Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\WindowsUserManagement] 'Start' = '00000002'
- '<SYSTEM32>\attrib.exe' \WUMsvc.dll -s -h
- '<SYSTEM32>\attrib.exe' <SYSTEM32>\WUMsvc.dll -s -h
- <SYSTEM32>\WUMsvc.dll
- from <SYSTEM32>\WUMsvc.dll to <SYSTEM32>\wdl.dll