Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\dumprep.exe' 1136 -dm 7 7 %TEMP%\WER9c60.dir00\svchost.exe.mdmp 16325836412032532
- %TEMP%\WER9c60.dir00\svchost.exe.mdmp
- <SYSTEM32>\urdvxc.exe
- '20#.#5.190.254':445
- '20#.#5.38.166':445
- '20#.#5.103.57':445
- '20#.#5.161.73':445
- '20#.#5.158.160':445
- '20#.#5.22.209':445
- '20#.#5.18.29':445
- '20#.#5.42.202':445
- '20#.#5.58.53':445
- '20#.#5.166.243':445
- '20#.#5.198.161':445
- '20#.#5.16.142':445
- '20#.#5.220.25':445
- '20#.#5.39.120':445
- '20#.#5.170.234':445
- '20#.#5.129.170':445
- '20#.#5.133.34':139
- '20#.#5.76.220':139
- '20#.#5.43.201':139
- '20#.#5.77.149':445
- '20#.#5.6.226':445
- '20#.#5.82.205':445
- '20#.#5.208.74':445
- '20#.#5.254.188':445
- '20#.#5.85.176':445
- '20#.#5.33.222':445
- '20#.#5.76.220':445
- '20#.#5.43.201':445
- '20#.#5.15.188':139
- '20#.#5.54.75':445
- '20#.65.7.65':445
- '20#.#5.133.34':445
- '20#.#5.10.164':139
- '20#.#5.187.132':139
- '20#.#5.3.176':139
- '20#.#5.15.65':139
- '20#.#5.10.164':445
- '20#.#5.219.10':139
- '20#.#5.132.219':139
- '20#.#5.60.230':445
- '20#.#5.39.60':445
- '20#.65.7.32':445
- '20#.#5.91.199':445
- '20#.#5.49.151':445
- '20#.#5.169.68':445
- '20#.#5.247.184':445
- '20#.#5.80.40':445
- '20#.#5.92.106':445
- '20#.#5.76.92':445
- '20#.#5.186.247':445
- '20#.#5.215.197':445
- '20#.#5.130.183':445
- '20#.65.7.65':139
- '20#.#5.170.234':139
- '20#.#5.129.170':139
- '20#.#5.77.149':139
- '20#.#5.188.194':139
- '20#.#5.188.194':445
- '20#.#5.39.120':139
- '20#.#5.254.188':139
- '20#.#5.82.205':139
- '20#.#5.208.74':139
- '20#.#5.161.73':139
- '20#.#5.85.176':139
- '20#.#5.33.222':139
- '20#.#5.6.226':139
- '20#.#5.102.204':139
- '20#.#5.150.77':445
- '20#.#5.237.93':445
- '20#.#5.105.222':139
- '20#.#5.12.137':139
- '20#.#5.230.49':139
- '20#.#5.11.153':445
- '20#.#5.12.137':445
- '20#.#5.230.49':445
- '20#.#5.102.204':445
- '20#.#5.36.188':445
- '20#.#5.20.169':445
- '20#.#5.105.222':445
- '20#.#5.39.60':139
- '20#.65.7.32':139
- '20#.#5.247.184':139
- '20#.#5.49.151':139
- '20#.#5.169.68':139
- '20#.#5.60.230':139
- '20#.#5.186.247':139
- '20#.#5.92.106':139
- '20#.#5.76.92':139
- '20#.#5.54.75':139
- '20#.#5.215.197':139
- '20#.#5.130.183':139
- '20#.#5.80.40':139
- '20#.#5.38.166':139
- '20#.#5.103.57':139
- '20#.#5.18.29':139
- '20#.#5.158.160':139
- '20#.#5.22.209':139
- '20#.#5.190.254':139
- '20#.#5.198.161':139
- '20#.#5.58.53':139
- '20#.#5.166.243':139
- '20#.#5.91.199':139
- '20#.#5.16.142':139
- '20#.#5.220.25':139
- '20#.#5.42.202':139
- '20#.#5.196.214':445
- '20#.#5.141.196':445
- '20#.#5.102.245':445
- '20#.#5.26.56':445
- '20#.#5.43.39':445
- '20#.#5.211.189':445
- '20#.#5.32.159':445
- '20#.65.5.55':445
- '20#.#5.95.198':445
- '20#.#5.192.212':445
- '20#.#5.238.102':445
- '20#.#5.70.157':445
- '20#.#5.157.8':445
- '20#.#5.50.221':445
- '20#.#5.247.77':445
- '20#.#5.145.111':445
- '20#.#5.105.195':139
- '20#.#5.195.216':445
- '20#.#5.225.96':445
- '20#.#5.37.221':445
- '20#.#5.176.175':445
- '20#.#5.135.22':445
- '20#.#5.216.181':445
- '20#.#5.18.124':445
- '20#.65.2.76':445
- '20#.#5.175.2':445
- '20#.#5.89.103':445
- '20#.#5.72.118':445
- '20#.#5.105.195':445
- '20#.65.33.1':445
