Technical Information
- [<HKLM>\SYSTEM\CURRENTCONTROLSET\services\Winmgmt] 'Start' = '00000002'
- 'do###.wodown.net':80
- http://do###.wodown.net/jpdesk/20101201/jpdesk_3012_Setup.exe
- DNS ASK do###.wodown.net
- DNS ASK bi##bei.com
- DNS ASK d3.##wnxia.net
- DNS ASK d2.##wnxia.net
- DNS ASK d1.##azhai8.net