Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Полный путь к вирусу>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1124 -dm 7 7 %TEMP%\WER402d.dir00\svchost.exe.mdmp 16325836412032328
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\sjwzlskk.exe
- %PROGRAM_FILES%\FireFox\chrome\toolkit\res\lhbtcvlt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WER402d.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- '61.##6.205.200':445
- '61.##6.176.131':445
- '61.##6.44.38':445
- '61.##6.159.105':445
- '61.##6.181.180':139
- '61.##6.83.103':445
- '61.##6.237.102':445
- '61.##6.241.120':139
- '61.##6.124.109':139
- '61.##6.246.203':445
- '61.##6.12.148':445
- '61.##6.30.22':139
- '61.##6.124.30':139
- '61.##6.51.196':139
- '61.##6.21.139':139
- '61.##6.194.133':139
- '61.##6.248.72':139
- '61.##6.48.212':139
- '61.##6.12.67':139
- '61.##6.60.204':139
- '61.##6.231.30':139
- '61.##6.36.32':139
- '61.##6.44.38':139
- '61.##6.176.131':139
- '61.##6.78.18':139
- '61.##6.72.89':139
- '61.##6.164.16':139
- '61.#86.4.16':139
- '61.##6.54.156':139
- '61.##6.237.173':139
- '61.##6.2.182':445
- '61.##6.197.57':445
- '61.##6.162.138':445
- '61.##6.19.83':445
- '61.##6.181.180':445
- '61.##6.194.133':445
- '61.##6.28.185':445
- '61.##6.48.212':445
- '61.##6.231.30':445
- '61.##6.78.18':445
- '61.##6.164.16':445
- '61.##6.101.229':445
- '61.##6.54.156':445
- '61.##6.93.109':445
- '61.##6.100.43':445
- '61.##6.179.12':445
- '61.##6.31.20':445
- '61.##6.21.104':445
- '61.##6.36.32':445
- '61.##6.144.52':445
- '61.##6.19.192':445
- '61.##6.190.82':445
- '61.##6.239.246':445
- '61.##6.60.204':445
- '61.##6.77.176':445
- '61.##6.248.72':445
- '61.##6.104.26':445
- '61.##6.59.84':445
- '61.##6.26.179':445
- '61.##6.221.22':445
- '61.##6.72.89':445
- '61.##6.0.153':445
- '61.##6.36.232':445
- '61.##6.36.192':139
- '61.##6.34.199':445
- '61.##6.90.26':445
- '61.##6.191.8':445
- '61.##6.111.50':445
- '61.##6.35.89':139
- '61.##6.204.222':139
- '61.##6.72.205':139
- '61.##6.24.144':139
- '61.##6.120.104':139
- '61.##6.237.102':139
- '61.##6.106.61':139
- '61.##6.83.103':139
- '61.##6.45.11':445
- '61.##6.31.68':445
- '61.##6.45.245':445
- '61.##6.187.112':445
- '61.##6.39.80':445
- '61.##6.73.157':445
- '61.##6.71.168':445
- '61.##6.57.55':445
- '61.##6.174.92':445
- '61.##6.151.169':445
- '61.##6.14.193':445
- '61.##6.93.21':445
- '61.##6.143.189':445
- '61.##6.27.163':445
- '61.##6.133.14':445
- '61.##6.62.148':139
- '61.##6.205.200':139
- '61.##6.162.138':139
- '61.##6.59.84':139
- '61.##6.19.192':139
- '61.##6.221.22':139
- '61.##6.28.185':139
- '61.##6.2.182':139
- '61.##6.159.105':139
- '61.##6.93.109':139
- '61.##6.77.176':139
- '61.##6.100.43':139
- '61.##6.24.31':139
- '61.##6.101.229':139
- '61.##6.19.83':139
- '61.##6.144.52':139
- '61.##6.21.104':139
