Technical Information
- [<HKLM>\System\CurrentControlSet\Services\WebaltaService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\WebaltaService] 'ImagePath' = '%APPDATA%\WebaltaService\WebaltaService.exe -start'
- %APPDATA%\webaltaservice\webaltaservice.cfg
- %APPDATA%\webaltaservice\webaltaservice.exe
- DNS ASK st###.webalta.ru
- '%APPDATA%\webaltaservice\webaltaservice.exe' -start