Technical Information
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '<SYSTEM32>\DC01.exe'
- %WINDIR%\syswow64\mswinsck.ocx
- %WINDIR%\syswow64\c472.exe
- %WINDIR%\syswow64\dc01.exe
- <PATH_SAMPLE>tmp.bat
- %WINDIR%\syswow64\dc01tmp.bat
- %WINDIR%\syswow64\c472.exe
- '22#.#04.249.240':80
- '21#.51.45.5':80
- '%WINDIR%\syswow64\c472.exe' -bb
- '%WINDIR%\syswow64\dc01.exe'
- '%WINDIR%\syswow64\cmd.exe' /c "start <SYSTEM32>\C472.exe -bb"' (with hidden window)
- '%WINDIR%\syswow64\dc01.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "<PATH_SAMPLE>tmp.bat"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "%WINDIR%\SysWOW64\DC01tmp.bat"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "start <SYSTEM32>\C472.exe -bb"
- '%WINDIR%\syswow64\cmd.exe' /c "<PATH_SAMPLE>tmp.bat"
- '%WINDIR%\syswow64\cmd.exe' /c "%WINDIR%\SysWOW64\DC01tmp.bat"