Technical Information
- %WINDIR%\Tasks\SA.DAT
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1140 -dm 7 7 %TEMP%\WER847a.dir00\svchost.exe.mdmp 16325836412032548
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- <SYSTEM32>\urdvxc.exe
- %TEMP%\WER847a.dir00\svchost.exe.mdmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- '22#.#11.242.152':139
- '22#.#11.140.250':139
- '22#.#11.80.96':139
- '22#.#11.153.132':139
- '22#.#11.6.191':139
- '22#.#11.150.205':139
- '22#.#11.190.145':139
- '22#.#11.235.47':139
- '22#.#11.143.179':139
- '22#.#11.194.143':139
- '22#.#11.180.20':139
- '22#.#11.81.128':139
- '22#.#11.62.227':139
- '22#.#11.79.220':139
- '22#.#11.154.184':445
- '22#.#11.189.138':445
- '22#.#11.31.47':139
- '22#.#11.127.49':139
- '22#.#11.32.2':139
- '22#.#11.31.208':139
- '22#.#11.87.113':139
- '22#.#11.70.18':139
- '22#.#11.155.235':139
- '22#.#11.3.111':445
- '22#.#11.34.111':445
- '22#.#11.204.46':445
- '22#.#11.155.98':445
- '22#.#11.167.56':445
- '22#.#11.55.86':445
- '22#.#11.37.185':445
- '22#.#11.84.101':445
- '22#.#11.216.21':445
- '22#.#11.248.18':445
- '22#.#11.3.248':445
- '22#.#11.98.119':139
- '22#.#11.63.90':139
- '22#.#11.177.90':139
- '22#.#11.239.155':139
- '22#.#11.255.175':139
- '22#.#11.169.216':139
- '22#.#11.39.13':139
- '22#.#11.40.43':139
- '22#.#11.233.79':139
- '22#.#11.171.9':139
- '22#.#11.121.184':139
- '22#.#11.103.228':445
- '22#.#11.100.244':445
- '22#.#11.210.245':445
- '22#.#11.79.204':445
- '22#.#11.88.105':445
- '22#.#11.24.152':445
- '22#.#11.13.48':445
- '22#.#11.163.176':445
- '22#.#11.241.114':445
- '22#.#11.39.119':445
- '22#.#11.134.144':445
- '22#.#11.40.244':445
- '22#.#11.11.120':445
- '22#.#11.241.240':445
- '22#.#11.55.138':445
- '22#.#11.108.193':445
- '22#.#11.71.204':445
- '22#.#11.37.50':445
- '22#.#11.206.50':445
- '22#.#11.215.25':445
- '22#.#11.71.79':445
- '22#.#11.43.178':445
- '22#.#11.178.101':445
- '22#.#11.122.79':139
- '22#.#11.216.21':139
- '22#.#11.37.185':139
- '22#.#11.3.248':139
- '22#.#11.55.86':139
- '22#.#11.248.18':139
- '22#.#11.84.101':139
- '22#.#11.74.176':445
- '22#.#11.19.53':445
- '22#.#11.16.240':445
- '22#.#11.220.133':139
- '22#.#11.122.79':445
- '22#.#11.189.138':139
- '22#.#11.74.176':139
- '22#.#11.154.184':139
- '22#.#11.16.240':139
- '22#.#11.19.53':139
- '22#.#11.103.228':139
- '22#.#11.3.111':139
- '22#.#11.34.111':139
- '22#.#11.204.46':139
- '22#.#11.155.98':139
- '22#.#11.167.56':139
- '22#.#11.47.202':139
- '22#.#11.99.119':139
- '22#.#11.238.219':139
- '22#.#11.179.113':139
- '22#.#11.114.45':139
- '22#.#11.26.90':139
- '22#.#11.134.160':139
- '22#.#11.26.170':139
- '22#.#11.85.252':139
- '22#.#11.27.140':139
- '22#.#11.11.116':139
- '22#.#11.211.33':139
- '22#.#11.184.174':139
- '22#.#11.218.224':139
- '22#.#11.32.69':445
- '22#.#11.12.130':139
- '22#.#11.116.4':139
- '22#.#11.185.44':139
- '22#.#11.6.16':139
- '22#.#11.231.2':139
- '22#.#11.4.39':139
- '22#.#11.85.53':139
