IOC Report
101 2043 5770 pdf.exe

101 2043 5770 pdf.exe

PE32+ executable (GUI) x86-64, for MS Windows

initial sample

C:\Users\user\101 2043 5770 pdf.exe

PE32+ executable (GUI) x86-64, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\DB1

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Roaming\J8AR3449\J8Alogri.ini

data

dropped

C:\Users\user\AppData\Roaming\J8AR3449\J8Alogrv.ini

data

dropped

C:\Users\user\Desktop\101 2043 5770 pdf.exe

"C:\Users\user\Desktop\101 2043 5770 pdf.exe"

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Program Files (x86)\Windows Media Player\wmplayer.exe

"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"

C:\Windows\explorer.exe

C:\Windows\Explorer.EXE

C:\Windows\SysWOW64\ipconfig.exe

"C:\Windows\SysWOW64\ipconfig.exe"

C:\Windows\SysWOW64\cmd.exe

/c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

http://www.sacksmantenimiento.storeReferer:

unknown

www.a2zglobalimports.com/kmge/

http://www.mrawkward.xyz/kmge/

unknown

http://www.hhe-crv220.com/kmge/www.sacksmantenimiento.store

unknown

http://www.n5l780.comReferer:

unknown

http://www.mrawkward.xyz

unknown

http://www.cq0jt.sbs

unknown

http://www.kickssoccercamp.com

unknown

http://www.hhe-crv220.com/kmge/

unknown

http://www.n5l780.com/kmge/www.szexvideokingyen.sbs

unknown