Technical Information
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'dllhost32' = '"<Full path to file>"'
- <Current directory>\run.bat
- '255.255.255.255':1234
- DNS ASK na####r.no-ip.info
- '%WINDIR%\syswow64\cmd.exe' /c run.bat
- '%WINDIR%\syswow64\cmd.exe' /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V dllhost32 /D "\"<Full path to file>\"" /f
- '%WINDIR%\syswow64\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V dllhost32 /D "\"<Full path to file>\"" /f
- '%WINDIR%\syswow64\cmd.exe' /c run.bat' (with hidden window)