IOC Report
O0dZdy12ak.exe

loading gif

Files

File Path
Type
Category
Malicious
O0dZdy12ak.exe
PE32 executable (console) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\Desktop\O0dZdy12ak.exe.invisible
data
dropped
 malicious
C:\Users\Public\Documents\desktop.ini.invisible
data
dropped
C:\Users\Public\Downloads\desktop.ini.invisible
data
dropped
C:\Users\Public\Music\desktop.ini.invisible
data
dropped
C:\Users\Public\Pictures\desktop.ini.invisible
data
dropped
C:\Users\Public\Videos\desktop.ini.invisible
data
dropped
C:\Users\Public\desktop.ini.invisible
data
dropped
C:\Users\desktop.ini.invisible
data
dropped
C:\Users\user\.curlrc.invisible
data
dropped
C:\Users\user\3D Objects\desktop.ini.invisible
data
dropped
C:\Users\user\AppData\Local\Temp\tmp.bmp
PC bitmap, Windows 3.x format, 1920 x 1080 x 24, image size 6220800, cbSize 6220854, bits offset 54
dropped
C:\Users\user\AppData\Roaming\time.dat
ASCII text, with no line terminators
dropped
C:\Users\user\Contacts\desktop.ini.invisible
data
dropped
C:\Users\user\Desktop\DVWHKMNFNN.png.invisible
data
dropped
C:\Users\user\Desktop\Excel.lnk.invisible
data
dropped
C:\Users\user\Desktop\HTAGVDFUIE.jpg.invisible
data
dropped
C:\Users\user\Desktop\HTAGVDFUIE.xlsx.invisible
data
dropped
C:\Users\user\Desktop\KATAXZVCPS.pdf.invisible
data
dropped
C:\Users\user\Desktop\KZWFNRXYKI.png.invisible
data
dropped
C:\Users\user\Desktop\LTKMYBSEYZ.mp3.invisible
data
dropped
C:\Users\user\Desktop\LTKMYBSEYZ.pdf.invisible
data
dropped
C:\Users\user\Desktop\UMMBDNEQBN.docx.invisible
data
dropped
C:\Users\user\Desktop\UMMBDNEQBN.xlsx.invisible
data
dropped
C:\Users\user\Desktop\UMMBDNEQBN\HTAGVDFUIE.xlsx.invisible
data
dropped
C:\Users\user\Desktop\UMMBDNEQBN\KZWFNRXYKI.png.invisible
data
dropped
C:\Users\user\Desktop\UMMBDNEQBN\LTKMYBSEYZ.pdf.invisible
data
dropped
C:\Users\user\Desktop\UMMBDNEQBN\UMMBDNEQBN.docx.invisible
data
dropped
C:\Users\user\Desktop\UMMBDNEQBN\WUTJSCBCFX.jpg.invisible
data
dropped
C:\Users\user\Desktop\UMMBDNEQBN\ZBEDCJPBEY.mp3.invisible
data
dropped
C:\Users\user\Desktop\VLZDGUKUTZ.docx.invisible
data
dropped
C:\Users\user\Desktop\VLZDGUKUTZ\DVWHKMNFNN.png.invisible
data
dropped
C:\Users\user\Desktop\VLZDGUKUTZ\HTAGVDFUIE.jpg.invisible
data
dropped
C:\Users\user\Desktop\VLZDGUKUTZ\KATAXZVCPS.pdf.invisible
data
dropped
C:\Users\user\Desktop\VLZDGUKUTZ\LTKMYBSEYZ.mp3.invisible
data
dropped
C:\Users\user\Desktop\VLZDGUKUTZ\UMMBDNEQBN.xlsx.invisible
data
dropped
C:\Users\user\Desktop\VLZDGUKUTZ\VLZDGUKUTZ.docx.invisible
data
dropped
C:\Users\user\Desktop\WUTJSCBCFX.jpg.invisible
data
dropped
C:\Users\user\Desktop\ZBEDCJPBEY.mp3.invisible
data
dropped
C:\Users\user\Desktop\desktop.ini.invisible
data
dropped
C:\Users\user\Documents\DVWHKMNFNN.png.invisible
data
dropped
C:\Users\user\Documents\HTAGVDFUIE.jpg.invisible
data
dropped
C:\Users\user\Documents\HTAGVDFUIE.xlsx.invisible
data
dropped
C:\Users\user\Documents\KATAXZVCPS.pdf.invisible
data
dropped
C:\Users\user\Documents\KZWFNRXYKI.png.invisible
data
dropped
C:\Users\user\Documents\LTKMYBSEYZ.mp3.invisible
data
dropped
C:\Users\user\Documents\LTKMYBSEYZ.pdf.invisible
data
dropped
C:\Users\user\Documents\UMMBDNEQBN.docx.invisible
data
dropped
C:\Users\user\Documents\UMMBDNEQBN.xlsx.invisible
data
dropped
C:\Users\user\Documents\UMMBDNEQBN\HTAGVDFUIE.xlsx.invisible
data
dropped
C:\Users\user\Documents\UMMBDNEQBN\KZWFNRXYKI.png.invisible
data
dropped
C:\Users\user\Documents\UMMBDNEQBN\LTKMYBSEYZ.pdf.invisible
data
dropped
C:\Users\user\Documents\UMMBDNEQBN\UMMBDNEQBN.docx.invisible
data
dropped
C:\Users\user\Documents\UMMBDNEQBN\WUTJSCBCFX.jpg.invisible
data
dropped
C:\Users\user\Documents\UMMBDNEQBN\ZBEDCJPBEY.mp3.invisible
data
dropped
C:\Users\user\Documents\VLZDGUKUTZ.docx.invisible
data
dropped
