Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WERe54d.dir00\svchost.exe.mdmp 16325836412029956
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WERe54d.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- '20#.#30.113.110':139
- '20#.#30.70.95':139
- '20#.#30.60.219':139
- '20#.#30.119.58':139
- '20#.#30.220.56':139
- '20#.#30.153.234':139
- '20#.#30.52.33':139
- '20#.#30.221.56':139
- '20#.#30.63.239':139
- '20#.#30.109.212':139
- '20#.#30.20.56':139
- '20#.#30.132.137':139
- '20#.#30.113.82':139
- '20#.#30.180.34':139
- '20#.#30.173.164':139
- '20#.#30.169.184':139
- '20#.#30.43.232':139
- '20#.#30.21.252':139
- '20#.#30.91.84':139
- '20#.#30.49.150':139
- '20#.#30.138.41':139
- '20#.#30.150.137':139
- '20#.#30.212.220':139
- '20#.#30.83.140':139
- '20#.#30.255.190':139
- '20#.#30.140.88':139
- '20#.#30.219.169':139
- '20#.#30.5.156':139
- '20#.#30.83.46':139
- '20#.#30.12.174':139
- '20#.#30.25.130':139
- '20#.#30.125.56':139
- '20#.#30.87.140':139
- '20#.#30.6.87':139
- '20#.#30.148.201':139
- '20#.#30.186.245':139
- '20#.#30.56.176':139
- '20#.#30.106.64':139
- '20#.#30.122.134':139
- '20#.#30.73.224':445
- '20#.#30.56.121':139
- '20#.#30.15.95':139
- '20#.#30.21.238':139
- '20#.#30.142.253':445
- '20#.#30.173.164':445
- '20#.#30.142.253':139
- '20#.#30.181.60':9988
- '20#.#30.97.45':9988
- '20#.#30.107.209':9988
- '20#.#30.145.19':9988
- '20#.#30.19.155':9988
- '20#.#30.98.109':9988
- '20#.#30.0.100':9988
- '20#.#30.112.149':9988
- '20#.#30.58.61':9988
- '20#.#30.1.149':9988
- '20#.#30.123.179':9988
- '20#.#30.233.167':9988
- '20#.#30.177.196':9988
- '20#.#30.59.111':9988
- '20#.#30.190.82':9988
- '20#.#30.238.75':9988
- '20#.#30.138.202':9988
- '20#.#30.109.225':9988
- '20#.#30.102.103':9988
- '20#.#30.198.163':9988
- '20#.#30.115.178':9988
- '20#.#30.167.159':9988
- '20#.#30.51.83':9988
- '20#.#30.213.240':139
- '20#.#30.135.151':139
- '20#.#30.2.165':139
- '20#.#30.123.237':9988
- '20#.#30.194.107':9988
- '20#.#30.216.93':139
- '20#.#30.135.151':445
- '20#.#30.73.224':139
- '20#.#30.216.93':445
- '20#.#30.2.165':445
- '20#.#30.213.240':445
- '20#.#30.213.161':9988
- '20#.#30.26.19':9988
- '20#.#30.194.78':9988
- '20#.#30.215.98':9988
- '20#.#30.78.248':9988
- '20#.#30.223.240':9988
- '20#.#30.84.233':9988
- '20#.#30.206.185':9988
- '20#.#30.162.125':9988
- '20#.#30.63.114':9988
- '20#.#30.98.116':9988
- '20#.#30.76.17':139
- '20#.#30.229.157':139
- '20#.#30.204.104':139
- '20#.#30.94.63':139
- '20#.#30.236.71':139
- '20#.#30.101.14':139
- '20#.#30.14.236':139
- '20#.#30.75.10':139
- '20#.#30.15.82':139
- '20#.#30.16.189':139
- '20#.#30.119.34':139
- '20#.#30.34.58':139
- '20#.#30.233.234':139
- '20#.#30.6.87':445
- '20#.#30.24.219':139
- '20#.#30.153.50':139
- '20#.#30.40.53':139
- '20#.#30.76.17':445
- '20#.#30.86.224':139
- '20#.#30.193.231':139
- '20#.#30.26.173':139
- '20#.#30.214.51':445
- '20#.#30.243.6':139
- '20#.#30.222.207':139
- '20#.#30.20.52':139
