Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\Ylffmg oatnqa] 'ImagePath' = '%WINDIR%\Terms.EXE'
- [<HKLM>\SYSTEM\ControlSet001\Services\Ylffmg oatnqa] 'Start' = '00000002'
- '%WINDIR%\Terms.EXE'
- %WINDIR%\Terms.EXE
- 're#####ongshe.f3322.org':1987
- DNS ASK re#####ongshe.f3322.org