Technical Information
- [<HKLM>\System\CurrentControlSet\Services\Ghijkl Nopqrstu Wxy] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Ghijkl Nopqrstu Wxy] 'ImagePath' = '%ProgramFiles%\Arrange\Null.jpg'
- %ProgramFiles%\arrange\null.jpg
- DNS ASK mu##8.com
- '%ProgramFiles%\arrange\null.jpg'