Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1112 -dm 7 7 %TEMP%\WER269e.dir00\svchost.exe.mdmp 16325836412032332
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %TEMP%\WER269e.dir00\svchost.exe.mdmp
- <SYSTEM32>\urdvxc.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- '19#.#00.158.211':445
- '19#.#00.74.253':445
- '19#.#00.249.114':445
- '19#.#00.251.49':445
- '19#.#00.200.22':445
- '19#.#00.241.127':445
- '19#.#00.69.47':445
- '19#.#00.1.238':445
- '19#.#00.40.171':445
- '19#.#00.130.75':445
- '19#.#00.3.187':445
- '19#.#00.86.196':445
- '19#.#00.129.135':445
- '19#.#00.141.171':445
- '19#.#00.51.165':445
- '19#.#00.66.47':445
- '19#.#00.46.140':445
- '19#.#00.0.72':445
- '19#.#00.145.248':445
- '19#.#00.178.140':445
- '19#.#00.119.92':445
- '19#.#00.232.96':445
- '19#.#00.219.195':445
- '19#.#00.34.246':445
- '19#.#00.185.245':445
- '19#.#00.182.214':445
- '19#.#00.17.213':445
- '19#.#00.138.243':445
- '19#.#00.61.188':445
- '19#.#00.98.25':445
- '19#.#00.235.138':445
- '19#.#00.16.126':445
- '19#.#00.150.240':445
- '19#.#00.13.155':445
- '19#.#00.147.163':445
- '19#.#00.46.93':445
- '19#.#00.96.148':445
- '19#.#00.196.166':445
- '19#.#00.105.76':445
- '19#.#00.32.250':445
- '19#.#00.104.33':445
- '19#.#00.46.93':139
- '19#.#00.86.24':139
- '19#.#00.32.250':139
- '19#.#00.249.114':139
- '19#.#00.147.163':139
- '19#.#00.182.214':139
- '19#.#00.196.166':139
- '19#.#00.16.126':139
- '19#.#00.13.155':139
- '19#.#00.150.240':139
- '19#.#00.119.92':139
- '19#.#00.200.22':139
- '19#.#00.46.140':139
- '19#.#00.1.238':139
- '19#.#00.0.72':139
- '19#.#00.251.49':139
- '19#.#00.40.171':139
- '19#.#00.74.253':139
- '19#.#00.66.47':139
- '19#.#00.158.211':139
- '19#.#00.58.42':139
- '19#.#00.61.188':139
- '19#.#00.235.138':139
- '19#.#00.247.85':139
- '19#.#00.98.25':139
- '19#.#00.138.243':139
- '19#.#00.31.244':445
- '19#.#00.78.177':445
- '19#.#00.94.110':445
- '19#.#00.107.32':445
- '19#.#00.18.147':445
- '19#.#00.232.96':139
- '19#.#00.77.18':139
- '19#.#00.96.148':139
- '19#.#00.105.76':139
- '19#.#00.34.246':139
- '19#.#00.219.195':139
- '19#.#00.82.116':139
- '19#.#00.17.213':139
- '19#.#00.104.33':139
- '19#.#00.185.245':139
- '19#.#00.131.208':139
- '19#.#00.81.133':139
- '19#.#00.23.147':139
- '19#.#00.47.138':139
- '19#.#00.97.163':139
- '19#.#00.139.200':139
- '19#.#00.212.217':445
- '19#.#00.18.36':139
- '19#.#00.50.240':139
- '19#.#00.116.176':139
- '19#.#00.25.76':139
- '19#.#00.114.53':139
- '19#.#00.38.145':139
- '19#.#00.135.98':139
- '19#.#00.66.104':139
- '19#.#00.70.127':445
- '19#.#00.249.26':139
- '19#.#00.200.203':139
- '19#.#00.17.109':139
- '19#.#00.61.183':139