- '20#.#5.137.190':445
- '20#.#5.200.215':445
- '20#.65.4.17':139
- '20#.#5.229.68':139
- '20#.#5.125.250':139
- '20#.#5.236.78':139
- '20#.#5.225.0':139
- '20#.#5.86.34':139
- '20#.#5.131.12':139
- '20#.#5.208.183':445
- '20#.#5.154.4':445
- '20#.#5.102.169':445
- '20#.#5.124.217':445
- '20#.#5.69.75':445
- '20#.#5.176.33':445
- '20#.#5.109.243':445
- '20#.#5.185.204':445
- '20#.#5.156.119':445
- '20#.#5.61.235':445
- '20#.#5.217.224':445
- '20#.#5.108.92':445
- '20#.#5.204.108':445
- '20#.#5.72.118':139
- '20#.#5.18.124':139
- '20#.65.2.76':139
- '20#.#5.175.2':139
- '20#.#5.247.77':139
- '20#.#5.145.111':139
- '20#.#5.37.221':139
- '20#.#5.176.175':139
- '20#.#5.43.39':139
- '20#.#5.211.189':139
- '20#.#5.196.214':139
- '20#.#5.135.22':139
- '20#.#5.216.181':139
- '20#.#5.26.56':139
- '20#.#5.15.188':445
- '20#.#5.219.10':445
- '20#.#5.132.219':445
- '20#.#5.165.221':139
- '20#.#5.159.196':139
- '20#.#5.62.104':139
- '20#.#5.187.132':445
- '20#.#5.195.216':139
- '20#.#5.225.96':139
- '20#.#5.50.221':139
- '20#.#5.3.176':445
- '20#.#5.15.65':445
- '20#.#5.62.104':445
- '20#.#5.217.224':139
- '20#.#5.108.92':139
- '20#.#5.204.108':139
- '20#.#5.154.4':139
- '20#.#5.102.169':139
- '20#.#5.109.243':139
- '20#.#5.185.204':139
- '20#.#5.137.190':139
- '20#.#5.200.215':139
- '20#.#5.89.103':139
- '20#.#5.156.119':139
- '20#.#5.61.235':139
- '20#.65.33.1':139
- '20#.#5.238.102':139
- '20#.#5.70.157':139
- '20#.#5.157.8':139
- '20#.#5.141.196':139
- '20#.#5.32.159':139
- '20#.#5.102.245':139
- '20#.65.5.55':139
- '20#.#5.69.75':139
- '20#.#5.176.33':139
- '20#.#5.208.183':139
- '20#.#5.95.198':139
- '20#.#5.192.212':139
- '20#.#5.124.217':139
- '20#.#5.64.15':445
- '20#.#5.49.246':445
- '20#.#5.117.41':445
- '20#.#5.205.160':445
- '20#.#5.234.205':445
- '20#.#5.184.23':445
- '20#.#5.243.141':445
- '20#.#5.69.48':445
- '20#.#5.134.247':445
- '20#.65.72.7':445
- '20#.#5.163.222':445
- '20#.#5.165.133':445
- '20#.#5.134.48':445
- '20#.65.2.51':445
- '20#.#5.184.121':445
- '20#.#5.179.28':445
- '20#.#5.194.179':445
- '20#.#5.198.248':445
- '20#.#5.4.140':445
- '20#.#5.29.140':445
- '20#.#5.117.138':445
- '20#.#5.223.93':445
- '20#.#5.59.201':445
- '20#.#5.115.187':445
- '20#.#5.128.143':445
- '20#.#5.34.147':445
- '20#.#5.118.124':445
- '20#.#5.86.153':445
- '20#.#5.61.91':445
- '20#.#5.148.241':445
- '20#.#5.41.145':445
- '20#.#5.124.53':445
- '20#.#5.22.179':445
- '20#.#5.223.93':9988
- '20#.65.2.51':9988
- '20#.#5.194.179':9988
- '20#.#5.78.112':445
- '20#.#5.169.78':445
- '20#.#5.128.150':445
- '20#.#5.255.32':445
- '20#.#5.166.38':445
- '20#.#5.224.156':445
- '20#.#5.132.14':445
- '20#.#5.207.131':445
- '20#.#5.243.48':445
- '20#.#5.182.64':445
- '20#.#5.228.208':445
- '20#.#5.84.228':445
- '20#.#5.179.84':445
- '20#.#5.226.103':445
- '20#.#5.58.226':445
- '20#.#5.73.71':445
- '20#.#5.96.16':445
- '20#.#5.234.205':139
- '20#.#5.184.23':139
- '20#.#5.64.15':139
- '20#.#5.223.93':139
- '20#.#5.59.201':139
- '20#.#5.205.160':139
- '20#.#5.49.246':139
- '20#.#5.165.133':139
- '20#.#5.134.48':139
- '20#.#5.69.48':139
- '20#.#5.117.41':139
- '20#.#5.243.141':139
- '20#.#5.163.222':139
- '20#.#5.4.140':139