- '61.##6.190.82':139
- '61.##6.239.246':139
- '61.##6.36.192':445
- '61.##6.197.57':139
- '61.##6.246.203':139
- '61.##6.12.148':139
- '61.##6.106.61':445
- '61.##6.26.179':139
- '61.##6.31.20':139
- '61.##6.179.12':139
- '61.##6.104.26':139
- '61.##6.120.104':445
- '61.##6.204.222':445
- '61.##6.72.205':445
- '61.##6.37.169':445
- '61.##6.25.128':445
- '61.##6.7.102':445
- '61.##6.190.97':445
- '61.##6.191.254':445
- '61.##6.96.237':445
- '61.##6.126.199':445
- '61.##6.13.14':445
- '61.##6.98.25':445
- '61.##6.49.211':445
- '61.##6.132.224':445
- '61.##6.5.205':445
- '61.##6.43.198':445
- '61.##6.152.11':445
- '61.##6.175.171':445
- '61.##6.93.183':139
- '61.##6.57.119':139
- '61.##6.132.224':139
- '61.##6.98.25':139
- '61.##6.49.211':139
- '61.##6.48.152':139
- '61.##6.149.48':139
- '61.##6.23.254':139
- '61.##6.60.227':139
- '61.##6.160.92':445
- '61.##6.214.190':445
- '61.##6.134.94':139
- '61.##6.29.154':139
- '61.##6.58.245':139
- '61.##6.87.47':139
- '61.##6.87.47':445
- '61.##6.171.176':445
- '61.##6.204.97':445
- '61.##6.33.215':445
- '61.##6.89.134':445
- '61.##6.100.0':445
- '61.##6.212.144':445
- '61.##6.173.96':445
- '61.##6.253.24':445
- '61.##6.30.98':445
- '61.##6.173.187':445
- '61.##6.169.3':445
- '61.##6.141.85':445
- '61.##6.57.119':445
- '61.##6.60.227':445
- '61.##6.58.245':445
- '61.##6.134.94':445
- '61.##6.162.108':139
- '61.##6.225.249':139
- '61.##6.11.11':139
- '61.##6.23.254':445
- '61.##6.93.183':445
- '61.##6.29.154':445
- '61.##6.173.187':139
- '61.##6.3.168':139
- '61.##6.164.168':139
- '61.##6.73.173':445
- '61.##6.97.220':139
- '61.##6.47.67':139
- '61.##6.60.58':139
- '61.##6.169.3':139
- '61.#86.20.3':139
- '61.##6.88.56':139
- '61.##6.13.228':445
- '61.##6.47.94':139
- '61.##6.95.129':139
- '61.##6.212.183':139
- '61.##6.27.37':139
- '61.##6.90.153':445
- '61.##6.88.56':445
- '61.##6.37.83':445
- '61.#86.20.3':445
- '61.##6.47.94':445
- '61.##6.50.42':445
- '61.##6.161.35':445
- '61.##6.253.187':445
- '61.##6.21.139':445
- '61.##6.30.22':445
- '61.##6.124.109':445
- '61.##6.51.196':445
- '61.#86.4.16':445
- '61.##6.241.120':445
- '61.##6.124.30':445
- '61.##6.43.229':139
- '61.##6.50.42':139
- '61.##6.37.83':139
- '61.##6.213.72':139
- '61.##6.253.187':139
- '61.##6.13.228':139
- '61.##6.161.35':139
- '61.##6.90.153':139
- '61.##6.95.129':445
- '61.##6.190.97':139
- '61.##6.212.144':139
- '61.##6.175.171':139
- '61.##6.171.176':139
- '61.##6.126.199':139
- '61.##6.30.98':139
- '61.##6.37.169':139
- '61.##6.43.198':139
- '61.##6.7.102':139
- '61.##6.204.97':139
- '61.##6.5.205':139
- '61.##6.253.24':139
- '61.##6.141.85':139
- '61.##6.152.11':139
- '61.##6.25.128':139
- '61.##6.33.215':139
- '61.##6.43.229':445
- '61.##6.27.37':445
- '61.##6.214.190':139
- '61.##6.212.183':445
- '61.##6.100.0':139
- '61.##6.160.92':139
