Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\sacuqwiwa] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\sacuqwiwa] 'ImagePath' = '%WINDIR%\sacuqwiwa.exe'
- %WINDIR%\sacuqwiwa.exe
- %WINDIR%\waitwwswa.exe
- '94.##2.60.132':80
- http://94.##2.60.132/log/adm.php
- '%WINDIR%\sacuqwiwa.exe'