C:\Users\user\Documents\VLZDGUKUTZ\DVWHKMNFNN.png.invisible
data
dropped
C:\Users\user\Documents\VLZDGUKUTZ\HTAGVDFUIE.jpg.invisible
data
dropped
C:\Users\user\Documents\VLZDGUKUTZ\KATAXZVCPS.pdf.invisible
data
dropped
C:\Users\user\Documents\VLZDGUKUTZ\LTKMYBSEYZ.mp3.invisible
data
dropped
C:\Users\user\Documents\VLZDGUKUTZ\UMMBDNEQBN.xlsx.invisible
data
dropped
C:\Users\user\Documents\VLZDGUKUTZ\VLZDGUKUTZ.docx.invisible
data
dropped
C:\Users\user\Documents\WUTJSCBCFX.jpg.invisible
data
dropped
C:\Users\user\Documents\ZBEDCJPBEY.mp3.invisible
data
dropped
C:\Users\user\Documents\desktop.ini.invisible
data
dropped
C:\Users\user\Downloads\DVWHKMNFNN.png.invisible
data
dropped
C:\Users\user\Downloads\HTAGVDFUIE.jpg.invisible
data
dropped
C:\Users\user\Downloads\HTAGVDFUIE.xlsx.invisible
data
dropped
C:\Users\user\Downloads\KATAXZVCPS.pdf.invisible
data
dropped
C:\Users\user\Downloads\KZWFNRXYKI.png.invisible
data
dropped
C:\Users\user\Downloads\LTKMYBSEYZ.mp3.invisible
data
dropped
C:\Users\user\Downloads\LTKMYBSEYZ.pdf.invisible
data
dropped
C:\Users\user\Downloads\UMMBDNEQBN.docx.invisible
data
dropped
C:\Users\user\Downloads\UMMBDNEQBN.xlsx.invisible
data
dropped
C:\Users\user\Downloads\VLZDGUKUTZ.docx.invisible
data
dropped
C:\Users\user\Downloads\WUTJSCBCFX.jpg.invisible
data
dropped
C:\Users\user\Downloads\ZBEDCJPBEY.mp3.invisible
data
dropped
C:\Users\user\Downloads\desktop.ini.invisible
data
dropped
C:\Users\user\Favorites\Amazon.url.invisible
data
dropped
C:\Users\user\Favorites\Bing.url.invisible
data
dropped
C:\Users\user\Favorites\Facebook.url.invisible
data
dropped
C:\Users\user\Favorites\Google.url.invisible
data
dropped
C:\Users\user\Favorites\Links\desktop.ini.invisible
data
dropped
C:\Users\user\Favorites\Live.url.invisible
data
dropped
C:\Users\user\Favorites\NYTimes.url.invisible
data
dropped
C:\Users\user\Favorites\Reddit.url.invisible
data
dropped
C:\Users\user\Favorites\Twitter.url.invisible
data
dropped
C:\Users\user\Favorites\Wikipedia.url.invisible
data
dropped
C:\Users\user\Favorites\Youtube.url.invisible
data
dropped
C:\Users\user\Favorites\desktop.ini.invisible
data
dropped
C:\Users\user\Links\Desktop.lnk.invisible
data
dropped
C:\Users\user\Links\Downloads.lnk.invisible
data
dropped
C:\Users\user\Links\desktop.ini.invisible
data
dropped
C:\Users\user\Music\desktop.ini.invisible
data
dropped
C:\Users\user\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TM.blf.invisible
data
dropped
C:\Users\user\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.invisible
data
dropped
C:\Users\user\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000002.regtrans-ms.invisible
data
modified
C:\Users\user\OneDrive\desktop.ini.invisible
data
dropped
C:\Users\user\Pictures\Camera Roll\desktop.ini.invisible
data
dropped
C:\Users\user\Pictures\Saved Pictures\desktop.ini.invisible
data
dropped
C:\Users\user\Pictures\desktop.ini.invisible
data
dropped
C:\Users\user\Saved Games\desktop.ini.invisible
data
dropped
C:\Users\user\Searches\Everywhere.search-ms.invisible
data
dropped
C:\Users\user\Searches\Indexed Locations.search-ms.invisible
data
dropped
C:\Users\user\Searches\desktop.ini.invisible
data
dropped
C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1002}-.searchconnector-ms.invisible
data
dropped
C:\Users\user\Videos\desktop.ini.invisible
data
dropped
C:\Users\user\_curlrc.invisible
data
dropped
C:\Users\user\ntuser.ini.invisible
data
dropped
There are 99 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\O0dZdy12ak.exe
"C:\Users\user\Desktop\O0dZdy12ak.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mmc.exe /t
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im mmc.exe /t
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 67 hidden processes, click here to show them.