- '61.##6.213.72':445
- '61.##6.96.237':139
- '61.##6.73.173':139
- '61.##6.191.254':139
- '61.##6.173.96':139
- '61.##6.134.33':139
- '61.##6.89.134':139
- '61.##6.13.14':139
- '61.##6.116.211':445
- '61.##6.81.176':445
- '61.##6.112.127':445
- '61.##6.127.185':445
- '61.##6.228.167':445
- '61.##6.127.132':445
- '61.##6.63.201':445
- '61.##6.41.109':445
- '61.##6.248.133':445
- '61.#86.3.64':445
- '61.##6.178.234':445
- '61.##6.42.197':445
- '61.##6.101.21':445
- '61.##6.36.240':445
- '61.##6.78.117':445
- '61.##6.4.131':445
- '61.##6.245.209':445
- '61.##6.161.57':445
- '61.##6.107.16':445
- '61.##6.40.147':445
- '61.##6.199.188':445
- '61.##6.166.232':445
- '61.##6.177.246':445
- '61.##6.85.13':445
- '61.##6.51.201':445
- '61.##6.25.211':445
- '61.##6.67.95':445
- '61.##6.120.180':445
- '61.##6.112.78':445
- '61.##6.131.242':445
- '61.##6.185.68':445
- '61.##6.227.126':445
- '61.##6.127.185':9988
- '61.##6.42.197':9988
- '61.##6.85.13':9988
- '61.##6.227.126':9988
- '61.##6.54.183':9988
- '61.##6.252.111':9988
- '61.##6.152.199':9988
- '61.##6.127.132':9988
- '61.##6.66.186':9988
- '61.##6.57.113':9988
- '61.##6.228.167':9988
- '61.##6.186.251':9988
- '61.##6.199.188':9988
- '61.##6.188.174':9988
- '61.##6.107.16':9988
- '61.##6.55.185':445
- '61.##6.2.137':445
- '61.##6.76.171':445
- '61.##6.98.41':445
- '61.##6.66.186':445
- '61.#86.2.90':445
- '61.##6.113.214':445
- '61.##6.60.175':445
- '61.##6.137.200':9988
- '61.##6.98.41':9988
- '61.#86.37.2':9988
- '61.##6.81.176':9988
- '61.##6.182.232':445
- '61.##6.152.199':445
- '61.##6.175.54':9988
- '61.##6.199.188':139
- '61.##6.57.113':139
- '61.##6.161.57':139
- '61.#86.37.2':139
- '61.##6.54.183':139
- '61.##6.175.54':139
- '61.##6.60.175':139
- '61.##6.85.13':139
- '61.##6.112.78':139
- '61.##6.131.242':139
- '61.##6.81.176':139
- '61.##6.63.201':139
- '61.##6.245.209':139
- '61.##6.107.16':139
- '61.##6.120.180':139
- '61.##6.177.246':139
- '61.##6.166.232':139
- '61.##6.76.171':139
- '61.##6.2.137':139
- '61.##6.40.147':139
- '61.##6.98.41':139
- '61.##6.55.185':139
- '61.##6.137.200':139
- '61.##6.55.187':139
- '61.##6.152.199':139
- '61.##6.182.232':139
- '61.##6.186.251':139
- '61.##6.188.174':139
- '61.##6.188.2':139
- '61.##6.252.111':139
- '61.##6.228.167':139
- '61.##6.113.214':139
- '61.##6.186.251':445
- '61.##6.188.174':445
- '61.##6.227.126':139
- '61.##6.42.197':139
- '61.#86.2.90':139
- '61.##6.178.234':139
- '61.##6.55.187':445
- '61.##6.175.54':445
- '61.#86.37.2':445
- '61.##6.57.113':445
- '61.##6.137.200':445
- '61.##6.252.111':445
- '61.##6.54.183':445
- '61.##6.188.2':445
- '61.##6.67.95':139
- '61.##6.4.131':139
- '61.##6.51.201':139
- '61.##6.78.117':139
- '61.##6.185.68':139
- '61.##6.25.211':139
- '61.##6.41.109':139
- '61.##6.36.240':139
- '61.##6.127.185':139
- '61.##6.101.21':139
