Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'zZHILNIspz' = '<LS_APPDATA>\BjIhIWsdsu\rdsvc.exe'
- '<SYSTEM32>\svchost.exe' -a cryptonight -o stratum+tcp://xmr.crypto-pool.fr:6666 -u 47qJtynh14BXjdYm8wrhwYFaVgaUDzBv12ayMWkBEgpVFb9a4hY5k2W9bubrqE6mD9M3Nekk5xuvm4aY1beFqdFHExRSw36 -p x -t 1
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\svchost.exe
- <LS_APPDATA>\BjIhIWsdsu\rdsvc.exe