Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Error ActiveX Adaptive Internet Class' = '<SYSTEM32>\bdvbksqkfcdy.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Card Engine Installer Discovery DNS Now Manager] 'ImagePath' = '<SYSTEM32>\bdvbksqkfcdy.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Card Engine Installer Discovery DNS Now Manager] 'Start' = '00000002'
- Windows Security Center
- '<SYSTEM32>\vsxncke.exe' "<SYSTEM32>\bdvbksqkfcdy.exe"
- '%WINDIR%\Temp\hnuidpho3ohykti.exe' -r 35291 tcp
- '%TEMP%\hnuidpho3k65ktiz9h8qhj.exe'
- '<SYSTEM32>\bdvbksqkfcdy.exe'
- <SYSTEM32>\gqdxhunbunx\run
- <SYSTEM32>\gqdxhunbunx\rng
- %WINDIR%\Temp\hnuidpho3ohykti.exe
- <SYSTEM32>\gqdxhunbunx\cfg
- <SYSTEM32>\vsxncke.exe
- %TEMP%\hnuidpho3k65ktiz9h8qhj.exe
- <SYSTEM32>\gqdxhunbunx\tst
- <SYSTEM32>\bdvbksqkfcdy.exe
- <SYSTEM32>\gqdxhunbunx\etc
- <SYSTEM32>\vsxncke.exe
- <SYSTEM32>\bdvbksqkfcdy.exe
- %WINDIR%\Temp\hnuidpho3ohykti.exe
- <DRIVERS>\etc\hosts
- %TEMP%\hnuidpho3k65ktiz9h8qhj.exe
- 'dr###food.net':80
- 'na###ood.net':80
- 'dr###shown.net':80
- 'na###hown.net':80
- 'dr###meet.net':80
- 'qu###some.net':80
- 'fi###seven.net':80
- 'na###eet.net':80
- 'fi###some.net':80
- 'na###eck.net':80
- 'se###hown.net':80
- 'we####dayshown.net':80
- 'se###eck.net':80
- 'we####dayneck.net':80
- 'se###ood.net':80
- 'we####daymeet.net':80
- 'dr###neck.net':80
- 'we####dayfood.net':80
- 'se###eet.net':80
- 'qu###seven.net':80
- 'le###some.net':80
- 'fa###ome.net':80
- 'bo###uch.net':80
- 'ga###uch.net':80
- 'le###seven.net':80
- 'fa###oday.net':80
- 'le###such.net':80
- 'fa###even.net':80
- 'le###today.net':80
- 'ga###oday.net':80
- 'fi###such.net':80
- 'qu###such.net':80
- 'fi###today.net':80
- 'qu###today.net':80
- 'bo###ome.net':80
- 'ga###even.net':80
- 'bo###oday.net':80
- 'ga###ome.net':80
- 'bo###even.net':80
- 'fo###meet.net':80
- 'le###food.net':80
- 'fa###ood.net':80
- 'be##lxc.com':80
- 'fa###hown.net':80
- 'le###meet.net':80
- 'wa###eck.net':80
- 'mo###shown.net':80
- 'fa###eet.net':80
- 'mo###neck.net':80
- 'ri###nstorm.net':80
- 'mo###ugust.net':80
- 'mi###hown.net':80
- 'cr#####onaraminta.net':80
- 'le###form.net':80
- 'ab###ell.net':80
- 'ca####nbring.net':80
- 'al###being.net':80
- 'mo###olor.net':80
- 'pr####tbottom.net':80
- 'wa###hown.net':80
- 'af###neck.net':80
- 'fo###neck.net':80
- 'st###meet.net':80
- 'we###eet.net':80
- 'af###shown.net':80
- 'fo###food.net':80
- 'af###meet.net':80
- 'fo###shown.net':80
- 'af###food.net':80
- 'we###ood.net':80
- 'mo###meet.net':80
- 'wa###eet.net':80
- 'mo###food.net':80
- 'wa###ood.net':80
- 'st###neck.net':80
- 'we###hown.net':80
- 'st###food.net':80
- 'we###eck.net':80
- 'st###shown.net':80
- http://dr###food.net/index.php
- http://na###ood.net/index.php
- http://dr###shown.net/index.php
- http://na###hown.net/index.php
- http://dr###meet.net/index.php
- http://qu###some.net/index.php
- http://fi###seven.net/index.php
- http://na###eet.net/index.php
- http://fi###some.net/index.php
- http://na###eck.net/index.php
- http://se###hown.net/index.php
- http://we####dayshown.net/index.php
- http://se###eck.net/index.php
- http://we####dayneck.net/index.php
- http://se###ood.net/index.php
- http://we####daymeet.net/index.php
- http://dr###neck.net/index.php
- http://we####dayfood.net/index.php
- http://se###eet.net/index.php
- http://qu###seven.net/index.php
- http://le###some.net/index.php
- http://fa###ome.net/index.php
- http://bo###uch.net/index.php
- http://ga###uch.net/index.php
- http://le###seven.net/index.php
- http://fa###oday.net/index.php
- http://le###such.net/index.php
- http://fa###even.net/index.php
- http://le###today.net/index.php
