Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\MSWindows] 'Start' = '00000002'
- '<SYSTEM32>\urdvxc.exe' /service
- '<SYSTEM32>\urdvxc.exe' /uninstallservice patch:<Full path to virus>
- '<SYSTEM32>\urdvxc.exe' /installservice
- '<SYSTEM32>\urdvxc.exe' /start
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\dumprep.exe' 1136 -dm 7 7 %TEMP%\WERfb96.dir00\svchost.exe.mdmp 16325836412032248
- %TEMP%\WERfb96.dir00\svchost.exe.mdmp
- <SYSTEM32>\urdvxc.exe
- '19#.#75.116.75':139
- '19#.#75.133.95':139
- '19#.#75.24.13':139
- '19#.#75.229.252':139
- '19#.#75.123.64':139
- '19#.#75.229.252':445
- '19#.#75.173.72':139
- '19#.#75.224.249':445
- '19#.#75.43.112':139
- '19#.#75.115.214':139
- '19#.#75.68.68':139
- '19#.#75.81.113':445
- '19#.#75.4.67':139
- '19#.#75.224.249':139
- '19#.#75.116.53':139
- '19#.#75.149.123':139
- '19#.#75.24.13':445
- '19#.#75.4.67':445
- '19#.#75.116.53':445
- '19#.#75.133.95':445
- '19#.#75.149.123':445
- '19#.#75.123.64':445
- '19#.#75.173.72':445
- '19#.#75.43.112':445
- '19#.#75.12.2':139
- '19#.#75.108.21':139
- '19#.#75.115.17':139
- '19#.#75.4.12':139
- '19#.#75.68.68':445
- '19#.#75.45.34':139
- '19#.#75.143.54':139
- '19#.#75.81.113':139
- '19#.#75.193.194':139
- '19#.#75.164.242':139
- '19#.#75.242.66':139
- '19#.#75.13.83':139
- '19#.#75.10.58':139
- '19#.#75.236.23':139
- '19#.#75.32.161':139
- '19#.#75.55.134':139
- '19#.#75.150.15':139
- '19#.#75.50.240':139
- '19#.#75.159.93':139
- '19#.#75.184.33':139
- '19#.#75.245.104':139
- '19#.#75.219.115':139
- '19#.#75.184.33':445
- '19#.#75.10.58':445
- '19#.#75.193.194':445
- '19#.#75.164.242':445
- '19#.#75.242.66':445
- '19#.#75.13.83':445
- '19#.#75.126.11':445
- '19#.#75.32.161':445
- '19#.#75.236.23':445
- '19#.#75.55.134':445
- '19#.175.4.4':445
- '19#.#75.126.11':139
- '19#.#75.11.31':139
- '19#.#75.220.70':445
- '19#.#75.159.93':445
- '19#.#75.50.240':445
- '19#.#75.69.120':445
- '19#.#75.219.112':445
- '19#.#75.41.87':445
- '19#.#75.85.113':139
- '19#.#75.154.39':445
- '19#.#75.13.82':445
- '19#.#75.209.232':445
- '19#.#75.69.37':445
- '19#.#75.118.179':139
- '19#.#75.3.185':445
- '19#.#75.99.48':139
- '19#.#75.3.185':139
- '19#.#75.254.23':139
- '19#.#75.109.62':139
- '19#.#75.117.1':139
- '19#.#75.51.218':139
- '19#.#75.106.69':445
- '19#.#75.254.23':445
- '19#.#75.118.179':445
- '19#.#75.85.113':445
- '19#.#75.186.63':139
- '19#.#75.51.218':445
- '19#.#75.117.1':445
- '19#.#75.251.180':139
- '19#.#75.99.48':445
- '19#.#75.16.48':445
- '19#.#75.125.219':445
- '19#.#75.179.0':445
- '19#.#75.19.249':445
- '19#.#75.79.190':445
- '19#.#75.166.8':445
- '19#.#75.105.1':445
- '19#.#75.79.190':139
- '19#.#75.154.39':139
- '19#.#75.227.194':445
- '19#.#75.227.194':139
- '19#.#75.202.133':139
- '19#.#75.69.37':139
- '19#.#75.202.133':445
- '19#.#75.36.202':139
- '19#.#75.219.112':139
- '19#.#75.12.2':445
- '19#.#75.108.21':445
- '19#.#75.115.17':445
- '19#.#75.4.12':445
- '19#.#75.51.188':139
- '19#.#75.25.120':139
- '19#.#75.41.87':139
- '19#.#75.36.202':445
- '19#.#75.19.249':139
- '19#.#75.57.51':445
- '19#.#75.57.51':139
- '19#.#75.105.1':139
- '19#.#75.113.141':445
