Trojan.DownLoader10.13783

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Startup' = '%APPDATA%\Mining\Mining.exe'

Вредоносные функции:

Создает и запускает на исполнение:

'%APPDATA%\Mining\coin-miner.exe' /pid=6492
'%APPDATA%\Mining\coin-miner.exe' /pid=6652
'%APPDATA%\Mining\coin-miner.exe' /pid=6792
'%APPDATA%\Mining\coin-miner.exe' /pid=6352
'%APPDATA%\Mining\coin-miner.exe' /pid=6372
'%APPDATA%\Mining\coin-miner.exe' /pid=6428
'%APPDATA%\Mining\coin-miner.exe' /pid=6912
'%APPDATA%\Mining\coin-miner.exe' /pid=7328
'%APPDATA%\Mining\coin-miner.exe' /pid=7512
'%APPDATA%\Mining\coin-miner.exe' /pid=7548
'%APPDATA%\Mining\coin-miner.exe' /pid=6968
'%APPDATA%\Mining\coin-miner.exe' /pid=7092
'%APPDATA%\Mining\coin-miner.exe' /pid=7208
'%APPDATA%\Mining\coin-miner.exe' /pid=5192
'%APPDATA%\Mining\coin-miner.exe' /pid=2432
'%APPDATA%\Mining\coin-miner.exe' /pid=5836
'%APPDATA%\Mining\coin-miner.exe' /pid=1380
'%APPDATA%\Mining\coin-miner.exe' /pid=5564
'%APPDATA%\Mining\coin-miner.exe' /pid=4532
'%APPDATA%\Mining\coin-miner.exe' /pid=5384
'%APPDATA%\Mining\coin-miner.exe' /pid=5996
'%APPDATA%\Mining\coin-miner.exe' /pid=5636
'%APPDATA%\Mining\coin-miner.exe' /pid=4912
'%APPDATA%\Mining\coin-miner.exe' /pid=2808
'%APPDATA%\Mining\coin-miner.exe' /pid=4900
'%APPDATA%\Mining\coin-miner.exe' /pid=2640
'%APPDATA%\Mining\coin-miner.exe' /pid=5012
'%APPDATA%\Mining\coin-miner.exe' /pid=7672
'%APPDATA%\Mining\coin-miner.exe' /pid=7156
'%APPDATA%\Mining\coin-miner.exe' /pid=7256
'%APPDATA%\Mining\coin-miner.exe' /pid=7248
'%APPDATA%\Mining\coin-miner.exe' /pid=6508
'%APPDATA%\Mining\coin-miner.exe' /pid=6816
'%APPDATA%\Mining\coin-miner.exe' /pid=6936
'%APPDATA%\Mining\coin-miner.exe' /pid=7076
'%APPDATA%\Mining\coin-miner.exe' /pid=7388
'%APPDATA%\Mining\coin-miner.exe' /pid=7992
'%APPDATA%\Mining\coin-miner.exe' /pid=7868
'%APPDATA%\Mining\coin-miner.exe' /pid=7152
'%APPDATA%\Mining\coin-miner.exe' /pid=7412
'%APPDATA%\Mining\coin-miner.exe' /pid=7596
'%APPDATA%\Mining\coin-miner.exe' /pid=6828
'%APPDATA%\Mining\coin-miner.exe' /pid=7872
'%APPDATA%\Mining\coin-miner.exe' /pid=7968
'%APPDATA%\Mining\coin-miner.exe' /pid=8156
'%APPDATA%\Mining\coin-miner.exe' /pid=7688
'%APPDATA%\Mining\coin-miner.exe' /pid=7792
'%APPDATA%\Mining\coin-miner.exe' /pid=7828
'%APPDATA%\Mining\coin-miner.exe' /pid=8088
'%APPDATA%\Mining\coin-miner.exe' /pid=6156
'%APPDATA%\Mining\coin-miner.exe' /pid=6456
'%APPDATA%\Mining\coin-miner.exe' /pid=6836
'%APPDATA%\Mining\coin-miner.exe' /pid=8152
'%APPDATA%\Mining\coin-miner.exe' /pid=8168
