Technical Information
- [<HKLM>\System\CurrentControlSet\Services\Rstuvw Yabcdefg Ijk] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Rstuvw Yabcdefg Ijk] 'ImagePath' = '%ProgramFiles%\stesc\cosua.exe'
- %ProgramFiles%\stesc\cosua.exe
- DNS ASK ao##.xyz
- '%ProgramFiles%\stesc\cosua.exe'