- '19#.#00.41.110':139
- '19#.#00.50.72':139
- '19#.#00.158.208':139
- '19#.#00.196.192':139
- '19#.#00.45.88':139
- '19#.#00.199.127':139
- '19#.#00.227.171':445
- '19#.#00.12.152':445
- '19#.#00.86.73':445
- '19#.#00.231.31':139
- '19#.#00.224.229':445
- '19#.#00.103.64':139
- '19#.#00.235.125':139
- '19#.#00.240.197':139
- '19#.#00.215.83':139
- '19#.#00.253.55':139
- '19#.#00.169.15':139
- '19#.#00.84.165':139
- '19#.#00.119.105':139
- '19#.#00.75.149':445
- '19#.#00.147.95':139
- '19#.#00.87.243':139
- '19#.#00.244.111':139
- '19#.#00.24.157':139
- '19#.#00.177.135':139
- '19#.#00.35.251':139
- '19#.#00.101.30':139
- '19#.#00.37.78':139
- '19#.#00.2.31':139
- '19#.#00.245.55':139
- '19#.#00.111.233':139
- '19#.#00.247.85':445
- '19#.#00.82.116':445
- '19#.#00.58.42':445
- '19#.#00.86.24':445
- '19#.#00.77.18':445
- '19#.#00.92.117':139
- '19#.#00.227.171':139
- '19#.#00.224.229':139
- '19#.#00.12.152':139
- '19#.#00.86.73':139
- '19#.#00.67.191':139
- '19#.#00.160.61':139
- '19#.#00.27.238':139
- '19#.#00.218.158':139
- '19#.#00.113.60':139
- '19#.#00.17.250':139
- '19#.#00.232.212':139
- '19#.#00.159.100':139
- '19#.#00.172.70':139
- '19#.#00.93.137':139
- '19#.#00.2.10':139
- '19#.#00.25.58':139
- '19#.#00.92.117':445
- '19#.#00.177.135':445
- '19#.#00.35.251':445
- '19#.#00.114.67':139
- '19#.#00.249.212':139
- '19#.#00.170.222':139
- '19#.#00.134.125':139
- '19#.#00.216.109':139
- '19#.#00.86.182':139
- '19#.#00.145.248':139
- '19#.#00.34.172':445
- '19#.#00.47.63':445
- '19#.#00.143.168':445
- '19#.#00.194.75':445
- '19#.#00.87.2':445
- '19#.#00.140.113':445
- '19#.#00.85.7':445
- '19#.#00.195.28':445
- '19#.#00.224.166':445
- '19#.#00.202.134':445
- '19#.#00.155.193':139
- '19#.#00.50.156':139
- '19#.#00.82.93':139
- '19#.#00.8.216':139
- '19#.#00.82.17':139
- '19#.#00.114.235':139
- '19#.#00.62.196':139
- '19#.#00.80.243':139
- '19#.#00.2.51':139
- '19#.#00.206.106':139
- '19#.#00.22.224':445
- '19#.#00.89.95':445
- '19#.#00.206.88':445
- '19#.#00.77.216':445
- '19#.#00.74.19':445
- '19#.#00.151.115':445
- '19#.#00.56.28':445
- '19#.#00.174.187':445
- '19#.#00.171.1':445
- '19#.#00.69.40':445
- '19#.#00.139.99':445
- '19#.#00.172.183':445
- '19#.#00.179.204':445
- '19#.#00.2.180':445
- '19#.#00.172.130':445
- '19#.#00.16.121':445
- '19#.#00.48.101':445
- '19#.#00.18.130':445
- '19#.#00.115.78':445
- '19#.#00.11.85':445
- '19#.#00.18.245':445
- '19#.#00.47.63':139
- '19#.#00.195.28':139
- '19#.#00.140.113':139
- '19#.#00.143.168':139
- '19#.#00.172.183':139
- '19#.#00.11.85':139
- '19#.#00.18.245':139
- '19#.#00.85.7':139
- '19#.#00.179.204':139
- '19#.#00.16.121':139
