IOC Report
OJP7vrLRNG.exe

loading gif

Files

File Path
Type
Category
Malicious
OJP7vrLRNG.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\FBGHIIJDGHCBFIECBKEGHDHDBA
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\HDGIEBGHDAEBGDGCFIIDHCBKFB
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\HJDBAFIECGHCBFIDGDAAAKEBFH
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\IECGIEBAEBFIIECBGCBG
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\JECBGCFH
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\JEGDGIIJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\KECFCGHIDHCAKEBFCFHC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_OJP7vrLRNG.exe_1c7453fceb9d49986d7d6fcbf2dd77d97ddf070_1acabca5_a1aa76ac-c401-4682-b8fc-907491113dad\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_OJP7vrLRNG.exe_32d0a1acbeed6a6507232e869ad1c368e04c3a_1acabca5_9656c24c-55f3-4855-b67c-06f7a3e6b2f3\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_OJP7vrLRNG.exe_bc1e71f3f2fc50d671d8e475ba838687c46d1_1acabca5_044d22cc-a4c4-4dc3-86b7-6ec2dcadf0f5\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2957.tmp.dmp
Mini DuMP crash report, 14 streams, Thu Mar 28 20:22:03 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2A61.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2A82.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C35.tmp.dmp
Mini DuMP crash report, 14 streams, Thu Mar 28 20:22:04 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2CF2.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2D12.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A0C.tmp.dmp
Mini DuMP crash report, 14 streams, Thu Mar 28 20:22:16 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5AA9.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5AD9.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
There are 25 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\OJP7vrLRNG.exe
"C:\Users\user\Desktop\OJP7vrLRNG.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6552 -s 2008
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6552 -s 2024
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6552 -s 2064

URLs

Name
IP
Malicious
193.233.132.241/e64f36763e423a50.php
malicious
http://193.233.132.241/0c90d49aae193f2b/mozglue.dll
193.233.132.241
 malicious
http://193.233.132.241/0c90d49aae193f2b/nss3.dll
193.233.132.241
 malicious
http://193.233.132.241/0c90d49aae193f2b/vcruntime140.dll
193.233.132.241
 malicious
http://193.233.132.241/0c90d49aae193f2b/msvcp140.dll
193.233.132.241
 malicious
http://193.233.132.241/0c90d49aae193f2b/sqlite3.dll
193.233.132.241
 malicious
http://193.233.132.241
unknown
 malicious
http://193.233.132.241/e64f36763e423a50.php
193.233.132.241
 malicious
http://193.233.132.241/0c90d49aae193f2b/freebl3.dll
193.233.132.241
 malicious
http://193.233.132.241/0c90d49aae193f2b/softokn3.dll
193.233.132.241
 malicious
http://193.233.132.241/e64f36763e423a50.phpSession
unknown
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
http://193.233.132.241/0c90d49aae193f2b/softokn3.dll%D
unknown
https://duckduckgo.com/ac/?q=
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
http://193.233.132.241/e64f36763e423a50.php2
unknown
http://193.233.132.241/e64f36763e423a50.php0
unknown
http://193.233.132.241/e64f36763e423a50.php(
unknown
http://193.233.132.241/e64f36763e423a50.php.
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
unknown
http://193.233.132.241/e64f36763e423a50.phpgU
unknown
http://193.233.132.241/0c90d49aae193f2b/nss3.dllh
unknown
http://www.sqlite.org/copyright.html.
unknown
http://193.233.132.241/e64f36763e423a50.phpcal
unknown
http://193.233.132.241/e64f36763e423a50.phpO
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
http://193.233.132.241/0c90d49aae193f2b/sqlite3.dllL
unknown
https://mozilla.org0/
unknown
http://193.233.132.241/e64f36763e423a50.php_VB6
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://193.233.132.241/e64f36763e423a50.phpJ
unknown
http://193.233.132.241/e64f36763e423a50.phpN
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://upx.sf.net
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
http://193.233.132.241/0c90d49aae193f2b/msvcp140.dllCD
unknown
https://www.ecosia.org/newtab/
unknown
http://193.233.132.241/e64f36763e423a50.php2f
unknown
http://193.233.132.241/e64f36763e423a50.phprowser
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
http://193.233.132.241/e64f36763e423a50.phpion:
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
http://193.233.132.241/e64f36763e423a50.phpv
unknown
http://193.233.132.241/e64f36763e423a50.phpDf
unknown
http://193.233.132.241/e64f36763e423a50.phpl
unknown
http://193.233.132.241/e64f36763e423a50.php616d3974a7ad87bb8c318304cea3
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://193.233.132.241/e64f36763e423a50.phpSVN6
unknown
There are 42 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
193.233.132.241
unknown
Russian Federation
malicious