- '20#.#30.0.65':139
- '20#.#30.105.150':139
- '20#.#30.69.61':139
- '20#.#30.149.245':139
- '20#.#30.101.91':139
- '20#.#30.85.79':139
- '20#.#30.74.208':139
- '20#.#30.175.125':139
- '20#.#30.73.163':139
- '20#.#30.125.94':139
- '20#.#30.255.169':139
- '20#.#30.76.193':139
- '20#.#30.194.50':139
- '20#.#30.167.152':139
- '20#.#30.195.209':139
- '20#.#30.186.44':139
- '20#.#30.86.90':139
- '20#.#30.250.11':139
- '20#.#30.158.92':139
- '20#.#30.35.37':139
- '20#.#30.235.24':139
- '20#.#30.193.173':139
- '20#.#30.52.33':445
- '20#.#30.221.56':445
- '20#.#30.63.239':445
- '20#.#30.153.234':445
- '20#.#30.60.219':445
- '20#.#30.106.64':445
- '20#.#30.20.56':445
- '20#.#30.132.137':445
- '20#.#30.212.220':445
- '20#.#30.220.56':445
- '20#.#30.70.95':445
- '20#.#30.180.34':445
- '20#.#30.113.82':445
- '20#.#30.169.184':445
- '20#.#30.94.238':139
- '20#.#30.214.51':139
- '20#.#30.43.232':445
- '20#.#30.21.252':445
- '20#.#30.119.58':445
- '20#.#30.138.41':445
- '20#.#30.150.137':445
- '20#.#30.91.84':445
- '20#.#30.49.150':445
- '20#.#30.83.46':445
- '20#.#30.87.140':445
- '20#.#30.255.190':445
- '20#.#30.140.88':445
- '20#.#30.83.140':445
- '20#.#30.12.174':445
- '20#.#30.221.183':139
- '20#.#30.31.105':139
- '20#.#30.25.130':445
- '20#.#30.125.56':445
- '20#.#30.94.238':445
- '20#.#30.56.176':445
- '20#.#30.148.201':445
- '20#.#30.122.134':445
- '20#.#30.113.110':445
- '20#.#30.109.212':445
- '20#.#30.186.245':445
- '20#.#30.219.169':445
- '20#.#30.5.156':445
- '20#.#30.15.95':445
- '20#.#30.56.121':445
- '20#.#30.21.238':445
- '20#.#30.34.66':9988
- '20#.#30.58.61':139
- '20#.#30.190.82':139
- '20#.#30.233.58':139
- '20#.#30.63.114':139
- '20#.#30.223.240':139
- '20#.#30.206.185':139
- '20#.#30.164.139':139
- '20#.#30.11.241':139
- '20#.#30.198.163':139
- '20#.#30.202.244':139
- '20#.#30.116.183':139
- '20#.#30.145.19':139
- '20#.#30.6.126':139
- '20#.#30.59.111':139
- '20#.#30.97.45':139
- '20#.#30.0.100':139
- '20#.#30.130.181':139
- '20#.#30.138.202':139
- '20#.#30.84.233':139
- '20#.#30.107.209':139
- '20#.#30.11.192':139
- '20#.#30.115.178':139
- '20#.#30.233.167':139
- '20#.#30.6.173':445
- '20#.#30.156.101':445
- '20#.#30.121.246':445
- '20#.#30.196.138':139
- '20#.#30.208.193':445
- '20#.#30.163.240':445
- '20#.#30.215.98':445
- '20#.#30.118.188':445
- '20#.#30.128.3':445
- '20#.#30.238.197':445
- '20#.#30.11.192':445
- '20#.#30.107.237':139
- '20#.#30.239.172':139
- '20#.#30.167.159':139
- '20#.#30.60.177':139
- '20#.#30.162.125':139
- '20#.#30.112.149':139
- '20#.#30.109.234':139
- '20#.#30.19.155':139
- '20#.#30.238.75':139
- '20#.#30.103.80':139
- '20#.#30.82.52':139
- '20#.#30.220.171':139
- '20#.#30.213.161':139
- '20#.#30.82.144':139
- '20#.#30.3.164':139
- '20#.#30.208.193':139
- '20#.#30.238.197':139
- '20#.#30.30.103':139
- '20#.#30.237.155':139
- '20#.#30.166.196':139
- '20#.#30.160.9':139
- '20#.#30.194.78':139
- '20#.#30.102.84':139
- '20#.#30.118.188':139
