Pillowmint has used shellcode which reads code stored in the registry keys "\REGISTRY\SOFTWARE\Microsoft\DRM" using the native Windows API as well as read "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces" as part of its C2.