Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'System3264' = '<LS_APPDATA>\System3264\taskman.exe'
- '<SYSTEM32>\svchost.exe' -a cryptonight -o stratum+tcp://sever1.kozow.com:80 -u 43afVPYCn6ghuowJb4fScCThkS7mWAmqRCEJATdd79YfZC5bB5nnzNG33HAjKd7azUZ4HR72uD4uVYdSro65SdJf4z37C5k.00000000ToMINER22222 -p XXXXXXXXXXXXXXXXXX...
- '<SYSTEM32>\cmd.exe'
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\svchost.exe
- <LS_APPDATA>\System3264\taskman.exe
- %TEMP%\svhost.exe