Technical Information
- [HKLM\System\CurrentControlSet\Services\ialdnwxf] 'ImagePath' = '<Current directory>\superec.ProcessMemory.sys'
- 'ialdnwxf' <Current directory>\\superec.ProcessMemory.sys
- 'ialdnwxf' <Current directory>\superec.ProcessMemory.sys
- <Current directory>\superec.processmemory.sys
- %WINDIR%\temp\udd896a.tmp
- %WINDIR%\temp\udd896a.tmp
- 'yi#####.host.hostsz.com':80
- http://yi#####.host.hostsz.com//jiancewangluo.asp
- DNS ASK yi#####.host.hostsz.com