Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\] 'TurlaAPT' = '"%APPDATA%\reducer.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'TurlaAPT' = '"%APPDATA%\reducer.exe"'
- reducer.exe
- %APPDATA%\reducer.exe
- nul
- %APPDATA%\reducer.exe
- DNS ASK 1.#####yourdongers.wtf
- '%APPDATA%\reducer.exe'
- '<SYSTEM32>\cmd.exe' ping 127.0.0.1 -n 1 -w 5000 > Nul & Del <Full path to file>
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 1 -w 5000