Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1124 -dm 7 7 %TEMP%\WER21ce.dir00\svchost.exe.mdmp 16325836412032892
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WER21ce.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- '64.##8.158.113':445
- '64.##8.159.181':445
- '64.##8.175.188':445
- '64.##8.163.18':445
- '64.#38.86.4':445
- '64.#38.80.7':445
- '64.##8.192.231':445
- '64.##8.126.74':445
- '64.##8.44.50':445
- '64.##8.215.118':139
- '64.##8.90.184':139
- '64.#38.80.7':139
- '64.##8.145.79':139
- '64.##8.211.90':139
- '64.##8.167.63':139
- '64.#38.6.94':139
- '64.##8.246.128':139
- '64.##8.255.131':139
- '64.#38.5.40':445
- '64.##8.65.104':139
- '64.##8.92.27':139
- '64.#38.6.94':445
- '64.#38.47.6':139
- '64.##8.220.179':139
- '64.##8.190.231':139
- '64.##8.236.9':139
- '64.##8.46.19':139
- '64.##8.28.243':139
- '64.##8.172.162':445
- '64.##8.215.118':445
- '64.##8.145.79':445
- '64.##8.103.113':445
- '64.##8.90.184':445
- '64.##8.255.131':445
- '64.##8.167.63':445
- '64.##8.211.90':445
- '64.##8.246.128':445
- '64.##8.51.109':445
- '64.##8.35.52':445
- '64.##8.8.132':445
- '64.##8.86.236':445
- '64.##8.80.29':445
- '64.##8.104.138':445
- '64.##8.135.238':445
- '64.##8.23.115':445
- '64.##8.242.175':445
- '64.##8.28.118':445
- '64.##8.72.28':445
- '64.##8.41.68':445
- '64.##8.142.233':445
- '64.##8.87.207':445
- '64.##8.88.221':445
- '64.##8.156.0':445
- '64.##8.149.70':445
- '64.##8.70.199':445
- '64.##8.121.237':445
- '64.##8.103.113':139
- '64.##8.44.50':139
- '64.#38.86.4':139
- '64.##8.175.188':139
- '64.##8.126.74':139
- '64.##8.159.181':139
- '64.##8.192.231':139
- '64.##8.158.113':139
- '64.#38.5.40':139
- '64.##8.95.87':445
- '64.##8.196.148':445
- '64.##8.113.170':445
- '64.##8.47.128':445
- '64.##8.217.110':445
- '64.##8.163.18':139
- '64.##8.172.162':139
- '64.##8.88.48':445
- '64.##8.18.61':445
- '64.##8.146.165':445
- '64.##8.10.84':445
- '64.##8.92.220':445
- '64.##8.30.243':445
- '64.##8.48.100':445
- '64.#38.5.86':445
- '64.##8.55.155':139
- '64.##8.136.129':445
- '64.##8.141.17':445
- '64.##8.99.56':445
- '64.##8.82.191':445
- '64.##8.219.25':445
- '64.##8.203.79':445
- '64.##8.129.251':445
- '64.##8.113.44':445
- '64.##8.16.232':445
- '64.##8.231.243':445
- '64.##8.44.146':445
- '64.##8.23.158':139
- '64.##8.216.225':139
- '64.##8.148.33':139
- '64.##8.159.183':139
- '64.##8.218.97':139
- '64.##8.120.148':139
- '64.##8.12.97':139
- '64.##8.27.32':139
- '64.##8.72.36':139
- '64.##8.166.50':139
- '64.##8.236.60':139
- '64.##8.224.235':139
- '64.##8.185.118':139
- '64.##8.61.40':139
- '64.##8.115.126':139
- '64.##8.55.238':139
- '64.##8.31.76':139
- '64.##8.198.56':139
- '64.#38.69.1':139
- '64.##8.231.243':139
- '64.##8.113.44':139
- '64.##8.129.251':139
- '64.##8.82.191':139
- '64.##8.44.146':139
- '64.##8.92.220':139
- '64.##8.30.243':139
- '64.##8.16.232':139
- '64.##8.136.129':139
- '64.#38.7.66':139
- '64.##8.203.79':139
- '64.##8.80.20':139
- '64.##8.85.227':139
- '64.##8.219.25':139
- '64.##8.54.251':139
- '64.##8.99.56':139
- '64.##8.26.244':139
- '64.##8.89.241':139
- '64.##8.146.165':139
- '64.##8.80.20':445
- '64.##8.28.243':445
- '64.##8.190.231':445
- '64.##8.236.9':445
- '64.##8.89.241':445
- '64.#38.7.66':445
- '64.##8.54.251':445
- '64.##8.85.227':445
- '64.##8.26.244':445
- '64.#38.5.86':139
- '64.##8.48.100':139
- '64.##8.141.17':139
- '64.##8.10.84':139
- '64.#38.47.6':445
