Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

https://kezenelectric.ca/First-America

URL

initial url

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Microsoft Cabinet archive data, 60080 bytes, 1 file

dropped

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\0a1a5bbe-8aa9-4dc8-8139-02fc0a5e7de4.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\76da7b8b-f094-4fb5-b0c0-393127c4b8ba.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\9548abb1-5605-427d-b54b-4fedc2fe2c35.tmp

SysEx File -

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\9c7b99d7-f559-43b7-a91c-0ac609b76ef8.tmp

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\02be7372-55df-4983-b6ff-7018cbaa805c.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\1288b324-97f1-48f3-bcfc-db67dedd2185.tmp

ASCII text, with very long lines, with no line terminators

modified

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\1e072769-31fe-439b-9f52-047825c17262.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\71e4fe4e-990f-4b98-aff1-06858d9696bd.tmp

UTF-8 Unicode text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\734753a9-f224-42a9-a38d-289cb990c9ac.tmp

very short file (no magic)

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\7646c7fe-eb7f-4111-baed-47a93160456f.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\7ce2b011-7949-43fa-aaba-66550c560841.tmp

UTF-8 Unicode text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\9516885b-c89d-4b07-9f59-157c5e4b9756.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\002445640ee1de89_0

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\05a632044e49ec3d_0

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\06aba3ef4a05b1d3_0

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\1d1b2948d4525464_0

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\200e0abd4ba2ff0b_0

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\229c73a4fe442ea3_0

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\5278677776ece701_0

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\5da3893660e7a47a_0

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\6485724e45ee2243_0

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\6c75240678e5e01e_0

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\75ddb2c602fd7877_0

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\786b0adb2bd9c037_0

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\80a193e1143879d7_0

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\8ed7979f48ca3039_0

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\9e21f8aa16d21fc2_0

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\a431c1478c67bc32_0

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\a8d7eb2cedf7692b_0

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\b92b2c27ad669878_0

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\bda3c198988ffc1a_0

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\c27291f84aa51d71_0

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\d9852fc8edfab566_0

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\dc6462b65c6623d5_0

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\ee05b7802d222e35_0

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\f22d5e331d7c4eab_0

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\f597f914edb8e129_0

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies

SQLite 3.x database, last written using SQLite version 3032001

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies-journal

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Current Session

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Current Tabs

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8520.615.0.5_1\_metadata\computed_hashes.json

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Favicons

SQLite 3.x database, last written using SQLite version 3032001

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Favicons-journal

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\File System\Origins\000001.dbtmp

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\File System\Origins\000003.log

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\File System\Origins\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\File System\Origins\MANIFEST-000001

PGP\011Secret Key -

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History

SQLite 3.x database, last written using SQLite version 3032001

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History-journal

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Action Predictor

SQLite 3.x database, last written using SQLite version 3032001

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Action Predictor-journal

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\QuotaManager

SQLite 3.x database, last written using SQLite version 3032001

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\QuotaManager-journal

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Reporting and NEL

SQLite 3.x database, last written using SQLite version 3032001

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Reporting and NEL-journal

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\3085c1ef-01c8-4cfa-a8dd-fb9b1ffb49ad.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Local Storage\leveldb\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Platform Notifications\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Session Storage\000003.log

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Session Storage\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\9a88bfbb-e9d5-4757-8815-bb24bda897a2.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Platform Notifications\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\000003.log

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Visited Links

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\a61a9d9e-1da0-4847-b7aa-e3cdf777b186.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\c1652dca-5907-4397-b613-cde51acd4b2f.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\c4005ad4-7ef8-4b7e-960e-ad09a8a8c684.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cba595f5-4b38-4568-8eda-aa17998e16b3.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cf03e488-4006-4aed-a42e-31e7dd0c0a39.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000004

MPEG-4 LOAS

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\e0ca1c89-5eb5-4916-9177-1082a9223bbe.tmp

UTF-8 Unicode text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\e29a2a5c-75ce-4776-bc18-3ed36aa0b849.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG

ASCII text

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Browser

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version

ASCII text, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\aaa72626-de97-4922-bb08-bf1849aeb9cd.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\b0494455-4893-4af3-9197-7485c0b4f56e.tmp

data

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\c9287eaa-d22b-49aa-af79-0f794f0463c5.tmp