- '22#.#11.211.163':139
- '22#.#11.92.156':139
- '22#.#11.32.191':139
- '22#.#11.143.85':139
- '22#.#11.53.12':139
- '22#.#11.85.141':139
- '22#.#11.73.55':139
- '22#.#11.26.170':445
- '22#.#11.102.234':445
- '22#.#11.42.204':139
- '22#.#11.79.87':139
- '22#.#11.82.158':139
- '22#.#11.20.232':139
- '22#.#11.32.45':139
- '22#.#11.17.91':139
- '22#.#11.77.91':139
- '22#.#11.100.190':139
- '22#.#11.234.239':139
- '22#.#11.13.92':139
- '22#.#11.40.51':139
- '22#.#11.252.6':139
- '22#.#11.102.234':139
- '22#.#11.141.102':139
- '22#.#11.135.91':445
- '22#.#11.80.96':445
- '22#.#11.190.145':445
- '22#.#11.155.235':445
- '22#.#11.242.152':445
- '22#.#11.140.250':445
- '22#.#11.235.47':445
- '22#.#11.143.179':445
- '22#.#11.180.20':445
- '22#.#11.6.191':445
- '22#.#11.255.175':445
- '22#.#11.239.155':445
- '22#.#11.31.208':445
- '22#.#11.87.113':445
- '22#.#11.81.128':445
- '22#.#11.220.133':445
- '22#.#11.79.220':445
- '22#.#11.32.2':445
- '22#.#11.127.49':445
- '22#.#11.153.132':445
- '22#.#11.62.227':445
- '22#.#11.70.18':445
- '22#.#11.31.47':445
- '22#.#11.194.143':445
- '22#.#11.137.5':139
- '22#.#11.135.91':139
- '22#.#11.118.167':139
- '22#.#11.34.250':139
- '22#.#11.187.107':139
- '22#.#11.32.69':139
- '22#.#11.118.167':445
- '22#.#11.137.5':445
- '22#.#11.241.108':445
- '22#.#11.34.250':445
- '22#.#11.187.107':445
- '22#.#11.63.90':445
- '22#.#11.169.216':445
- '22#.#11.98.119':445
- '22#.#11.177.90':445
- '22#.#11.150.205':445
- '22#.#11.171.9':445
- '22#.#11.40.43':445
- '22#.#11.241.108':139
- '22#.#11.39.13':445
- '22#.#11.233.79':445
- '22#.#11.121.184':445
- '22#.#11.43.77':445
- '22#.#11.7.18':445
- '22#.#11.77.197':445
- '22#.#11.121.44':445
- '22#.#11.32.30':445
- '22#.#11.222.187':445
- '22#.#11.84.186':445
- '22#.#11.38.239':445
- '22#.#11.25.203':445
- '22#.#11.97.65':445
- '22#.#11.158.150':445
- '22#.#11.168.76':445
- '22#.#11.134.138':139
- '22#.#11.43.212':139
- '22#.#11.160.196':139
- '22#.#11.62.230':139
- '22#.#11.196.168':139
- '22#.#11.201.90':445
- '22#.#11.125.205':445
- '22#.#11.30.80':445
- '22#.#11.155.146':445
- '22#.#11.200.125':445
- '22#.#11.168.14':445
- '22#.#11.222.1':445
- '22#.#11.48.155':445
- '22#.#11.129.59':445
- '22#.#11.30.193':445
- '22#.#11.141.56':445
- '22#.#11.192.141':445
- '22#.#11.44.71':445
- '22#.#11.230.72':445
- '22#.#11.218.229':445
- '22#.#11.12.178':445
- '22#.#11.90.109':445
- '22#.#11.5.87':445
- '22#.#11.168.22':445
- '22#.#11.93.167':445
- '22#.#11.221.78':445
- '22#.#11.166.203':445
- '22#.#11.201.88':445
- '22#.#11.191.93':445
- '22#.#11.227.88':445
- '22#.#11.56.243':445
- '22#.#11.105.201':445
- '22#.#11.90.191':445
- '22#.#11.94.233':445
- '22#.#11.32.9':139
- '22#.#11.97.65':139
- '22#.#11.38.239':139
- '22#.#11.168.76':139
- '22#.#11.84.186':139
- '22#.#11.158.150':139
- '22#.#11.25.203':139
- '22#.#11.221.78':139
- '22#.#11.168.22':139
- '22#.#11.201.88':139
- '22#.#11.222.1':139
- '22#.#11.166.203':139