Registry

Path
Value
Malicious
\REGISTRY\A\{b9dfce12-0039-5ed2-7d8d-7b41f646be41}\Root\InventoryApplicationFile\ojp7vrlrng.exe|3857fb8fd5c8e386
ProgramId
\REGISTRY\A\{b9dfce12-0039-5ed2-7d8d-7b41f646be41}\Root\InventoryApplicationFile\ojp7vrlrng.exe|3857fb8fd5c8e386
FileId
\REGISTRY\A\{b9dfce12-0039-5ed2-7d8d-7b41f646be41}\Root\InventoryApplicationFile\ojp7vrlrng.exe|3857fb8fd5c8e386
LowerCaseLongPath
\REGISTRY\A\{b9dfce12-0039-5ed2-7d8d-7b41f646be41}\Root\InventoryApplicationFile\ojp7vrlrng.exe|3857fb8fd5c8e386
LongPathHash
\REGISTRY\A\{b9dfce12-0039-5ed2-7d8d-7b41f646be41}\Root\InventoryApplicationFile\ojp7vrlrng.exe|3857fb8fd5c8e386
Name
\REGISTRY\A\{b9dfce12-0039-5ed2-7d8d-7b41f646be41}\Root\InventoryApplicationFile\ojp7vrlrng.exe|3857fb8fd5c8e386
OriginalFileName
\REGISTRY\A\{b9dfce12-0039-5ed2-7d8d-7b41f646be41}\Root\InventoryApplicationFile\ojp7vrlrng.exe|3857fb8fd5c8e386
Publisher
\REGISTRY\A\{b9dfce12-0039-5ed2-7d8d-7b41f646be41}\Root\InventoryApplicationFile\ojp7vrlrng.exe|3857fb8fd5c8e386
Version
\REGISTRY\A\{b9dfce12-0039-5ed2-7d8d-7b41f646be41}\Root\InventoryApplicationFile\ojp7vrlrng.exe|3857fb8fd5c8e386
BinFileVersion
\REGISTRY\A\{b9dfce12-0039-5ed2-7d8d-7b41f646be41}\Root\InventoryApplicationFile\ojp7vrlrng.exe|3857fb8fd5c8e386
BinaryType
\REGISTRY\A\{b9dfce12-0039-5ed2-7d8d-7b41f646be41}\Root\InventoryApplicationFile\ojp7vrlrng.exe|3857fb8fd5c8e386
ProductName
\REGISTRY\A\{b9dfce12-0039-5ed2-7d8d-7b41f646be41}\Root\InventoryApplicationFile\ojp7vrlrng.exe|3857fb8fd5c8e386
ProductVersion
\REGISTRY\A\{b9dfce12-0039-5ed2-7d8d-7b41f646be41}\Root\InventoryApplicationFile\ojp7vrlrng.exe|3857fb8fd5c8e386
LinkDate
\REGISTRY\A\{b9dfce12-0039-5ed2-7d8d-7b41f646be41}\Root\InventoryApplicationFile\ojp7vrlrng.exe|3857fb8fd5c8e386
BinProductVersion
\REGISTRY\A\{b9dfce12-0039-5ed2-7d8d-7b41f646be41}\Root\InventoryApplicationFile\ojp7vrlrng.exe|3857fb8fd5c8e386
AppxPackageFullName
\REGISTRY\A\{b9dfce12-0039-5ed2-7d8d-7b41f646be41}\Root\InventoryApplicationFile\ojp7vrlrng.exe|3857fb8fd5c8e386
AppxPackageRelativeId
\REGISTRY\A\{b9dfce12-0039-5ed2-7d8d-7b41f646be41}\Root\InventoryApplicationFile\ojp7vrlrng.exe|3857fb8fd5c8e386
Size
\REGISTRY\A\{b9dfce12-0039-5ed2-7d8d-7b41f646be41}\Root\InventoryApplicationFile\ojp7vrlrng.exe|3857fb8fd5c8e386
Language
\REGISTRY\A\{b9dfce12-0039-5ed2-7d8d-7b41f646be41}\Root\InventoryApplicationFile\ojp7vrlrng.exe|3857fb8fd5c8e386
Usn
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
TickCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
0018400ECDA8078A
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId
There are 14 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
400000
unkown
page execute and read and write
 malicious
CA0000
direct allocation
page read and write
 malicious
D53000
heap
page read and write
 malicious
C70000
direct allocation
page execute and read and write
 malicious
273C8000
heap
page read and write
21068000
heap
page read and write
21068000
heap
page read and write
21057000
heap
page read and write
2DE10000
heap
page read and write
9B000
stack
page read and write
D2E000
heap
page read and write
C55000
heap
page read and write
2722E000
stack
page read and write
21066000
heap
page read and write
DF7000
heap
page read and write
6CD6D000
unkown
page readonly
27162000
heap
page read and write
21082000
heap
page read and write
ADF000
unkown
page read and write
6CF75000
unkown
page readonly
21050000
heap
page read and write
DFA000
heap
page read and write
C57000
heap
page read and write
210F0000
heap
page read and write
21068000
heap
page read and write
2107D000
heap
page read and write
AE2000
unkown
page readonly
F1E000
stack
page read and write
101F000
stack
page read and write
2108C000
heap
page read and write
21082000
heap
page read and write
2E8B0000
heap
page read and write
21056000
heap
page read and write
27FE000
stack
page read and write
273D1000
heap
page read and write
2108A000
heap
page read and write
21063000
heap
page read and write
1AFE1000
heap
page read and write
1AE4E000
stack
page read and write
6CF70000
unkown
page read and write
1AFE0000
heap
page read and write
2106D000
heap
page read and write
21089000
heap
page read and write
2108C000
heap
page read and write
C50000
heap
page read and write
61EB7000
direct allocation
page readonly
21068000
heap
page read and write
27100000
heap
page read and write
1AFD0000
heap
page read and write
2106D000