ASCII text, with very long lines, with no line terminators

modified

C:\Users\user\AppData\Local\Google\Chrome\User Data\cc6d00fc-945c-4e9e-a1f8-ca54ab1c6c37.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\e2d55278-6188-4db9-8ebc-616e2df7e45a.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\f36d9e0a-8ab5-492b-893c-90a336f48c0f.tmp

ASCII text, with very long lines, with no line terminators

dropped

C:\Users\user\AppData\Local\Temp\0625af07-2896-4943-b0e3-5868486ac129.tmp

very short file (no magic)

dropped

C:\Users\user\AppData\Local\Temp\50916eb0-12e5-474c-9088-bc60f2581c83.tmp

Google Chrome extension, version 3

dropped

C:\Users\user\AppData\Local\Temp\5ee018e4-4128-4b30-9909-86c222451472.tmp

very short file (no magic)

dropped

C:\Users\user\AppData\Local\Temp\6bebe0bf-2ac4-40bc-910f-bd8906a292c6.tmp

Google Chrome extension, version 3

dropped

C:\Users\user\AppData\Local\Temp\browser-sslkeys.log

ASCII text

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\6bebe0bf-2ac4-40bc-910f-bd8906a292c6.tmp

Google Chrome extension, version 3

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\bg\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\ca\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\cs\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\da\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\de\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\el\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\en\messages.json

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\en_GB\messages.json

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\es\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\es_419\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\et\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\fi\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\fil\messages.json

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\fr\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\hi\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\hr\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\hu\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\id\messages.json

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\it\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\ja\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\ko\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\lt\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\lv\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\nb\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\nl\messages.json

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\pl\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\pt_BR\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\pt_PT\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\ro\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\ru\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\sk\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\sl\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\sr\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\sv\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\th\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\tr\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\uk\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\vi\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\zh_CN\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\_locales\zh_TW\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\images\icon_128.png

PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\images\icon_16.png

PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_1661387247\CRX_INSTALL\manifest.json

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\50916eb0-12e5-474c-9088-bc60f2581c83.tmp

Google Chrome extension, version 3

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\am\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\ar\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\bg\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\bn\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\ca\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\cs\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\da\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\de\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\el\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\en\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\es\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\et\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\fa\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\fi\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\fil\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\fr\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\gu\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\hi\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\hr\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\hu\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\id\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\it\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\ja\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\kn\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\ko\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\lt\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\lv\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\ml\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\mr\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\ms\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\nb\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\nl\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\pl\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\pt\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\ro\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\ru\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\sk\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\sl\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\sr\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\sv\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\sw\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\ta\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\te\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\th\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\tr\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\uk\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\vi\messages.json

UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\zh\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\_locales\zh_TW\messages.json

UTF-8 Unicode text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scoped_dir6456_451601126\CRX_INSTALL\manifest.json

ASCII text, with very long lines, with CRLF line terminators

dropped

C:\Windows\Fonts\timesi.ttf

data

dropped

There are 204 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation 'https://kezenelectric.ca/First-America'

Details

Is windows:	true
Is dropped:	false
PID:	6456
Target ID:	0
Parent PID:	3096
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation 'https://kezenelectric.ca/First-America'
Size:	2150896
MD5:	C139654B5C1438A95B321BB01AD63EF6
Time:	21:02:09
Date:	10/06/2021
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff609c80000
Modulesize:	2199552
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1528,13816511049468976980,9988846167183782253,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1700 /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	6680
Target ID:	1
Parent PID:	6456
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1528,13816511049468976980,9988846167183782253,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1700 /prefetch:8
Size:	2150896
MD5:	C139654B5C1438A95B321BB01AD63EF6
Time:	21:02:10
Date:	10/06/2021
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff609c80000
Modulesize:	2199552
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://kezenelectric.ca/First-America/

