Technical Information
- [<HKLM>\System\CurrentControlSet\Services\0SE] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\0SE] 'ImagePath' = '%WINDIR%\OSE.exe'
- '0SE' %WINDIR%\OSE.exe
- %WINDIR%\ose.exe
- %WINDIR%\apppatch\netsyst72.dll
- 'qy##yw.com':80
- http://qy##yw.com/ads/NetSyst72.jpg
- http://www.qy##yw.com/ads/NetSyst72.jpg
- DNS ASK qy##yw.com
- '%WINDIR%\ose.exe'