Техническая информация
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\] 'TurlaAPT' = '"%PROGRAMDATA%\reducer.exe"'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'TurlaAPT' = '"%PROGRAMDATA%\reducer.exe"'
- reducer.exe
- %PROGRAMDATA%\reducer.exe
- nul
- %PROGRAMDATA%\reducer.exe
- DNS ASK 1.#####yourdongers.wtf
- '%PROGRAMDATA%\reducer.exe'
- '%WINDIR%\syswow64\cmd.exe' ping 127.0.0.1 -n 1 -w 5000 > Nul & Del <Полный путь к файлу>
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 1 -w 5000