Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'wZJUyyZE' = '%TEMP%\wZJUyyZE.exe'
- '<SYSTEM32>\svchost.exe' -o pool.monero.hashvault.pro:5555 -u 41vbULeqYmY4pMHtSQiQhncdKzSV5aAnHCQ17qSic8gyikuC8GR5xXFWFKTcCK4vE67wJJca6SQGVZS9oVfVp68ZG8EBSgP -p x -k --donate-level=1 -B
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\svchost.exe
- %TEMP%\wZJUyyZE.exe