- http://ga###oday.net/index.php
- http://fi###such.net/index.php
- http://qu###such.net/index.php
- http://fi###today.net/index.php
- http://qu###today.net/index.php
- http://bo###ome.net/index.php
- http://ga###even.net/index.php
- http://bo###oday.net/index.php
- http://ga###ome.net/index.php
- http://bo###even.net/index.php
- http://fo###meet.net/index.php
- http://le###food.net/index.php
- http://fa###ood.net/index.php
- http://be##lxc.com/index.php
- http://fa###hown.net/index.php
- http://le###meet.net/index.php
- http://wa###eck.net/index.php
- http://mo###shown.net/index.php
- http://fa###eet.net/index.php
- http://mo###neck.net/index.php
- http://ri###nstorm.net/index.php
- http://mo###ugust.net/index.php
- http://mi###hown.net/index.php
- http://cr#####onaraminta.net/index.php
- http://le###form.net/index.php
- http://ab###ell.net/index.php
- http://ca####nbring.net/index.php
- http://al###being.net/index.php
- http://mo###olor.net/index.php
- http://pr####tbottom.net/index.php
- http://wa###hown.net/index.php
- http://af###neck.net/index.php
- http://fo###neck.net/index.php
- http://st###meet.net/index.php
- http://we###eet.net/index.php
- http://af###shown.net/index.php
- http://fo###food.net/index.php
- http://af###meet.net/index.php
- http://fo###shown.net/index.php
- http://af###food.net/index.php
- http://we###ood.net/index.php
- http://mo###meet.net/index.php
- http://wa###eet.net/index.php
- http://mo###food.net/index.php
- http://wa###ood.net/index.php
- http://st###neck.net/index.php
- http://we###hown.net/index.php
- http://st###food.net/index.php
- http://we###eck.net/index.php
- http://st###shown.net/index.php
- DNS ASK na###ood.net
- DNS ASK dr###meet.net
- DNS ASK dr###food.net
- DNS ASK dr###shown.net
- DNS ASK na###hown.net
- DNS ASK fi###seven.net
- DNS ASK qu###seven.net
- DNS ASK qu###some.net
- DNS ASK na###eet.net
- DNS ASK fi###some.net
- DNS ASK we####dayshown.net
- DNS ASK se###ood.net
- DNS ASK se###hown.net
- DNS ASK se###eck.net
- DNS ASK we####dayneck.net
- DNS ASK dr###neck.net
- DNS ASK na###eck.net
- DNS ASK we####daymeet.net
- DNS ASK we####dayfood.net
- DNS ASK se###eet.net
- DNS ASK fa###ome.net
- DNS ASK le###seven.net
- DNS ASK le###some.net
- DNS ASK bo###uch.net
- DNS ASK ga###uch.net
- DNS ASK le###such.net
- DNS ASK fa###uch.net
- DNS ASK fa###oday.net
- DNS ASK fa###even.net
- DNS ASK le###today.net
- DNS ASK qu###such.net
- DNS ASK bo###ome.net
- DNS ASK fi###such.net
- DNS ASK fi###today.net
- DNS ASK qu###today.net
- DNS ASK bo###oday.net
- DNS ASK ga###oday.net
- DNS ASK ga###even.net
- DNS ASK ga###ome.net
- DNS ASK bo###even.net
- DNS ASK fo###meet.net
- DNS ASK le###food.net
- DNS ASK fa###ood.net
- DNS ASK be##lxc.com
- DNS ASK fa###hown.net
- DNS ASK le###meet.net
- DNS ASK wa###eck.net
- DNS ASK mo###shown.net
- DNS ASK fa###eet.net
- DNS ASK mo###neck.net
- DNS ASK ri###nstorm.net
- DNS ASK mo###ugust.net
- DNS ASK mi###hown.net
- DNS ASK cr#####onaraminta.net
- DNS ASK le###form.net
- DNS ASK ab###ell.net
- DNS ASK ca####nbring.net
- DNS ASK al###being.net
- DNS ASK mo###olor.net
- DNS ASK pr####tbottom.net
- DNS ASK wa###hown.net
- DNS ASK af###neck.net
- DNS ASK fo###neck.net
- DNS ASK st###meet.net
- DNS ASK we###eet.net
- DNS ASK af###shown.net
- DNS ASK fo###food.net
- DNS ASK af###meet.net
- DNS ASK fo###shown.net
- DNS ASK af###food.net
- DNS ASK we###ood.net
- DNS ASK mo###meet.net
- DNS ASK wa###eet.net
- DNS ASK mo###food.net
- DNS ASK wa###ood.net
- DNS ASK st###neck.net
- DNS ASK we###hown.net
- DNS ASK st###food.net
- DNS ASK we###eck.net
- DNS ASK st###shown.net
- '23#.#55.255.250':1900