Authors, thank you for this well written information.
I'm really interested to know whether the Loader service stays resident once the attack is underway?
In that case, I think the simplest way to detect an infected system would be to che for the registered device name 'WinHost(32)?'... Correct?

Thanks