Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft OneDrives' = '"%APPDATA%\dllhost.exe"'
- [<HKLM>\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%APPDATA%\WinRing0x64.sys'
- %APPDATA%\dllhost.exe
- %APPDATA%\winlogonn.exe
- %APPDATA%\dllhost.exe
- http://sp####space.had.su/x32.exe
- http://sp####space.had.su/page.php
- DNS ASK sp####space.had.su
- DNS ASK xm#.###l.minergate.com
- '%APPDATA%\winlogonn.exe' -o stratum+tcp://xmr.pool.minergate.com:45700 -u layter2005@gmail.com --max-cpu-usage=50 -p x --donate-level=1 --algo=cryptonight