- '19#.#75.166.8':139
- '19#.#75.113.141':139
- '19#.#75.154.79':139
- '19#.#75.245.146':139
- '19#.#75.179.0':139
- '19#.#75.106.69':139
- '19#.#75.16.48':139
- '19#.#75.13.82':139
- '19#.#75.125.219':139
- '19#.#75.209.232':139
- '19#.#75.18.16':139
- '19#.#75.165.175':139
- '19#.#75.3.242':139
- '19#.#75.115.25':139
- '19#.#75.9.166':139
- '19#.#75.236.98':139
- '19#.#75.46.0':139
- '19#.#75.242.162':139
- '19#.#75.82.247':139
- '19#.#75.246.241':139
- '19#.#75.21.165':139
- '19#.#75.63.82':139
- '19#.#75.65.237':139
- '19#.#75.52.63':139
- '19#.#75.132.63':139
- '19#.#75.70.198':139
- '19#.#75.37.3':445
- '19#.#75.50.74':445
- '19#.#75.3.51':445
- '19#.#75.78.112':445
- '19#.#75.152.184':445
- '19#.#75.143.231':445
- '19#.#75.51.60':445
- '19#.#75.132.90':445
- '19#.#75.254.106':139
- '19#.#75.107.227':139
- '19#.#75.227.76':139
- '19#.#75.106.251':445
- '19#.#75.76.168':445
- '19#.#75.29.204':445
- '19#.#75.242.236':445
- '19#.#75.86.180':139
- '19#.#75.143.231':139
- '19#.#75.51.60':139
- '19#.#75.78.112':139
- '19#.#75.152.184':139
- '19#.#75.24.78':139
- '19#.#75.111.64':139
- '19#.#75.179.82':139
- '19#.#75.37.3':139
- '19#.#75.242.236':139
- '19#.#75.76.168':139
- '19#.#75.106.251':139
- '19#.#75.29.204':139
- '19#.#75.3.51':139
- '19#.#75.50.74':139
- '19#.#75.132.90':139
- '19#.#75.11.78':139
- '19#.#75.191.200':139
- '19#.#75.218.68':139
- '19#.#75.113.154':139
- '19#.#75.118.5':139
- '19#.#75.128.0':139
- '19#.#75.148.78':139
- '19#.#75.32.118':139
- '19#.#75.65.60':139
- '19#.#75.212.183':139
- '19#.#75.183.92':139
- '19#.#75.213.230':139
- '19#.#75.69.185':139
- '19#.#75.48.101':139
- '19#.#75.46.198':139
- '19#.#75.221.148':139
- '19#.#75.76.168':9988
- '19#.#75.37.3':9988
- '19#.#75.132.90':9988
- '19#.#75.51.60':9988
- '19#.#75.69.185':9988
- '19#.#75.24.78':9988
- '19#.#75.152.184':9988
- '19#.#75.78.112':9988
- '19#.#75.9.166':445
- '19#.#75.236.98':445
- '19#.#75.46.0':445
- '19#.#75.70.198':445
- '19#.#75.254.106':445
- '19#.#75.107.227':445
- '19#.#75.227.76':445
- '19#.#75.65.60':9988
- '19#.#75.29.234':139
- '19#.#75.234.253':139
- '19#.#75.86.180':9988
- '19#.#75.29.234':445
- '19#.#75.220.70':139
- '19#.#75.69.120':139
- '19#.175.4.4':139
- '19#.#75.9.166':9988
- '19#.#75.132.63':9988
- '19#.#75.107.227':9988
- '19#.#75.212.183':9988
- '19#.#75.52.63':9988
- '19#.#75.236.98':9988
- '19#.#75.3.242':9988
- '19#.#75.106.251':9988
- '19#.#75.115.25':445
- '19#.#75.48.101':445
- '19#.#75.46.198':445
- '19#.#75.221.148':445
- '19#.#75.65.60':445
- '19#.#75.191.200':445
- '19#.#75.218.68':445
- '19#.#75.113.154':445
- '19#.#75.69.185':445
- '19#.#75.11.78':445
- '19#.#75.24.78':445
- '19#.#75.179.82':445
- '19#.#75.111.64':445
- '19#.#75.183.92':445
- '19#.#75.213.230':445
- '19#.#75.212.183':445
- '19#.#75.32.118':445
- '19#.#75.65.237':445
- '19#.#75.52.63':445
- '19#.#75.132.63':445
- '19#.#75.242.162':445
- '19#.#75.18.16':445
- '19#.#75.165.175':445
- '19#.#75.3.242':445
- '19#.#75.63.82':445
- '19#.#75.128.0':445
- '19#.#75.148.78':445
- '19#.#75.118.5':445
- '19#.#75.86.180':445
- '19#.#75.82.247':445
- '19#.#75.246.241':445
- '19#.#75.21.165':445