Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '' = '%APPDATA%\NsMiner\IMG001.exe'
- %APPDATA%\microsoft\windows\start menu\programs\startup\run.lnk
- %TEMP%\nshafc0.tmp
- %APPDATA%\nsminer\img001.exe
- %TEMP%\nsmc005.tmp
- %APPDATA%\nsminer\nscpucnminer32.exe
- %APPDATA%\nsminer\nscpucnminer64.exe
- %APPDATA%\nsminer\pools.txt
- '%APPDATA%\nsminer\img001.exe'
- '%APPDATA%\nsminer\img001.exe' ' (with hidden window)