IOC Report
DsLQ5tXxAQ.exe

loading gif

Files

File Path
Type
Category
Malicious
DsLQ5tXxAQ.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
 malicious
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
 malicious
C:\ProgramData\BAAFBFBAAKECFIEBFIECFCGCAF
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\CAEHJEBKFCAKKFIEHDBF
SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\CFIECBFI
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\DHIEBAAKJDHIECAAFHCAECAFCF
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\GHDHJEBFBFHJECAKFCAA
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\GIIIECBGDHJJKFIDAKJD
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\KJJJJDHI
SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 7, database pages 68, 1st free page 51, free pages 2, cookie 0x4a, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\json[1].json
JSON data
dropped
Chrome Cache Entry: 78
ASCII text, with very long lines (5162), with no line terminators
downloaded
Chrome Cache Entry: 79
ASCII text
downloaded
Chrome Cache Entry: 80
ASCII text, with very long lines (65531)
downloaded
Chrome Cache Entry: 81
ASCII text, with very long lines (2412)
downloaded
Chrome Cache Entry: 82
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 83
Unicode text, UTF-8 text, with very long lines (6229)
downloaded
Chrome Cache Entry: 84
ASCII text
downloaded
There are 20 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\DsLQ5tXxAQ.exe
"C:\Users\user\Desktop\DsLQ5tXxAQ.exe"
 malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
 malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2488,i,16454725771506238363,7640174756609455215,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2548 /prefetch:3
malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\DsLQ5tXxAQ.exe" & del "C:\ProgramData\*.dll"" & exit
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\timeout.exe
timeout /t 5

URLs

Name
IP
Malicious
http://213.209.150.220/
213.209.150.220
 malicious
http://213.209.150.220
unknown
 malicious
http://213.209.150.220/263ff79562167f22/sqlite3.dll
213.209.150.220
 malicious
http://213.209.150.220/d7f85cd3e24a4757.php
213.209.150.220
 malicious
http://213.209.150.220/263ff79562167f22/nss3.dll
213.209.150.220
 malicious
http://213.209.150.220/263ff79562167f22/msvcp140.dll
213.209.150.220
 malicious
http://213.209.150.220/263ff79562167f22/softokn3.dll
213.209.150.220
 malicious
http://213.209.150.220/263ff79562167f22/vcruntime140.dll
213.209.150.220
 malicious
http://213.209.150.220/263ff79562167f22/mozglue.dll
213.209.150.220
 malicious
http://213.209.150.220/263ff79562167f22/freebl3.dll
213.209.150.220
 malicious
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
http://www.broofa.com
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
http://213.209.150.220/263ff79562167f22/softokn3.dllx
unknown
http://213.209.150.220/n
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://www.google.com/async/newtab_promos
142.250.186.100
http://213.209.150.220/d7f85cd3e24a4757.php-
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://www.google.com/images/branding/product/ico/googleg_alldp.ico
unknown
https://www.google.com/async/ddljson?async=ntp:2
142.250.186.100
https://play.google.com/log?format=json&hasfast=true
unknown
http://213.209.150.220/263ff79562167f22/nss3.dllE
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.uiLLJjqnhCQ.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8NP2y291iiPDmfAN0GV3dvCuqlYA/cb=gapi.loaded_0
142.250.186.174
http://213.209.150.220/263ff79562167f22/vcruntime140.dllW
unknown
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
142.250.186.100
https://apis.google.com
unknown
https://support.mozilla.org
unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE
142.250.186.100
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
There are 26 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
plus.l.google.com
142.250.186.174
play.google.com
216.58.212.142
www.google.com
142.250.186.100
apis.google.com
unknown

IPs

IP
Domain
Country
Malicious
192.168.2.4
unknown
unknown
malicious
213.209.150.220
unknown
Germany
malicious
216.58.212.142
play.google.com
United States
142.250.186.174
plus.l.google.com
United States
142.250.186.100
www.google.com
United States
127.0.0.1
unknown
unknown

