Technical Information
- [<HKLM>\System\CurrentControlSet\Services\helpservices] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\helpservices] 'ImagePath' = '<Full path to file>'
- 'helpservices' <Full path to file>
- 'ad#####relearning.me':80
- http://ad#####relearning.me/wp-content/uploads/index.php
- DNS ASK ad#####relearning.me