https://kezenelectric.ca/First-America/index2.php

unknown

https://kezenelectric.ca/home/past-projects/

https://kezenelectric.ca/

https://kezenelectric.ca/First-America2(First

unknown

https://kezenelectric.ca/First-AmericaM

unknown

https://kezenelectric.ca/First-America

unknown

https://kezenelectric.ca/First-America/First

unknown

https://kezenelectric.ca/First-Americal

unknown

https://kezenelectric.ca/First-Americak

unknown

https://kezenelectric.ca/home/about-us/

https://kezenelectric.ca/home/about-us/accreditations-certifications/

https://kezenelectric.ca/First-AmericaFirst

unknown

https://kezenelectric.ca/First-America/

unknown

https://kezenelectric.ca/home/about-us/meet-our-team/

https://kezenelectric.ca/exec/fd_helpWin?topic=8#main

https://kezenelectric.ca/exec/fd_helpWin?topic=8

https://kezenelectric.ca/First-America/(First

unknown

https://kezenelectric.ca/home/contact-us/testamonials/

https://kezenelectric.ca/home/contact-us/

https://kezenelectric.ca/First-America/2(First

unknown

https://wphoot.com/wp-content/uploads/siteground-optimizer-assets/megamenu.min.js?ver=2.9.2

unknown

https://kezenelectric.ca/home/about-us/accreditations-certifications/c

unknown

https://wphoot.com/wp-content/uploads/siteground-optimizer-assets/contact-form-7.min.js?ver=5.3.2

unknown

https://kezenelectric.ca/wp-content/plugins/wp-customer-reviews/js/wp-customer-reviews.js?ver=3.5.6

unknown

https://wphoot.com/themes/metrolo/

https://kezenelectric.ca/wp-content/themes/metrolo/js/jquery.fitvids.js?ver=1.1aD

unknown

https://kezenelectric.ca/wp-content/themes/metrolo/js/jquery.superfish.js?ver=1.7.5

unknown

https://kezenelectric.ca/wp-content/themes/metrolo/js/modernizr.custom.js?ver=2.8.3

unknown

http://kezenelectric.ca/Kezen

unknown

https://kezenelectric.ca/home/contact-us/testamonials/Testamonials

unknown

https://kezenelectric.ca/wp-content/uploads/2018/09/cropped-LOGO-3-32x32.jpg(

unknown

https://wphoot.com/wp-includes/js/wp-embed.min.js?ver=5.7.2

unknown

https://wphoot.com

unknown

https://wphoot.com/wp-includes/js/hoverIntent.min.js?ver=1.8.1

unknown

https://kezenelectric.ca/

unknown

http://kezenelectric.ca/wp-content/uploads/2018/11/LOGO-300x179.jpg

66.70.177.74

https://kezenelectric.ca/wp-includes/js/hoverIntent.min.js?ver=1.8.1a

unknown

https://kezenelectric.ca/wp-content/themes/metrolo/js/hoot.theme.js?ver=1.9.14

unknown

https://kezenelectric.ca/home/contact-us/

unknown

https://kezenelectric.ca/home/about-us/

unknown

https://kezenelectric.ca/Kezen

unknown

https://kezenelectric.ca/wp-includes/js/wp-embed.min.js?ver=5.7.2aD

unknown

https://wphoot.com/themes/metrolo/Metrolo

unknown

https://kezenelectric.ca/Wc

unknown

https://kezenelectric.ca/home/about-us/meet-our-team/

unknown

https://kezenelectric.ca/exec/fd_helpWin?topic=8

unknown

https://dns.google

unknown

https://kezenelectric.ca/home/about-us/accreditations-certifications/Accreditations

unknown

https://wphoot.com/wp-content/plugins/easy-digital-downloads/assets/js/edd-ajax.min.js?ver=2.9.26

unknown

https://kezenelectric.ca/home/contact-us/Contact

unknown

https://kezenelectric.ca/home/about-us/accreditations-certifications/

unknown

https://kezenelectric.ca/wp-content/themes/metrolo/js/jquery.lightSlider.js?ver=1.1.1

unknown

https://wphoot.comh

unknown

https://wphoot.com/_

unknown

https://wphoot.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2

unknown

https://kezenelectric.ca/home/about-us/meet-our-team/Meet

unknown

https://kezenelectric.ca/wp-includes/js/jquery/jquery.min.js?ver=3.5.1

unknown

https://wallpaperaccess.com

unknown

https://wphoot.com/wp-content/uploads/siteground-optimizer-assets/modernizr.min.js?ver=2.8.3