- '19#.#00.172.130':139
- '19#.#00.202.134':139
- '19#.#00.224.166':139
- '19#.#00.115.78':139
- '19#.#00.22.224':139
- '19#.#00.87.2':139
- '19#.#00.34.172':139
- '19#.#00.2.180':139
- '19#.#00.253.243':139
- '19#.#00.194.75':139
- '19#.#00.48.101':139
- '19#.#00.75.134':139
- '19#.#00.99.56':139
- '19#.#00.61.250':139
- '19#.#00.174.187':139
- '19#.#00.15.101':139
- '19#.#00.171.50':139
- '19#.#00.161.184':139
- '19#.#00.223.236':139
- '19#.#00.49.13':139
- '19#.#00.130.126':139
- '19#.#00.77.216':139
- '19#.#00.89.95':139
- '19#.#00.151.115':139
- '19#.#00.18.130':139
- '19#.#00.74.19':139
- '19#.#00.171.1':139
- '19#.#00.56.28':139
- '19#.#00.139.99':139
- '19#.#00.206.88':139
- '19#.#00.69.40':139
- '19#.#00.18.245':9988
- '19#.#00.151.115':9988
- '19#.#00.139.99':9988
- '19#.#00.22.224':9988
- '19#.#00.85.7':9988
- '19#.#00.77.216':9988
- '19#.#00.2.51':9988
- '19#.#00.206.88':9988
- '19#.#00.18.130':9988
- '19#.#00.195.28':9988
- '19#.#00.140.113':9988
- '19#.#00.15.101':9988
- '19#.#00.171.50':9988
- '19#.#00.89.95':9988
- '19#.#00.99.56':9988
- '19#.#00.34.172':9988
- '19#.#00.80.243':9988
- '19#.#00.47.63':9988
- '19#.#00.49.13':9988
- '19#.#00.171.1':9988
- '19#.#00.2.180':9988
- '19#.#00.31.244':139
- '19#.#00.86.196':139
- '19#.#00.141.171':139
- '19#.#00.18.147':139
- '19#.#00.78.177':139
- '19#.#00.69.47':139
- '19#.#00.241.127':139
- '19#.#00.130.75':139
- '19#.#00.3.187':139
- '19#.#00.178.140':139
- '19#.#00.174.187':9988
- '19#.#00.16.121':9988
- '19#.#00.223.236':9988
- '19#.#00.50.156':9988
- '19#.#00.161.184':9988
- '19#.#00.51.165':139
- '19#.#00.129.135':139
- '19#.#00.94.110':139
- '19#.#00.82.17':9988
- '19#.#00.107.32':139
- '19#.#00.2.51':445
- '19#.#00.80.243':445
- '19#.#00.8.216':445
- '19#.#00.62.196':445
- '19#.#00.82.93':445
- '19#.#00.114.235':445
- '19#.#00.155.193':445
- '19#.#00.82.17':445
- '19#.#00.206.106':445
- '19#.#00.253.243':445
- '19#.#00.99.56':445
- '19#.#00.49.13':445
- '19#.#00.75.134':445
- '19#.#00.15.101':445
- '19#.#00.61.250':445
- '19#.#00.161.184':445
- '19#.#00.50.156':445
- '19#.#00.171.50':445
- '19#.#00.130.126':445
- '19#.#00.223.236':445
- '19#.#00.82.93':9988
- '19#.#00.56.28':9988
- '19#.#00.253.243':9988
- '19#.#00.62.196':9988
- '19#.#00.130.126':9988
- '19#.#00.11.85':9988
- '19#.#00.74.19':9988
- '19#.#00.179.204':9988
- '19#.#00.115.78':9988
- '19#.#00.75.134':9988
- '19#.#00.155.193':9988
- '19#.#00.202.134':9988
- '19#.#00.194.75':9988
- '19#.#00.224.166':9988
- '19#.#00.69.40':9988
- '19#.#00.8.216':9988
- '19#.#00.61.250':9988
- '19#.#00.172.183':9988
- '19#.#00.48.101':9988
- '19#.#00.87.2':9988
- '19#.#00.143.168':9988