Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WinXPService' = '<SYSTEM32>\wacult.exe'
- [<HKLM>\SOFTWARE\Classes\irc\Shell\open\command] '' = '"<SYSTEM32>\wacult.exe" -noconnect'
- [<HKLM>\SOFTWARE\Classes\ChatFile\Shell\open\command] '' = '"<SYSTEM32>\wacult.exe" -noconnect'
- <SYSTEM32>\wacult.exe
- %WINDIR%\msagent\agentsvr.exe -Embedding
- %WINDIR%\regedit.exe /s f2.reg
- <SYSTEM32>\wacult.exe
- <SYSTEM32>\f2.reg
- <SYSTEM32>\remote.ini
- <SYSTEM32>\system32\msconfg.dll
- <SYSTEM32>\edih.dll
- <SYSTEM32>\ms32.sys
- <SYSTEM32>\f2.reg
- 'i.###larama.com':3921
- DNS ASK i.###larama.com
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''