
- '19#.#49.189.122':445
- '19#.#49.92.209':445
- '19#.#49.207.27':139
- '19#.#49.129.207':139
- '19#.#49.158.102':139
- '19#.#49.104.38':445
- '19#.#49.87.254':139
- '19#.#49.27.253':139
- '19#.#49.33.224':445
- '19#.#49.81.79':445
- '19#.#49.96.162':445
- '19#.#49.54.200':445
- '19#.#49.16.112':445
- '19#.#49.90.40':445
- '19#.#49.216.252':445
- '19#.#49.20.210':445
- '19#.#49.196.20':445
- '19#.#49.19.167':445
- '19#.#49.94.209':445
- '19#.#49.23.126':445
- '19#.#49.45.188':445
- '19#.#49.157.5':139
- '19#.#49.44.138':139
- '19#.#49.179.168':139
- '19#.#49.60.155':139
- '19#.#49.226.42':139
- '19#.#49.245.225':139
- '19#.#49.216.221':139
- '19#.#49.82.43':139
- '19#.#49.87.254':445
- '19#.#49.102.213':139
- '19#.#49.201.109':139
- '19#.#49.21.158':139
- '19#.#49.49.97':139
- '19#.#49.227.138':139
- '19#.#49.35.36':139
- '19#.#49.189.165':139
- '19#.#49.40.197':139
- '19#.#49.19.218':139
- '19#.#49.211.6':139
- '19#.#49.62.132':139
- '19#.#49.63.99':139
- '19#.#49.119.251':139
- '19#.#49.66.12':139
- '19#.#49.193.137':139
- '19#.#49.38.30':139
- '19#.#49.61.177':445
- '19#.#49.96.222':445
- '19#.#49.4.152':445
- '19#.#49.188.121':445
- '19#.#49.64.206':445
- '19#.#49.158.89':445
- '19#.#49.228.160':445
- '19#.#49.255.183':445
- '19#.#49.233.10':445
- '19#.#49.35.25':445
- '19#.#49.82.226':445
- '19#.#49.8.220':445
- '19#.#49.27.1':445
- '19#.#49.233.180':445
- '19#.#49.31.154':445
- '19#.#49.252.240':445
- '19#.#49.107.252':445
- '19#.#49.17.174':445
- '19#.#49.232.84':445
- '19#.#49.20.94':445
- '19#.#49.96.252':445
- '19#.#49.105.105':445
- '19#.#49.181.105':445
- '19#.#49.61.108':445
- '19#.#49.194.154':445
- '19#.#49.146.8':445
- '19#.#49.194.204':445
- '19#.#49.85.89':445
- '19#.#49.222.40':445
- '19#.#49.91.186':445
- '19#.#49.219.167':445
- '19#.#49.54.38':445
- '19#.#49.152.152':445
- '19#.#49.93.1':445
- '19#.#49.155.17':445
- '19#.#49.48.164':445
- '19#.#49.155.211':445
- '19#.#49.152.155':445
- '19#.#49.51.25':445
- '19#.#49.48.113':445
- '19#.#49.79.242':445
- '19#.#49.126.242':445
- '19#.#49.178.18':445
- '19#.#49.161.244':445
- '19#.#49.111.182':445
- '19#.#49.51.209':445
- '19#.#49.185.214':445
- '19#.#49.28.212':445
- '19#.#49.150.88':445
- '19#.#49.65.25':445
- '19#.#49.208.139':445
- '19#.#49.129.69':139
- '19#.#49.96.222':139
- '19#.#49.4.152':139
- '19#.#49.188.121':139
- '19#.#49.64.206':139
- '19#.#49.158.89':139
- '19#.#49.228.160':139
- '19#.#49.255.183':139
- '19#.#49.233.10':139
- '19#.#49.35.25':139
- '19#.#49.82.226':139
- '19#.#49.8.220':139
- '19#.#49.27.1':139
- '19#.#49.233.180':139
- '19#.#49.31.154':139
- '19#.#49.252.240':139
- '19#.#49.107.252':139
- '19#.#49.17.174':139
- '19#.#49.232.84':139
- '19#.#49.20.94':139
- '19#.#49.96.252':139
- '19#.#49.105.105':139
- '19#.#49.181.105':139
- '19#.#49.61.108':139
- '19#.#49.194.154':139
- '19#.#49.146.8':139
- '19#.#49.194.204':139
- '19#.#49.85.89':139