- '61.##6.66.186':139
- '61.##6.112.127':139
- '61.#86.3.64':139
- '61.##6.248.133':139
- '61.##6.127.132':139
- '61.##6.71.168':139
- '61.##6.45.245':139
- '61.##6.31.68':139
- '61.##6.45.11':139
- '61.##6.111.50':139
- '61.##6.67.106':139
- '61.##6.116.211':139
- '61.##6.34.199':139
- '61.##6.73.157':139
- '61.##6.0.153':139
- '61.##6.191.0':139
- '61.##6.63.199':139
- '61.##6.57.55':139
- '61.##6.97.242':139
- '61.##6.152.203':139
- '61.##6.198.174':139
- '61.##6.18.79':139
- '61.##6.92.138':139
- '61.##6.174.92':139
- '61.##6.42.121':139
- '61.##6.120.236':139
- '61.##6.191.8':139
- '61.##6.39.80':139
- '61.##6.219.198':139
- '61.##6.49.214':139
- '61.##6.36.232':139
- '61.##6.21.106':139
- '61.##6.14.218':139
- '61.##6.85.206':139
- '61.##6.187.112':139
- '61.##6.14.218':445
- '61.##6.83.85':445
- '61.##6.63.153':445
- '61.##6.42.121':445
- '61.##6.211.63':445
- '61.##6.75.86':445
- '61.##6.19.138':445
- '61.##6.68.13':445
- '61.#86.9.51':445
- '61.##6.49.214':445
- '61.##6.198.174':445
- '61.##6.18.79':445
- '61.##6.219.198':445
- '61.##6.120.236':445
- '61.#86.9.71':445
- '61.##6.79.180':445
- '61.##6.101.147':445
- '61.##6.120.125':445
- '61.##6.250.228':445
- '61.##6.219.13':445
- '61.##6.97.242':445
- '61.##6.63.199':445
- '61.##6.191.0':445
- '61.##6.166.219':445
- '61.##6.18.251':445
- '61.##6.135.110':445
- '61.##6.252.15':445
- '61.##6.173.186':445
- '61.#86.14.2':445
- '61.#86.10.1':445
- '61.##6.229.143':445
- '61.##6.113.214':9988
- '61.##6.76.171':9988
- '61.##6.4.131':9988
- '61.##6.51.201':9988
- '61.##6.60.175':9988
- '61.##6.55.187':9988
- '61.##6.185.68':9988
- '61.##6.120.180':9988
- '61.##6.131.242':9988
- '61.##6.63.201':9988
- '61.##6.55.185':9988
- '61.##6.248.133':9988
- '61.##6.161.57':9988
- '61.##6.25.211':9988
- '61.#86.2.90':9988
- '61.##6.101.21':9988
- '61.##6.67.95':9988
- '61.##6.188.2':9988
- '61.#86.3.64':9988
- '61.##6.182.232':9988
- '61.##6.245.209':9988
- '61.##6.40.147':9988
- '61.##6.166.232':9988
- '61.##6.78.117':9988
- '61.##6.41.109':9988
- '61.##6.2.137':9988
- '61.##6.178.234':9988
- '61.##6.112.78':9988
- '61.##6.177.246':9988
- '61.##6.112.127':9988
- '61.##6.36.240':9988
- '61.#86.9.51':139
- '61.##6.79.180':139
- '61.##6.68.13':139
- '61.##6.14.193':139
- '61.##6.252.15':139
- '61.##6.173.186':139
- '61.##6.135.110':139
- '61.##6.19.138':139
- '61.##6.83.85':139
- '61.##6.211.63':139
- '61.##6.63.153':139
- '61.##6.90.26':139
- '61.##6.75.86':139
- '61.#86.9.71':139
- '61.##6.151.169':139
- '61.#86.14.2':139
- '61.##6.120.125':139
- '61.##6.229.143':139
- '61.##6.101.147':139
- '61.##6.96.29':139
- '61.##6.219.13':139
- '61.##6.166.219':139
- '61.##6.143.189':139
- '61.##6.18.251':139
- '61.#86.10.1':139
- '61.##6.133.14':139
- '61.##6.250.228':139
- '61.##6.27.163':139
- '61.##6.121.236':139
- '61.##6.93.21':139