To start, the implant looks for the AHNLAB V3 Antivirus software's class name "49B46336-BA4D-4905-9824-D282F05F6576". If the software is found, the implant will hide the AV software window from the view of the infected user