Technical Information
- '<SYSTEM32>\rundll32.exe' ..\AppData\Roaming\Goka.zzxxcc,DllRegisterServer
- <Current directory>\2e211000
- <PATH_SAMPLE>.xls
- http://gu####larm.com.tr/mnsdzu/423323.jpg
- DNS ASK gu####larm.com.tr
- '<SYSTEM32>\rundll32.exe' ..\AppData\Roaming\Goka.zzxxcc,DllRegisterServer' (with hidden window)