Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'RegHost' = '%APPDATA%\Microsoft\RegHost.exe'
- %WINDIR%\explorer.exe
- %APPDATA%\microsoft\reghost.exe
- %APPDATA%\microsoft\regmodule.exe
- %APPDATA%\microsoft\onedrive.exe
- %APPDATA%\microsoft\regdata.exe
- '18#.#37.234.33':8080
- http://18#.##7.234.33:8080/hs via 18#.#37.234.33
- http://18#.##7.234.33:8080/cl via 18#.#37.234.33
- http://18#.##7.234.33:8080/pm via 18#.#37.234.33
- http://18#.##7.234.33:8080/xr via 18#.#37.234.33
- http://18#.##7.234.33:8080/wd via 18#.#37.234.33
- '%WINDIR%\bfsvc.exe' -log 0 -nvdo 1 -pool eu1-etc.ethermine.org;4444 -wal 0x6A7B383b4c9eDA1348cc1fD31FDefcC6f20C05f5 -coin etc -worker bigdickzxc -cclock +500 -cvddc +500
- '%WINDIR%\explorer.exe' "123qWef0" "" "None" "etc" 1