Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'wslzylbhr' = '"%APPDATA%\Microsoft\Lzapnmnmz\lzapnmnm.exe"'
- <SYSTEM32>\cscript.exe
- %APPDATA%\Microsoft\Lzapnmnmz\lzapnmn.dat
- %HOMEPATH%\yecbygwufgptgqzodya.vbs
- %HOMEPATH%\pzqomdrvqsqibkfpeshgns.vbs
- %HOMEPATH%\yecbygwufgptgqzodya.vbs
- %HOMEPATH%\pzqomdrvqsqibkfpeshgns.vbs
- '<SYSTEM32>\cscript.exe' "%HOMEPATH%\yecbygwufgptgqzodya.vbs"
- '<SYSTEM32>\cscript.exe' "%HOMEPATH%\pzqomdrvqsqibkfpeshgns.vbs"
- '%APPDATA%\Microsoft\Lzapnmnmz\lzapnmnm.exe'
- '<SYSTEM32>\mobsync.exe'