Technical Information
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Wait' = '<Full path to file>'
- %APPDATA%\microsoft\windows\start menu\programs\startup\wait.exe
- 'au####am-net.moy.su':80
- 'sm##.mail.ru':25
- http://au####am-net.moy.su/
- 'sm##.mail.ru':25
- DNS ASK au####am-net.moy.su
- DNS ASK do#####dels.besaba.com
- DNS ASK sm##.mail.ru