unknown

https://kezenelectric.ca/wp-content/themes/metrolo/js/modernizr.custom.js?ver=2.8.3aD

unknown

https://kezenelectric.ca/wp-content/themes/metrolo/js/jquery.parallax.js?ver=1.4.2aD

unknown

https://wphoot.com/themes/metrolo/

unknown

https://kezenelectric.ca/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2aD

unknown

https://wphoot.com/;

unknown

https://wphoot.com/wp-content/uploads/siteground-optimizer-assets/hoot-theme.min.js?ver=2.12

unknown

http://kezenelectric.ca/

66.70.177.74

https://feedback.googleusercontent.com

unknown

https://kezenelectric.ca/home/about-us/About

unknown

http://kezenelectric.ca/wp-content/uploads/2018/11/CCC.jpg

66.70.177.74

https://kezenelectric.ca/favicon.ico

unknown

https://www.dwdtechgroup.com

unknown

https://kezenelectric.ca/wp-includes/js/wp-emoji-release.min.js?ver=5.7.2

unknown

https://twemoji.maxcdn.com/v/13.0.1/

unknown

https://kezenelectric.ca/wp-content/themes/metrolo/js/jquery.parallax.js?ver=1.4.2

unknown

https://wphoot.com/

unknown

https://kezenelectric.ca/k

unknown

https://wphoot.com/k

unknown

https://kezenelectric.ca/wp-content/plugins/wp-customer-reviews/js/wp-customer-reviews.js?ver=3.5.6a

unknown

https://kezenelectric.ca/wp-includes/js/wp-emoji-release.min.js?ver=5.7.2aD

unknown

https://kezenelectric.ca/exec/fd_helpWin?topic=8#main

unknown

https://wphoot.com/x

unknown

https://kezenelectric.ca/wp-content/themes/metrolo/js/jquery.fitvids.js?ver=1.1

unknown

https://kezenelectric.ca

unknown

https://wphoot.com/wp-content/uploads/siteground-optimizer-assets/fitvids.min.js?ver=1.1

unknown

https://kezenelectric.ca/wp-content/themes/metrolo/js/hoot.theme.js?ver=1.9.14aD

unknown

https://kezenelectric.ca/exec/fd_helpWin?topic=8#maintHZQ

unknown

https://kezenelectric.ca/wp-includes/js/hoverIntent.min.js?ver=1.8.1aD

unknown

https://kezenelectric.ca/wp-content/themes/metrolo/js/jquery.superfish.js?ver=1.7.5aD

unknown

http://kezenelectric.ca/wp-content/uploads/2018/11/index-300x117.png

66.70.177.74

https://kezenelectric.ca/wp-content/themes/metrolo/js/jquery.lightSlider.js?ver=1.1.1aD

unknown

https://kezenelectric.ca/wp-content/uploads/2018/09/cropped-LOGO-3-32x32.jpg

unknown

https://kezenelectric.ca/home/past-projects/

unknown

https://kezenelectric.ca/home/past-projects/Past

unknown

https://kezenelectric.ca/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2

unknown

https://kezenelectric.ca/wp-includes/js/hoverIntent.min.js?ver=1.8.1

unknown

https://kezenelectric.ca/wp-includes/js/jquery/jquery.min.js?ver=3.5.1aD

unknown

https://kezenelectric.ca/home/contact-us/testamonials/

unknown

https://kezenelectric.ca/wp-includes/js/wp-embed.min.js?ver=5.7.2

unknown

https://clients2.googleusercontent.com

unknown

There are 90 hidden URLs, click here to show them.

