Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\NPSvchost] 'ImagePath' = '<SYSTEM32>\svchost.exe -k WinNPSrv'
- [<HKLM>\SYSTEM\ControlSet001\Services\NPSvchost\Parameters] 'ServiceDll' = '%WINDIR%\STPacketSvc.dll'
- %WINDIR%\STPacketSvc.dll
- 'ds##.stnts.com':8888
- 'wx####1.may005.com':80
- http://wx####1.may005.com/sfcj/eWt0.json
- DNS ASK ds##.stnts.com
- DNS ASK wx####1.may005.com
- '<SYSTEM32>\svchost.exe' -k WinNPSrv