Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'RegHost' = '%APPDATA%\Microsoft\RegHost.exe'
- %WINDIR%\explorer.exe
- %APPDATA%\microsoft\reghost.exe
- '18#.#37.234.33':8080
- http://18#.##7.234.33:8080/hs via 18#.#37.234.33
- '%WINDIR%\bfsvc.exe' -a TON --pool wss://eu1.stratum.ton-pool.com/stratum --user EQDFOt3DVawR29wkHeC0TeaoWtyHbwQrg5nhMo5vGprARha6
- '%WINDIR%\explorer.exe' "312312314124" "" "money" "ton" 1