Domains

Name

Malicious

kezenelectric.ca

66.70.177.74

Details

Name:	kezenelectric.ca
IP:	66.70.177.74
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

wallpaperaccess.com

172.67.7.204

Details

Name:	wallpaperaccess.com
IP:	172.67.7.204
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

gofirstam.com

104.129.24.42

Details

Name:	gofirstam.com
IP:	104.129.24.42
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

dwdtechnology.wpengine.com

104.154.247.12

Details

Name:	dwdtechnology.wpengine.com
IP:	104.154.247.12
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

s.w.org

192.0.77.48

googlehosted.l.googleusercontent.com

142.250.180.225

wphoot.com

35.208.111.117

Details

Name:	wphoot.com
IP:	35.208.111.117
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

clients2.googleusercontent.com

unknown

www.dwdtechgroup.com

unknown

IPs

Domain

Country

Malicious

104.154.247.12

dwdtechnology.wpengine.com

United States

Details

IP:	104.154.247.12
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Country:	United States
Countrycode:	USA
ASN number:	15169
ASN name:	GOOGLEUS
Private:	false
Domain:	dwdtechnology.wpengine.com

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

192.168.2.1

unknown

104.129.24.42

gofirstam.com

United States

Details

IP:	104.129.24.42
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Country:	United States
Countrycode:	USA
ASN number:	8100
ASN name:	ASN-QUADRANET-GLOBALUS
Private:	false
Domain:	gofirstam.com

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

142.250.180.225

googlehosted.l.googleusercontent.com

United States

Details

IP:	142.250.180.225
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Country:	United States
Countrycode:	USA
ASN number:	15169
ASN name:	GOOGLEUS
Private:	false
Domain:	googlehosted.l.googleusercontent.com

35.208.111.117

wphoot.com

United States

Details

IP:	35.208.111.117
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Country:	United States
Countrycode:	USA
ASN number:	19527
ASN name:	GOOGLE-2US
Private:	false
Domain:	wphoot.com

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

172.67.7.204

wallpaperaccess.com

United States

Details

IP:	172.67.7.204
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Country:	United States
Countrycode:	USA
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	wallpaperaccess.com

66.70.177.74

kezenelectric.ca

Canada

Details

IP:	66.70.177.74
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Country:	Canada
Countrycode:	CAN
ASN number:	16276
ASN name:	OVHFR
Private:	false
Domain:	kezenelectric.ca