- '19#.#49.222.40':139
- '19#.#49.91.186':139
- '19#.#49.219.167':139
- '19#.#49.54.38':139
- '19#.#49.152.152':139
- '19#.#49.93.1':139
- '19#.#49.155.17':139
- '19#.#49.48.164':139
- '19#.#49.155.211':139
- '19#.#49.152.155':139
- '19#.#49.51.25':139
- '19#.#49.48.113':139
- '19#.#49.79.242':139
- '19#.#49.126.242':139
- '19#.#49.178.18':139
- '19#.#49.161.244':139
- '19#.#49.111.182':139
- '19#.#49.51.209':139
- '19#.#49.185.214':139
- '19#.#49.28.212':139
- '19#.#49.150.88':139
- '19#.#49.65.25':139
- '19#.#49.208.139':139
- '19#.#49.212.215':445
- '19#.#49.122.179':445
- '19#.#49.153.64':445
- '19#.#49.43.49':139
- '19#.#49.253.89':139
- '19#.#49.111.166':445
- '19#.#49.2.110':445
- '19#.#49.108.48':445
- '19#.#49.221.96':445
- '19#.249.4.0':445
- '19#.#49.77.181':445
- '19#.#49.137.80':445
- '19#.#49.68.137':139
- '19#.#49.100.172':139
- '19#.#49.94.160':139
- '19#.#49.73.3':139
- '19#.#49.189.52':139
- '19#.#49.219.98':139
- '19#.#49.73.183':139
- '19#.#49.103.21':139
- '19#.#49.123.69':139
- '19#.#49.72.139':139
- '19#.#49.83.75':139
- '19#.#49.205.246':139
- '19#.#49.126.3':139
- '19#.#49.176.42':445
- '19#.#49.218.180':445
- '19#.#49.72.238':445
- '19#.#49.205.234':445
- '19#.#49.205.196':445
- '19#.#49.235.54':445
- '19#.#49.255.170':445
- '19#.#49.139.60':445
- '19#.#49.189.52':445
- '19#.#49.197.104':445
- '19#.#49.170.172':445
- '19#.#49.182.212':445
- '19#.#49.4.159':445
- '19#.#49.92.168':445
- '19#.#49.102.200':445
- '19#.#49.246.201':445
- '19#.#49.159.111':445
- '19#.#49.101.22':445
- '19#.#49.135.159':445
- '19#.#49.1.177':445
- '19#.#49.40.6':445
- '19#.#49.63.196':445
- '19#.#49.169.71':445
- '19#.#49.36.150':445
- '19#.#49.53.191':445
- '19#.#49.4.41':139
- '19#.#49.212.215':139
- '19#.249.4.0':139
- '19#.#49.111.166':139
- '19#.#49.153.64':139
- '19#.#49.246.201':139
- '19#.#49.122.179':139
- '19#.#49.152.207':139
- '19#.#49.77.181':139
- '19#.#49.2.110':139
- '19#.#49.101.22':139
- '19#.#49.102.200':139
- '19#.#49.137.80':139
- '19#.#49.108.48':139
- '19#.#49.61.108':9988
- '19#.#49.232.84':9988
- '19#.#49.4.152':9988
- '19#.#49.129.69':445
- '19#.#49.17.174':9988
- '19#.#49.31.154':9988
- '19#.#49.65.25':9988
- '19#.#49.208.139':9988
- '19#.#49.219.167':9988
- '19#.#49.27.1':9988
- '19#.#49.255.183':9988
- '19#.#49.79.242':9988
- '19#.#49.235.54':139
- '19#.#49.205.234':139
- '19#.#49.72.238':139
- '19#.#49.63.196':139
- '19#.#49.218.180':139
- '19#.#49.4.159':139
- '19#.#49.61.177':139
- '19#.#49.39.68':139
- '19#.#49.182.212':139
- '19#.#49.139.60':139
- '19#.#49.255.170':139
- '19#.#49.170.172':139
- '19#.#49.205.196':139
- '19#.#49.71.135':139
- '19#.#49.169.71':139
- '19#.#49.92.168':139
- '19#.#49.221.96':139
- '19#.#49.159.111':139
- '19#.#49.135.159':139
- '19#.#49.176.42':139
- '19#.#49.36.150':139
- '19#.#49.197.104':139
- '19#.#49.40.6':139
- '19#.#49.53.191':139
- '19#.#49.1.177':139