Trojan Jorik – T0NOLRQ1DJ.exe – b6a1914dfb546e74e068a3611b5dc9d3

Trojan Jorik
Also known as: Trojan Crypt, Trojan Kryptik
SHA256: ca32dba9065f0ac6e5266e6c9882beb4381b7103d791e376baef1a0f4d450aa2
SHA1: a0e113a7534f6557046ec6e0c6689ab54346296c
MD5: b6a1914dfb546e74e068a3611b5dc9d3
File size: 216064 bytes

Created files:

%AppData%\T0NOLRQ1DJ.exe – Trojan Jorik

Trojan Jorik created autostart registry keys:

HKLM\Software\Microsoft\Active Setup\Installed Components\{B731FFEE-1EB6-4DAD-D2D5-EEAA2F6BFFCF}\StubPath: %AppData%\T0NOLRQ1DJ.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Windows Defender: %AppData%\T0NOLRQ1DJ.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender: %AppData%\T0NOLRQ1DJ.exe
HKCU\Software\Microsoft\Active Setup\Installed Components\{B731FFEE-1EB6-4DAD-D2D5-EEAA2F6BFFCF}\StubPath: %AppData%\T0NOLRQ1DJ.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender: %AppData%\T0NOLRQ1DJ.exe