URLs

Name
IP
Malicious
https://t.me/shiro_SATA)
unknown
https://t.me/WalterBishop42)
unknown
https://t.me/madoneputain)
unknown
https://t.me/moonnight_god)
unknown
https://t.me/Britannique)
unknown
https://t.me/te1egram_usr)
unknown
https://t.me/doubleface_group
unknown
https://t.me/masturbateur)
unknown
https://t.me/tcpsnow)
unknown
https://t.me/tombezyy)
unknown
https://t.me/hackerk7)
unknown
There are 1 hidden URLs, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
CFC000
heap
page read and write
423000
unkown
page readonly
A1E000
unkown
page readonly
CF9000
heap
page read and write
432000
unkown
page readonly
CF2000
heap
page read and write
D56000
heap
page read and write
400000
unkown
page readonly
D03000
heap
page read and write
CFD000
heap
page read and write
D35000
heap
page read and write
CFD000
heap
page read and write
42B000
unkown
page write copy
432000
unkown
page readonly
D00000
heap
page read and write
CF2000
heap
page read and write
CF3000
heap
page read and write
D51000
heap
page read and write
CF0000
heap
page read and write
D01000
heap
page read and write
D23000
heap
page read and write
401000
unkown
page execute read
There are 12 hidden memdumps, click here to show them.