- '20#.#30.194.107':139
- '20#.#30.121.246':139
- '20#.#30.6.173':139
- '20#.#30.102.103':139
- '20#.#30.98.109':139
- '20#.#30.51.83':139
- '20#.#30.172.196':139
- '20#.#30.71.213':139
- '20#.#30.163.240':139
- '20#.#30.156.101':139
- '20#.#30.52.105':139
- '20#.#30.43.134':139
- '20#.#30.62.17':139
- '20#.#30.123.237':139
- '20#.#30.181.60':139
- '20#.#30.52.162':139
- '20#.#30.81.122':139
- '20#.#30.78.248':139
- '20#.#30.226.101':139
- '20#.#30.34.66':139
- '20#.#30.237.190':139
- '20#.#30.98.116':139
- '20#.#30.177.196':139
- '20#.#30.215.98':139
- '20#.#30.191.78':139
- '20#.#30.200.127':139
- '20#.#30.8.191':139
- '20#.#30.123.179':139
- '20#.#30.1.149':139
- '20#.#30.26.19':139
- '20#.#30.182.179':139
- '20#.#30.128.3':139
- '20#.#30.109.225':139
- '20#.#30.82.144':445
- '20#.#30.223.240':445
- '20#.#30.239.172':445
- '20#.#30.112.149':445
- '20#.#30.60.177':445
- '20#.#30.63.114':445
- '20#.#30.107.237':445
- '20#.#30.58.61':445
- '20#.#30.19.155':445
- '20#.#30.238.75':445
- '20#.#30.82.52':445
- '20#.#30.162.125':445
- '20#.#30.116.183':445
- '20#.#30.198.163':445
- '20#.#30.202.244':445
- '20#.#30.103.80':445
- '20#.#30.190.82':445
- '20#.#30.233.167':445
- '20#.#30.138.202':445
- '20#.#30.164.139':445
- '20#.#30.84.233':445
- '20#.#30.107.209':445
- '20#.#30.11.241':445
- '20#.#30.109.234':445
- '20#.#30.160.9':9988
- '20#.#30.102.84':9988
- '20#.#30.81.122':9988
- '20#.#30.3.164':9988
- '20#.#30.237.190':9988
- '20#.#30.196.138':9988
- '20#.#30.200.127':9988
- '20#.#30.8.191':9988
- '20#.#30.172.196':9988
- '20#.#30.233.58':9988
- '20#.#30.30.103':9988
- '20#.#30.128.3':9988
- '20#.#30.156.101':9988
- '20#.#30.11.192':9988
- '20#.#30.82.144':9988
- '20#.#30.118.188':9988
- '20#.#30.6.173':9988
- '20#.#30.238.197':9988
- '20#.#30.163.240':9988
- '20#.#30.208.193':9988
- '20#.#30.121.246':9988
- '20#.#30.166.196':9988
- '20#.#30.167.159':445
- '20#.#30.237.155':445
- '20#.#30.102.84':445
- '20#.#30.194.78':445
- '20#.#30.62.17':445
- '20#.#30.30.103':445
- '20#.#30.160.9':445
- '20#.#30.81.122':445
- '20#.#30.237.190':445
- '20#.#30.191.78':445
- '20#.#30.200.127':445
- '20#.#30.8.191':445
- '20#.#30.51.83':445
- '20#.#30.194.107':445
- '20#.#30.172.196':445
- '20#.#30.3.164':445
- '20#.#30.166.196':445
- '20#.#30.98.109':445
- '20#.#30.123.237':445
- '20#.#30.43.134':445
- '20#.#30.52.162':445
- '20#.#30.71.213':445
- '20#.#30.109.225':445
- '20#.#30.98.116':445
- '20#.#30.196.138':445
- '20#.#30.130.181':445
- '20#.#30.6.126':445
- '20#.#30.182.179':445
- '20#.#30.1.149':445
- '20#.#30.26.19':445
- '20#.#30.181.60':445
- '20#.#30.123.179':445
- '20#.#30.213.161':445
- '20#.#30.233.58':445
- '20#.#30.206.185':445
- '20#.#30.220.171':445
- '20#.#30.115.178':445
- '20#.#30.226.101':445
- '20#.#30.34.66':445
- '20#.#30.78.248':445
- '20#.#30.102.103':445
- '20#.#30.145.19':445
- '20#.#30.59.111':445
- '20#.#30.0.100':445
- '20#.#30.97.45':445
- '20#.#30.177.196':445