Technical Information
- [<HKLM>\System\CurrentControlSet\Services\mapistub] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\mapistub] 'ImagePath' = '"%WINDIR%\SysWOW64\mapistub\mapistub.exe"'
- from <Full path to file> to %WINDIR%\syswow64\mapistub\mapistub.exe
- '24.##9.63.138':80
- '2.##.165.235':80
- http://2.##.165.235/fLHk1lgWRk2yIe/H1MZkBZtAFY/e6bxZNG9VpMxCCb0/3q3bIsce8v0ngT/TKj54H6bFTn7c1/