heap
page read and write
21082000
heap
page read and write
21070000
heap
page read and write
D3E000
heap
page execute and read and write
624000
unkown
page execute and read and write
417000
unkown
page write copy
21082000
heap
page read and write
210F0000
heap
page read and write
2E3A7000
heap
page read and write
1AB8F000
stack
page read and write
2107B000
heap
page read and write
2105C000
heap
page read and write
21088000
heap
page read and write
400000
unkown
page readonly
2970000
heap
page read and write
6CD91000
unkown
page execute read
21082000
heap
page read and write
21066000
heap
page read and write
21156000
heap
page read and write
27182000
heap
page read and write
C57000
heap
page read and write
1AA4F000
stack
page read and write
21061000
heap
page read and write
6CF6E000
unkown
page read and write
C0E000
stack
page read and write
21067000
heap
page read and write
61ECC000
direct allocation
page read and write
210F0000
heap
page read and write
DF1000
heap
page read and write
21068000
heap
page read and write
1AA8E000
stack
page read and write
6CD7E000
unkown
page read and write
21088000
heap
page read and write
6CF6F000
unkown
page write copy
BC0000
heap
page read and write
61ECD000
direct allocation
page readonly
1ABCE000
stack
page read and write
2108C000
heap
page read and write
27153000
heap
page read and write
DE4000
heap
page read and write
636000
unkown
page execute and read and write
21057000
heap
page read and write
190000
stack
page read and write
21056000
heap
page read and write
6CCF1000
unkown
page execute read
410000
unkown
page readonly
293E000
stack
page read and write
2108A000
heap
page read and write
27330000
trusted library allocation
page read and write
DA4000
heap
page read and write
21068000
heap
page read and write
1B0E0000
trusted library allocation
page read and write
2107D000
heap
page read and write
1ACCF000
stack
page read and write
273C9000
heap
page read and write
21070000
heap
page read and write
1F0000
heap
page read and write
C4E000
stack
page read and write
6CD90000
unkown
page readonly
27108000
heap
page read and write
270E0000
heap
page read and write
27103000
heap
page read and write
2106D000
heap
page read and write
401000
unkown
page execute read
D20000
heap
page read and write
21082000
heap
page read and write
549000
unkown
page execute and read and write
27115000
heap
page read and write
273C0000
heap
page read and write
273CE000
heap
page read and write
21063000
heap
page read and write
DFF000
heap
page read and write
AE2000
unkown
page readonly
273BA000
heap
page read and write
2107D000
heap
page read and write
1AF4E000
stack
page read and write
61ED0000
direct allocation
page read and write
2107D000
heap
page read and write
21069000
heap
page read and write
2732F000
stack
page read and write
2107B000
heap
page read and write
1AE0D000
stack
page read and write
1B0EF000
heap
page read and write
DEA000
heap
page read and write
21056000
heap
page read and write
21089000
heap
page read and write
270C0000
heap
page read and write
41C000
unkown
page write copy
273B0000
heap
page read and write
19A000
stack
page read and write
196000
stack
page read and write
21052000
heap
page read and write
D2A000
heap
page read and write
6CF2F000
unkown
page readonly
2108A000
heap
page read and write
2711C000
heap
page read and write
D87000
heap
page read and write
2106D000
heap
page read and write
21070000
heap
page read and write
2940000
heap
page read and write
61ED4000
direct allocation
page readonly
2107D000
heap
page read and write
21068000
heap
page read and write
2108C000
heap
page read and write
2710F000
heap
page read and write
6CCF0000
unkown
page readonly
447000
unkown
page execute and read and write
2106B000
heap
page read and write
21082000
heap
page read and write
2107B000
heap
page read and write
21056000
heap
page read and write
61EB4000
direct allocation
page read and write
21068000
heap
page read and write
1AD0E000
stack
page read and write
21064000
heap
page read and write
28FF000
stack
page read and write
1AFE1000
heap
page read and write
6CD82000
unkown
page readonly
61E01000
direct allocation
page execute read
61ED3000
direct allocation
page read and write
CF0000
heap
page read and write
DDF000
heap
page read and write
297B000
heap
page read and write
61E00000
direct allocation
page execute and read and write
There are 163 hidden memdumps, click here to show them.