DeviceCensus.exe DLL sideloading: a dcntel.dll backdoor staged from a WebDAV directory
WebDAV cmd stagers copy DeviceCensus.exe out of System32 to sideload dcntel.dll, a remote shell beaconing to port 9090.
Sep 25, 20265 min read0 reactions0 comments