- '64.##8.92.27':445
- '64.##8.46.19':445
- '64.##8.65.104':445
- '64.##8.220.179':445
- '64.##8.50.47':139
- '64.##8.240.50':139
- '64.##8.157.197':139
- '64.##8.160.167':139
- '64.##8.213.240':139
- '64.##8.252.49':445
- '64.##8.57.200':445
- '64.##8.90.221':445
- '64.##8.175.253':445
- '64.##8.93.149':139
- '64.##8.118.18':139
- '64.##8.28.43':139
- '64.##8.239.181':139
- '64.##8.40.132':139
- '64.##8.179.248':139
- '64.##8.197.198':139
- '64.##8.117.112':139
- '64.##8.172.18':139
- '64.##8.252.203':445
- '64.##8.93.116':445
- '64.##8.179.188':445
- '64.##8.239.121':445
- '64.##8.140.101':445
- '64.##8.205.139':445
- '64.##8.174.61':445
- '64.##8.15.249':445
- '64.##8.213.60':445
- '64.##8.43.12':445
- '64.##8.50.164':445
- '64.##8.232.249':445
- '64.##8.56.206':445
- '64.##8.122.50':445
- '64.##8.221.56':445
- '64.##8.184.222':445
- '64.##8.241.119':445
- '64.##8.47.190':445
- '64.##8.63.205':445
- '64.##8.232.249':139
- '64.##8.239.121':139
- '64.##8.122.50':139
- '64.##8.50.164':139
- '64.##8.140.101':139
- '64.##8.85.205':139
- '64.##8.93.116':139
- '64.##8.184.222':139
- '64.##8.241.119':139
- '64.##8.90.221':139
- '64.##8.175.253':139
- '64.##8.252.49':139
- '64.##8.56.206':139
- '64.##8.57.200':139
- '64.##8.47.190':139
- '64.##8.63.205':139
- '64.##8.252.203':139
- '64.##8.221.56':139
- '64.##8.205.139':139
- '64.##8.66.235':139
- '64.##8.196.227':139
- '64.##8.194.43':139
- '64.##8.97.199':139
- '64.##8.148.94':139
- '64.##8.133.81':139
- '64.##8.97.160':139
- '64.##8.181.96':139
- '64.##8.248.129':139
- '64.##8.179.188':139
- '64.##8.213.60':139
- '64.##8.12.56':139
- '64.##8.43.12':139
- '64.##8.15.249':139
- '64.##8.101.8':139
- '64.##8.85.231':139
- '64.##8.200.173':139
- '64.##8.174.61':139
- '64.##8.90.98':139
- '64.##8.118.92':139
- '64.##8.69.183':139
- '64.##8.87.207':139
- '64.##8.28.118':139
- '64.##8.88.221':139
- '64.##8.142.233':139
- '64.##8.80.29':139
- '64.##8.72.28':139
- '64.##8.47.128':139
- '64.##8.113.170':139
- '64.##8.252.203':9988
- '64.##8.196.148':139
- '64.##8.51.109':139
- '64.##8.119.231':139
- '64.##8.165.140':139
- '64.##8.8.132':139
- '64.##8.149.70':139
- '64.##8.23.115':139
- '64.##8.88.48':139
- '64.##8.18.61':139
- '64.##8.70.199':139
- '64.##8.217.110':139
- '64.##8.119.231':445
- '64.##8.90.98':445
- '64.##8.118.92':445
- '64.##8.165.140':445
- '64.##8.69.183':445
- '64.##8.104.138':139
- '64.##8.95.87':139
- '64.##8.41.68':139
- '64.##8.135.238':139
- '64.##8.242.175':139
- '64.##8.156.0':139
- '64.##8.86.236':139
- '64.##8.35.52':139
- '64.##8.121.237':139
- '64.##8.181.96':445
- '64.##8.133.81':445
- '64.##8.148.94':445
- '64.##8.248.129':445
- '64.##8.97.160':445
- '64.##8.28.43':445
- '64.##8.118.18':445
- '64.##8.239.181':445
- '64.##8.93.149':445
- '64.##8.101.8':445
- '64.##8.200.173':445
- '64.##8.12.56':445
- '64.##8.85.231':445
- '64.##8.194.43':445
- '64.##8.66.235':445
- '64.##8.196.227':445
- '64.##8.85.205':445
- '64.##8.97.199':445
- '64.##8.40.132':445
- '64.##8.175.253':9988
- '64.##8.57.200':9988
- '64.##8.90.221':9988
- '64.##8.252.49':9988
- '64.##8.239.121':9988
- '64.##8.43.12':9988
- '64.##8.66.235':9988
- '64.##8.174.61':9988
- '64.##8.85.231':9988
- '64.##8.172.18':445
- '64.##8.197.198':445
- '64.##8.179.248':445
- '64.##8.117.112':445
- '64.##8.157.197':445
- '64.##8.240.50':445
- '64.##8.213.240':445
- '64.##8.160.167':445
- '64.##8.50.47':445