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

239.255.255.250

unknown

Reserved

127.0.0.1

unknown

Registry

Path

Value

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

ahfgeienlihckogmohjhadlkjgocpleb

C:\Program Files\Google\Chrome\Application\chrome.exe

gdaefkejpgkiemlaofpalmlakkmbjdnl

C:\Program Files\Google\Chrome\Application\chrome.exe

gfdkimpbcpahaombhbimeihdjnejgicl

C:\Program Files\Google\Chrome\Application\chrome.exe

kmendfapggjehodndflmmgagdbamhnfd

C:\Program Files\Google\Chrome\Application\chrome.exe

mfehgcgbbipciphmccgaenjidiccnmng

C:\Program Files\Google\Chrome\Application\chrome.exe

mhjfbmdgcfjbbpaeojofohoefgiehjai

C:\Program Files\Google\Chrome\Application\chrome.exe

neajdppkdcdipfabeoofebfddakdcjhd

C:\Program Files\Google\Chrome\Application\chrome.exe

nkeimhogjdpnpccoofpliimaahmaaome

C:\Program Files\Google\Chrome\Application\chrome.exe

prefs.preference_reset_time

C:\Program Files\Google\Chrome\Application\chrome.exe

S-1-5-21-3853321935-2125563209-4053062332-1002

C:\Program Files\Google\Chrome\Application\chrome.exe

gfdkimpbcpahaombhbimeihdjnejgicl

C:\Program Files\Google\Chrome\Application\chrome.exe

nmmhkkegccagdldgiimedpiccmgmieda

C:\Program Files\Google\Chrome\Application\chrome.exe

pkedcjkdefgpdelpbcmbmeomcjbeemfm

C:\Program Files\Google\Chrome\Application\chrome.exe

nmmhkkegccagdldgiimedpiccmgmieda

C:\Program Files\Google\Chrome\Application\chrome.exe

state

C:\Program Files\Google\Chrome\Application\chrome.exe

StatusCodes

C:\Program Files\Google\Chrome\Application\chrome.exe

StatusCodes

C:\Program Files\Google\Chrome\Application\chrome.exe

state

C:\Program Files\Google\Chrome\Application\chrome.exe

software_reporter.reporting

C:\Program Files\Google\Chrome\Application\chrome.exe

module_blacklist_cache_md5_digest

C:\Program Files\Google\Chrome\Application\chrome.exe

media.storage_id_salt

C:\Program Files\Google\Chrome\Application\chrome.exe

google.services.last_account_id

C:\Program Files\Google\Chrome\Application\chrome.exe

google.services.account_id

C:\Program Files\Google\Chrome\Application\chrome.exe

software_reporter.prompt_seed

C:\Program Files\Google\Chrome\Application\chrome.exe

settings_reset_prompt.last_triggered_for_homepage

C:\Program Files\Google\Chrome\Application\chrome.exe

default_search_provider_data.template_url_data

C:\Program Files\Google\Chrome\Application\chrome.exe

safebrowsing.incidents_sent

C:\Program Files\Google\Chrome\Application\chrome.exe

pinned_tabs

C:\Program Files\Google\Chrome\Application\chrome.exe

search_provider_overrides

C:\Program Files\Google\Chrome\Application\chrome.exe

settings_reset_prompt.last_triggered_for_default_search

C:\Program Files\Google\Chrome\Application\chrome.exe

prefs.preference_reset_time

C:\Program Files\Google\Chrome\Application\chrome.exe

google.services.last_username

C:\Program Files\Google\Chrome\Application\chrome.exe

session.startup_urls

C:\Program Files\Google\Chrome\Application\chrome.exe

session.restore_on_startup

C:\Program Files\Google\Chrome\Application\chrome.exe

software_reporter.prompt_version

C:\Program Files\Google\Chrome\Application\chrome.exe

settings_reset_prompt.last_triggered_for_startup_urls

C:\Program Files\Google\Chrome\Application\chrome.exe

settings_reset_prompt.prompt_wave

C:\Program Files\Google\Chrome\Application\chrome.exe

homepage

C:\Program Files\Google\Chrome\Application\chrome.exe

homepage_is_newtabpage

C:\Program Files\Google\Chrome\Application\chrome.exe

browser.show_home_button

C:\Program Files\Google\Chrome\Application\chrome.exe

user_experience_metrics.stability.exited_cleanly

C:\Program Files\Google\Chrome\Application\chrome.exe

lastrun

C:\Program Files\Google\Chrome\Application\chrome.exe

Blob

C:\Program Files\Google\Chrome\Application\chrome.exe

Blob

C:\Program Files\Google\Chrome\Application\chrome.exe

Blob

C:\Program Files\Google\Chrome\Application\chrome.exe

Blob

C:\Program Files\Google\Chrome\Application\chrome.exe

Blob

C:\Program Files\Google\Chrome\Application\chrome.exe

Blob

There are 39 hidden registries, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