- '22#.#11.155.146':139
- '22#.#11.125.205':139
- '22#.#11.168.14':139
- '22#.#11.201.90':139
- '22#.#11.200.125':139
- '22#.#11.32.30':139
- '22#.#11.7.18':139
- '22#.#11.77.197':139
- '22#.#11.121.44':139
- '22#.#11.30.80':139
- '22#.#11.222.187':139
- '22#.#11.93.167':139
- '22#.#11.12.178':139
- '22#.#11.230.72':139
- '22#.#11.5.87':139
- '22#.#11.44.71':139
- '22#.#11.90.109':139
- '22#.#11.218.229':139
- '22#.#11.180.1':139
- '22#.#11.109.229':139
- '22#.#11.17.24':139
- '22#.#11.11.15':139
- '22#.#11.131.123':139
- '22#.#11.105.201':139
- '22#.#11.227.88':139
- '22#.#11.94.233':139
- '22#.#11.191.93':139
- '22#.#11.90.191':139
- '22#.#11.56.243':139
- '22#.#11.48.155':139
- '22#.#11.129.59':139
- '22#.#11.30.193':139
- '22#.#11.141.56':139
- '22#.#11.192.141':139
- '22#.#11.55.138':139
- '22#.#11.88.105':139
- '22#.#11.71.204':139
- '22#.#11.43.77':139
- '22#.#11.108.193':139
- '22#.#11.37.50':139
- '22#.#11.215.25':139
- '22#.#11.100.244':139
- '22#.#11.241.240':139
- '22#.#11.11.120':139
- '22#.#11.206.50':139
- '22#.#11.244.216':139
- '22#.#11.79.237':139
- '22#.#11.212.81':139
- '22#.#11.58.135':139
- '22#.#11.129.188':139
- '22#.#11.69.130':139
- '22#.#11.79.43':139
- '22#.#11.244.20':139
- '22#.#11.191.234':139
- '22#.#11.167.77':139
- '22#.#11.221.204':139
- '22#.#11.178.101':139
- '22#.#11.58.135':445
- '22#.#11.69.130':445
- '22#.#11.244.216':445
- '22#.#11.79.237':445
- '22#.#11.212.81':445
- '22#.#11.191.234':445
- '22#.#11.79.43':445
- '22#.#11.244.20':445
- '22#.#11.221.204':445
- '22#.#11.167.77':445
- '22#.#11.129.188':445
- '22#.#11.71.79':139
- '22#.#11.163.176':139
- '22#.#11.39.119':139
- '22#.#11.43.178':139
- '22#.#11.24.152':139
- '22#.#11.40.244':139
- '22#.#11.134.144':139
- '22#.#11.13.48':139
- '22#.#11.210.245':139
- '22#.#11.79.204':139
- '22#.#11.241.114':139
- '22#.#11.168.14':9988
- '22#.#11.201.88':9988
- '22#.#11.30.193':9988
- '22#.#11.125.205':9988
- '22#.#11.93.167':9988
- '22#.#11.222.187':9988
- '22#.#11.97.65':9988
- '22#.#11.200.125':9988
- '22#.#11.166.203':9988
- '22#.#11.32.30':9988
- '22#.#11.56.243':9988
- '22#.#11.77.197':9988
- '22#.#11.180.1':445
- '22#.#11.109.229':445
- '22#.#11.131.123':445
- '22#.#11.11.15':445
- '22#.#11.17.24':445
- '22#.#11.32.9':445
- '22#.#11.134.138':445
- '22#.#11.43.212':445
- '22#.#11.160.196':445
- '22#.#11.62.230':445
- '22#.#11.196.168':445
- '22#.#11.201.90':9988
- '22#.#11.44.71':9988
- '22#.#11.62.230':9988
- '22#.#11.134.138':9988
- '22#.#11.5.87':9988
- '22#.#11.109.229':9988
- '22#.#11.227.88':9988
- '22#.#11.7.18':9988
- '22#.#11.168.22':9988
- '22#.#11.221.78':9988
- '22#.#11.141.56':9988
- '22#.#11.90.109':9988
- '22#.#11.180.1':9988
- '22#.#11.12.178':9988
- '22#.#11.131.123':9988
- '22#.#11.218.229':9988
- '22#.#11.17.24':9988
- '22#.#11.196.168':9988
- '22#.#11.43.212':9988
- '22#.#11.11.15':9988
- '22#.#11.48.155':9988
- '22#.#11.160.196':9988
- '22#.#11.129.59':9988