Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{F5A9BA70-ABFA-AD51-5C8A-A3B73AA9CE18}] 'StubPath' = '<SYSTEM32>\wmiprvsa.exe'
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\wmiprvsa.exe
- 'st###.#umpingcrab.com':443
- DNS ASK st###.#umpingcrab.com