- '20#.#5.194.179':139
- '20#.65.2.51':139
- '20#.#5.96.16':139
- '20#.#5.140.229':139
- '20#.#5.198.248':139
- '20#.#5.184.121':139
- '20#.#5.128.143':139
- '20#.#5.34.147':139
- '20#.#5.117.138':139
- '20#.#5.179.28':139
- '20#.#5.29.140':139
- '20#.#5.115.187':139
- '20#.#5.41.145':139
- '20#.#5.124.53':139
- '20#.#5.118.124':139
- '20#.#5.84.228':139
- '20#.#5.179.84':139
- '20#.#5.148.241':139
- '20#.#5.86.153':139
- '20#.#5.169.78':139
- '20#.#5.128.150':139
- '20#.#5.140.229':445
- '20#.#5.61.91':139
- '20#.#5.22.179':139
- '20#.#5.78.112':139
- '20#.#5.207.131':139
- '20#.#5.243.48':139
- '20#.#5.255.32':139
- '20#.#5.134.247':139
- '20#.65.72.7':139
- '20#.#5.132.14':139
- '20#.#5.166.38':139
- '20#.#5.58.226':139
- '20#.#5.73.71':139
- '20#.#5.228.208':139
- '20#.#5.224.156':139
- '20#.#5.182.64':139
- '20#.#5.226.103':139
- '20#.#5.170.248':445
- '20#.#5.116.131':445
- '20#.#5.73.230':445
- '20#.#5.55.123':445
- '20#.#5.21.213':445
- '20#.#5.248.205':445
- '20#.#5.29.61':445
- '20#.#5.31.222':445
- '20#.#5.165.31':445
- '20#.#5.116.55':445
- '20#.#5.124.229':445
- '20#.#5.221.207':445
- '20#.#5.221.221':445
- '20#.#5.128.3':139
- '20#.#5.97.98':139
- '20#.#5.248.116':445
- '20#.#5.165.129':139
- '20#.#5.192.121':139
- '20#.#5.70.215':139
- '20#.#5.118.210':445
- '20#.#5.112.196':445
- '20#.#5.8.227':445
- '20#.#5.13.139':445
- '20#.#5.241.54':445
- '20#.#5.39.47':445
- '20#.#5.135.4':445
- '20#.#5.129.109':445
- '20#.#5.192.121':445
- '20#.#5.70.215':445
- '20#.#5.85.183':445
- '20#.#5.112.8':445
- '20#.#5.3.162':445
- '20#.#5.128.3':445
- '20#.#5.11.153':139
- '20#.#5.36.188':139
- '20#.#5.20.169':139
- '20#.#5.97.98':445
- '20#.#5.150.77':139
- '20#.#5.237.93':139
- '20#.#5.82.253':445
- '20#.#5.225.21':445
- '20#.#5.80.37':445
- '20#.#5.142.210':445
- '20#.#5.37.68':445
- '20#.#5.56.46':445
- '20#.#5.202.160':445
- '20#.#5.225.165':445
- '20#.#5.170.31':445
- '20#.#5.212.61':445
- '20#.#5.111.116':445
- '20#.#5.218.110':445
- '20#.#5.165.249':445
- '20#.#5.129.109':139
- '20#.#5.13.139':139
- '20#.#5.73.84':139
- '20#.#5.227.62':139
- '20#.#5.135.4':139
- '20#.#5.112.196':139
- '20#.#5.8.227':139
- '20#.#5.55.123':139
- '20#.#5.216.79':139
- '20#.#5.116.131':139
- '20#.#5.73.230':139
- '20#.#5.21.213':139
- '20#.#5.248.205':139
- '20#.#5.170.248':139
- '20#.#5.134.48':9988
- '20#.#5.132.14':9988
- '20#.#5.207.131':9988
- '20#.#5.198.248':9988
- '20#.#5.243.141':9988
- '20#.#5.163.222':9988
- '20#.#5.243.48':9988
- '20#.#5.118.210':139
- '20#.#5.241.54':139
- '20#.#5.39.47':139
- '20#.#5.182.64':9988
- '20#.#5.61.91':9988
- '20#.#5.248.116':139
- '20#.#5.111.116':139
- '20#.#5.218.110':139
- '20#.#5.215.246':139
- '20#.#5.225.21':139
- '20#.#5.80.37':139
- '20#.#5.202.160':139
- '20#.#5.165.249':139
- '20#.#5.85.183':139
- '20#.#5.112.8':139
- '20#.#5.3.162':139
- '20#.#5.225.165':139
- '20#.#5.170.31':139
- '20#.#5.212.61':139
- '20#.#5.221.207':139
- '20#.#5.221.221':139
- '20#.#5.31.222':139
- '20#.#5.29.61':139
- '20#.#5.238.153':139
- '20#.#5.124.229':139
- '20#.#5.165.31':139
- '20#.#5.37.68':139
- '20#.#5.56.46':139
- '20#.#5.82.253':139
- '20#.#5.181.254':139
- '20#.#5.116.55':139
- '20#.#5.142.210':139