Technical Information
- [<HKLM>\System\CurrentControlSet\Services\evzaco] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\evzaco] 'ImagePath' = '%CommonProgramFiles%\kgwxwcz\evzaco.exe'
- 'evzaco' %CommonProgramFiles%\kgwxwcz\evzaco.exe
- %WINDIR%\syswow64\calc.exe
- %CommonProgramFiles%\kgwxwcz\winda.ini
- %CommonProgramFiles%\kgwxwcz\kkygdt.exe
- %CommonProgramFiles%\kgwxwcz\evzaco.exe
- %CommonProgramFiles%\kgwxwcz\winda.ini
- ClassName: 'MS_WINHELP' WindowName: ''
- '%CommonProgramFiles%\kgwxwcz\evzaco.exe'
- '%WINDIR%\syswow64\calc.exe'