Memdumps

Base Address
Regiontype
Protect
Malicious
83B000
unkown
page readonly
 malicious
141E000
heap
page read and write
 malicious
83B000
unkown
page readonly
 malicious
9AB0000
heap
page read and write
36EF000
stack
page read and write
9AA5000
heap
page read and write
9B80000
heap
page read and write
9A91000
heap
page read and write
9A8C000
heap
page read and write
2570000
heap
page read and write
9AA5000
heap
page read and write
9A97000
heap
page read and write
9D57000
heap
page read and write
139C000
heap
page read and write
9A7D000
heap
page read and write
9A8C000
heap
page read and write
9D4F000
heap
page read and write
9A7D000
heap
page read and write
A5A000
unkown
page readonly
9BCF000
heap
page read and write
35AF000
stack
page read and write
34AE000
stack
page read and write
9C3F000
heap
page read and write
1003C000
stack
page read and write
9A91000
heap
page read and write
9A89000
heap
page read and write
61ED3000
direct allocation
page read and write
3979000
heap
page read and write
9A8D000
heap
page read and write
898000
unkown
page read and write
9AB3000
heap
page read and write
9AA5000
heap
page read and write
9A8C000
heap
page read and write
141A000
heap
page read and write
A48000
unkown
page read and write
9BC1000
heap
page read and write
9AB1000
heap
page read and write
9A7E000
heap
page read and write
61ED0000
direct allocation
page read and write
6CCB0000
unkown
page readonly
1393000
heap
page read and write
9AB3000
heap
page read and write
847000
unkown
page write copy
14B8000
heap
page read and write
E9C000
stack
page read and write
14B3000
heap
page read and write
3B00000
trusted library allocation
page read and write
14EB000
heap
page read and write
14BF000
heap
page read and write
9AAC000
heap
page read and write
9BDC000
heap
page read and write
27BE000
stack
page read and write
9A92000
heap
page read and write
6CD42000
unkown
page readonly
9AAA000
heap
page read and write
1461000
heap
page read and write
847000
unkown
page write copy
14CA000
heap
page read and write
9AA5000
heap
page read and write
9BD5000
heap
page read and write
A5A000
unkown
page readonly
322E000
stack
page read and write
2500000
heap
page read and write
9A97000
heap
page read and write
27FF000
stack
page read and write
2550000
heap
page read and write
9A91000
heap
page read and write
136E000
stack
page read and write
9A70000
heap
page read and write
9A8E000
heap
page read and write
14AF000
heap
page read and write
6CF30000
unkown
page read and write
9AB3000
heap
page read and write
9A7D000
heap
page read and write
396C000
stack
page read and write
9A91000
heap
page read and write
810000
unkown
page readonly
1410000
heap
page read and write
9A97000
heap
page read and write
9AB3000
heap
page read and write
2578000
heap
page read and write
9A74000
heap
page read and write
811000
unkown
page execute read
382D000
stack
page read and write
FDEB000
stack
page read and write
9B70000
heap
page read and write
9C6B000
heap
page read and write
9AB3000
heap
page read and write
9A70000
trusted library allocation
page read and write
277E000
stack
page read and write
9AB1000
heap
page read and write
14AB000
heap
page read and write
8E1000
unkown
page read and write
3970000
heap
page read and write
12E7000
heap
page read and write
9A8B000
heap
page read and write
810000
unkown
page readonly
9A8E000
heap
page read and write
170F000
stack
page read and write
9AB1000
heap
page read and write
9BA0000
heap
page read and write
9AA5000
heap
page read and write
6CF35000
unkown
page readonly
F9E000
stack
page read and write
12E0000
heap
page read and write
9AB1000
heap
page read and write
24E0000
heap
page read and write
147F000
heap
page read and write
6CCB1000
unkown
page execute read
1390000
heap
page read and write
14A8000
heap
page read and write
6CD2D000
unkown
page readonly
9D55000
heap
page read and write
3B0D000
heap
page read and write
9AA5000
heap
page read and write
9A90000
heap
page read and write
977000
unkown
page read and write
9A91000
heap
page read and write
FEFB000
stack
page read and write
9D5F000
heap
page read and write
6CEEF000
unkown
page readonly
132E000
stack
page read and write
9AA5000
heap
page read and write
254E000
stack
page read and write
61E00000
direct allocation
page execute and read and write
9A7E000
heap
page read and write
372E000
stack
page read and write
9CEB000
stack
page read and write
9AAC000
heap
page read and write
9A93000
heap
page read and write
160E000
stack
page read and write
346F000
stack
page read and write
6CD3E000
unkown
page read and write
332F000
stack
page read and write
24AC000
stack
page read and write
14FD000
heap
page read and write
61ECC000
direct allocation
page read and write
9A97000
heap
page read and write
43C000
stack
page read and write
9A82000
heap
page read and write
9C43000
heap
page read and write
386D000
stack
page read and write
6CF2E000
unkown
page read and write
9AA5000
heap
page read and write
61E01000
direct allocation
page execute read
9A8E000
heap
page read and write
9A8E000
heap
page read and write
9D47000
heap
page read and write
13C0000
heap
page read and write
9A94000
heap
page read and write
6CF2F000
unkown
page write copy
9AB3000
heap
page read and write
FF30000
heap
page read and write
9AA5000
heap
page read and write
9AA0000
heap
page read and write
61ED4000
direct allocation
page readonly
12E5000
heap
page read and write
9BC3000
heap
page read and write
9A7D000
heap
page read and write
9A93000
heap
page read and write
9AB3000
heap
page read and write
14E6000
heap
page read and write
35EE000
stack
page read and write
811000
unkown
page execute read
9AA2000
heap
page read and write
9BC8000
heap
page read and write
9AB1000
heap
page read and write
336E000
stack
page read and write
6CD51000
unkown
page execute read
61ECD000
direct allocation
page readonly
61EB7000
direct allocation
page readonly
9A8E000
heap
page read and write
FF0000
heap
page read and write
14C5000
heap
page read and write
F94000
stack
page read and write
9A70000
trusted library allocation
page read and write
4090000
heap
page read and write
9AA5000
heap
page read and write
9AB3000
heap
page read and write
14FB000
heap
page read and write
12D0000
heap
page read and write
9A8E000
heap
page read and write
61EB4000
direct allocation
page read and write
6CD50000
unkown
page readonly
There are 174 hidden memdumps, click here to show them.