C628A77000

unkown

page read and write

1C3B3E02000

unkown

page read and write

7FF50C068000

unkown

page readonly

223C6D80000

unkown

page read and write

7FF5337DF000

unkown

page readonly

1C3B3E6A000

unkown

page read and write

7FF536A90000

unkown

page readonly

7FF50BD77000

unkown

page readonly

209A8EC7000

unkown

page read and write

7FF536B5E000

unkown

page readonly

7FF5AD6D7000

unkown

page readonly

7FF57F313000

unkown

page readonly

223C6C60000

unkown

page read and write

7FF57F3DC000

unkown

page readonly

223C1DF0000

unkown

page read and write

223C6C64000

unkown

page read and write

1427FE57000

unkown

page read and write

7FF5AD6EC000

unkown

page readonly

209A8E70000

unkown

page read and write

7FF50B848000

unkown

page readonly

7FF536A92000

unkown

page readonly

234DDB90000

unkown

page write copy

223C15D0000

unkown

page readonly

7FF5367AC000

unkown

page readonly

223C6C50000

unkown

page read and write

7FF57F4DE000

unkown

page readonly

C628EFF000

unkown

page read and write

7FF536B1F000

unkown

page readonly

C628F7E000

unkown

page read and write

7FF50BBD5000

unkown

page readonly

7FF533926000

unkown

page readonly

7FF533816000

unkown

page readonly

209AB382000

unkown

page read and write

209AB216000

unkown

page read and write

209A8EC9000

unkown

page read and write

1427FF08000

unkown

page read and write

7FF57F36E000

unkown

page readonly

4D7391E000

unkown

page read and write

7FF5339EB000

unkown

page readonly

223C6C28000

unkown

page read and write

223C1D30000

unkown

page read and write

1427FE5A000

unkown

page read and write

223C6D10000

unkown

page read and write

223C6B10000

unkown

page read and write

209A8F60000

unkown

page read and write

7FF50C02C000

unkown

page readonly

22CFDE5D000

unkown

page read and write

7FF5AD662000

unkown

page readonly

1427FE59000

unkown

page read and write

1427FE47000

unkown

page read and write

223C25F0000

unkown

page read and write

223C1676000

unkown

page read and write

209AADC0000

unkown

page read and write

234DDC59000

unkown

page read and write

7FF533993000

unkown

page readonly

223C1654000

unkown

page read and write

7FF50BBC0000

unkown

page readonly

234DDC6C000

unkown

page read and write

223C1800000

unkown

page readonly

209A8E6F000

unkown

page read and write

234DDD02000

unkown

page read and write

223C1600000

unkown

page read and write

223C6E3C000

unkown

page read and write

7FF53379B000

unkown

page readonly

7FF536B58000

unkown

page readonly

209AAFE1000

unkown

page read and write

209A8F3F000

unkown

page read and write

1C3B3E6F000

unkown

page read and write

7FF50BEA3000

unkown

page readonly

1427FE70000

unkown

page read and write

7FF53332E000

unkown

page readonly

234DDC42000

unkown

page read and write

7FF50C044000

unkown

page readonly

7FF5335F7000

unkown

page readonly

C628FFE000

unkown

page read and write

C62897E000

unkown

page read and write

7FF50C079000

unkown

page readonly

1C3B3C70000

heap private

page read and write

7FF533542000

unkown

page readonly

7FF5AD704000

unkown

page readonly

223C16AE000

unkown

page read and write

7FF533238000

unkown

page readonly

4D7389B000

unkown

page read and write

7FF5332E1000

unkown

page readonly

223C2700000

unkown

page readonly

7FF50C037000

unkown

page readonly

7FF57F3D4000

unkown

page readonly

7FF5AD728000

unkown

page readonly

7FF57F1F0000

unkown

page readonly

7FF53392D000

unkown

page readonly

7FF536AF0000

unkown

page readonly

7FF533A56000

unkown

page readonly

1C3B3E6F000

unkown

page read and write

7FF57F45A000

unkown

page readonly

223C6C2E000

unkown

page read and write

47DC677000

unkown

page read and write

7FF50C076000

unkown

page readonly

234DDC00000

unkown

page read and write

1C3B3E6D000

unkown

page read and write

22CFDC40000

unkown

page readonly

234DDD13000

unkown

page read and write

7FF533661000

unkown

page readonly

7FF5339E5000

unkown

page readonly

209A8E70000

unkown

page read and write

223C6E14000

unkown

page read and write

7FF53394C000

unkown

page readonly

7FF57F036000

unkown

page readonly

7FF536B44000

unkown

page readonly

223C1F00000

unkown

page read and write

4D73E7D000

unkown

page read and write

223C1699000

unkown

page read and write

7FF5AD37C000

unkown

page readonly

1C3B3E6F000

unkown

page read and write

7FF50BEFE000

unkown

page readonly

209A8E70000

unkown

page read and write

7FF533A0C000

unkown

page readonly

7FF533A34000