'%APPDATA%\Mining\coin-miner.exe' /pid=6296
'%APPDATA%\Mining\coin-miner.exe' /pid=3232
'%APPDATA%\Mining\coin-miner.exe' /pid=3128
'%APPDATA%\Mining\coin-miner.exe' /pid=4712
'%APPDATA%\Mining\coin-miner.exe' /pid=4920
'%APPDATA%\Mining\coin-miner.exe' /pid=4440
'%APPDATA%\Mining\coin-miner.exe' /pid=4340
'%APPDATA%\Mining\coin-miner.exe' /pid=5504
'%APPDATA%\Mining\coin-miner.exe' /pid=5112
'%APPDATA%\Mining\coin-miner.exe' /pid=5180
'%APPDATA%\Mining\coin-miner.exe' /pid=4220
'%APPDATA%\Mining\coin-miner.exe' /pid=4212
'%APPDATA%\Mining\coin-miner.exe' /pid=5556
'%APPDATA%\Mining\coin-miner.exe' /pid=3660
'%APPDATA%\Mining\coin-miner.exe' /pid=2516
'%APPDATA%\Mining\coin-miner.exe' /pid=3412
'%APPDATA%\Mining\coin-miner.exe' /pid=3312
'%APPDATA%\Mining\coin-miner.exe' /pid=4412
'%APPDATA%\Mining\coin-miner.exe' -a sha256 -o http://Mi############rker14:1234@eu.triplemining.com:8344 -T 83 -l yes -t 1
'%APPDATA%\Mining\coin-miner.exe' /pid=5212
'%APPDATA%\Mining\coin-miner.exe' /pid=3712
'%APPDATA%\Mining\coin-miner.exe' /pid=5280
'%APPDATA%\Mining\coin-miner.exe' /pid=3156
'%APPDATA%\Mining\coin-miner.exe' /pid=916
'%APPDATA%\Mining\coin-miner.exe' /pid=1940
'%APPDATA%\Mining\coin-miner.exe' /pid=5100
'%APPDATA%\Mining\coin-miner.exe' /pid=4800
'%APPDATA%\Mining\coin-miner.exe' /pid=4420
'%APPDATA%\Mining\coin-miner.exe' /pid=3700
'%APPDATA%\Mining\coin-miner.exe' /pid=5616
'%APPDATA%\Mining\coin-miner.exe' /pid=2408
'%APPDATA%\Mining\coin-miner.exe' /pid=4432
'%APPDATA%\Mining\coin-miner.exe' /pid=3108
'%APPDATA%\Mining\coin-miner.exe' /pid=6004
'%APPDATA%\Mining\coin-miner.exe' /pid=5596
'%APPDATA%\Mining\coin-miner.exe' /pid=4600
'%APPDATA%\Mining\coin-miner.exe' /pid=3332
'%APPDATA%\Mining\coin-miner.exe' /pid=3632
'%APPDATA%\Mining\coin-miner.exe' /pid=4012
'%APPDATA%\Mining\coin-miner.exe' /pid=3892
'%APPDATA%\Mining\coin-miner.exe' /pid=2988
'%APPDATA%\Mining\coin-miner.exe' /pid=3760
'%APPDATA%\Mining\coin-miner.exe' /pid=5796
'%APPDATA%\Mining\coin-miner.exe' /pid=4200
'%APPDATA%\Mining\coin-miner.exe' /pid=4700
'%APPDATA%\Mining\coin-miner.exe' /pid=6104
'%APPDATA%\Mining\coin-miner.exe' /pid=5736
'%APPDATA%\Mining\coin-miner.exe' /pid=4780
'%APPDATA%\Mining\coin-miner.exe' /pid=5080
'%APPDATA%\Mining\coin-miner.exe' /pid=5664
'%APPDATA%\Mining\coin-miner.exe' /pid=4692
'%APPDATA%\Mining\coin-miner.exe' /pid=4592
'%APPDATA%\Mining\coin-miner.exe' /pid=2876
'%APPDATA%\Mining\coin-miner.exe' /pid=2660
'%APPDATA%\Mining\coin-miner.exe' /pid=6084
'%APPDATA%\Mining\coin-miner.exe' (загружен из сети Интернет)