Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'System3264' = '<LS_APPDATA>\System3264\taskman.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Configurator' = '%APPDATA%\Configurator\Configurator.exe'
- '<SYSTEM32>\svchost.exe' -a cryptonight -o stratum+tcp://xmr.crypto-pool.fr:3333 -u 49tHfACjLUFhZGNGGaVKC1JEUGonvmUpJSYi63vuh1bt4YEnKrwkP9wHzEB7HdX3CXbLp7tiitmcjToPHr4Dphm63TfsKBV -p x -t 1
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\svchost.exe
- <LS_APPDATA>\System3264\taskman.exe
- %APPDATA%\Configurator\Configurator.exe