Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'urSOzAfy' = '%TEMP%\urSOzAfy.exe'
- '<SYSTEM32>\svchost.exe' -o pool.supportxmr.com:3333 -u 48bEXicwesk8Eibo3y8KM26z4rQLUQ4RETaiQvZukRzQJY5vDdunFZz6YsmECpvo71C6ehxaxQj2RMopWsi6JumVBeE5Meq -p {IonClient}_CRNJEUFU -k --donate-level=1 --max-cpu-usage=50 -B
- <SYSTEM32>\svchost.exe
- %TEMP%\urSOzAfy.exe
- 'po##.#upportxmr.com':3333
- DNS ASK po##.#upportxmr.com