This comes from NiceHash Miner
I think it is your computer as I am using NiceHash Miner mining everyday and I don't have this problem. You are accusing a big company (I know their high fees) but they are super correct so far at giving out payments. So I don't think they will want to damage their reputation with such a virus.
They are actually scammer putting virus into their files. I had this issue after installing their applications.
I had cleaned the virus with MalwareBytes it was a really rootkit tough virus >_<
It is one thing to get infected because of one's own stupidity.
It is another thing to get infected by downloading a binary that is modified or not from its original actual source
It is the worst thing to get infected and to accuse legit exes which is widely used by many without problems without actual proof.
I just installed the nicehash miner from their official website on my clean host only newly created windows 10 machine with crowdinspect and other tools running.
Are you sure you got your copy off
https://github.com/nicehash/NiceHashMiner/releases/ ?
Even malwarebytes had no alarms on running it other than the default "bitcoin miner" flag, I also ran electrum and had no address replacement like you accused.