Technical Information
- [<HKLM>\System\CurrentControlSet\Services\AB1MQpTK] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\AB1MQpTK] 'ImagePath' = '<DRIVERS>\AB1MQpTK.sys'
- 'AB1MQpTK' <DRIVERS>\AB1MQpTK.sys
- <DRIVERS>\ab1mqptk.sys
- <DRIVERS>\c3f4827a
- <DRIVERS>\etc\hosts
- '12#.#2.138.217':58080
- 'vi###77777.top':11111
- DNS ASK vi###77777.top
- '%WINDIR%\syswow64\cmd.exe' /c rd "<DRIVERS>\etcXaFdE" /S /Q' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd "<DRIVERS>\etcXaFdE" /S /Q