unkown

page readonly

1C3B3E56000

unkown

page read and write

234DDC6C000

unkown

page read and write

223C26E0000

unkown

page readonly

7FF50BEE1000

unkown

page readonly

209A8F70000

unkown

page read and write

7FF5AD6C5000

unkown

page readonly

223C2710000

unkown

page readonly

22CFDE13000

unkown

page read and write

7FF5AD486000

unkown

page readonly

1427FE29000

unkown

page read and write

14200800000

unkown

page readonly

1427FD10000

heap default

page read and write

209A8FA1000

unkown

page read and write

7FF5AD72E000

unkown

page readonly

1C3B3DB0000

unkown

page write copy

7FF57F46A000

unkown

page readonly

223C1702000

unkown

page read and write

7FF57F47B000

unkown

page readonly

7FF50C0F1000

unkown

page readonly

5B30DFE000

unkown

page read and write

223C15F0000

unkown

page read and write

223C1F18000

unkown

page read and write

1C3B3E6D000

unkown

page read and write

7FF5337DD000

unkown

page readonly

C62917E000

unkown

page read and write

14200480000

unkown

page readonly

7FF50C06E000

unkown

page readonly

7FF5337CB000

unkown

page readonly

7FF5AD397000

unkown

page readonly

7FF50BFFA000

unkown

page readonly

223C6C50000

unkown

page read and write

7FF50BFEC000

unkown

page readonly

7FF5AD5C3000

unkown

page readonly

223C1DF3000

unkown

page read and write

7FF5AD73D000

unkown

page readonly

234DDC13000

unkown

page read and write

223C1F02000

unkown

page read and write

223C6D80000

unkown

page read and write

1427FF13000

unkown

page read and write

7FF5AD38A000

unkown

page readonly

C62887B000

unkown

page read and write

1C3B3CD0000

heap default

page read and write

7FF536BE2000

unkown

page readonly

209A8E70000

unkown

page read and write

223C166E000

unkown

page read and write

7FF536B34000

unkown

page readonly

209AADC0000

unkown

page read and write

7FF5AD70A000

unkown

page readonly

7FF57F470000

unkown

page readonly

234DDC6C000

unkown

page read and write

7FF5339B4000

unkown

page readonly

7FF561262000

unkown

page readonly

7FF5336C7000

unkown

page readonly

7FF50C04A000

unkown

page readonly

223C6E2C000

unkown

page read and write

47DC3FD000

unkown

page read and write

283D1AF000

unkown

page read and write

209A8E70000

unkown

page read and write

1427FE55000

unkown

page read and write

7FF50BF53000

unkown

page readonly

1427FD20000

unkown

page readonly

22CFDE2A000

unkown

page read and write

7FF53388F000

unkown

page readonly

1C3B57C0000

unkown

page read and write

7FF50BFEA000

unkown

page readonly

1C3B3E6A000

unkown

page read and write

7FF5AD7B1000

unkown

page readonly

1C3B3E6F000

unkown

page read and write

223C6D28000

unkown

page read and write

1C3B3F02000

unkown

page read and write

14200010000

unkown

page readonly

283D97E000

unkown

page read and write

7FF533277000

unkown

page readonly

223C6C20000

unkown

page read and write

223C1613000

unkown

page read and write

223C6E00000

unkown

page read and write

223C6CF0000

unkown

page readonly

223C1713000

unkown

page read and write

7FF5337B8000

unkown

page readonly

7FF5AD6BE000

unkown

page readonly

1427FE8E000

unkown

page read and write

C628C7A000

unkown

page read and write

223C15C0000

heap default

page read and write

1C3B3E71000

unkown

page read and write

1C3B4000000

unkown

page readonly

7FF5332FC000

unkown

page readonly

7FF53388A000

unkown

page readonly

7FF536AF5000

unkown

page readonly

223C6E7B000

unkown

page read and write

22CFDC30000

heap default

page read and write

7FF57F4E6000

unkown

page readonly

1427FE00000

unkown

page read and write

1C3B3E6D000

unkown

page read and write

234DDC6C000

unkown

page read and write

7FF5AD4E1000

unkown

page readonly

7FF533A0F000

unkown

page readonly

7FF5ACF1D000

unkown

page readonly

1C3B3E6D000

unkown

page read and write

14200602000

unkown

page read and write

7FF50BF6C000

unkown

page readonly

C62937C000

unkown

page read and write

209AADC0000

unkown

page read and write

1C3B3E71000

unkown

page read and write

223C6C41000

unkown

page read and write

7FF536B69000

unkown

page readonly

7FF536BE1000

unkown

page readonly

209A8EDC000

unkown

page read and write

1C3B4200000

unkown

page readonly

7FF5AD6EF000

unkown

page readonly

223C6D80000

unkown

page readonly

7FF533AD2000

unkown

page readonly

223C6B00000

unkown

page read and write

1C3B3E6A000

unkown

page read and write

1C3B3E6D000

unkown

page read and write

C62947D000

unkown

page read and write

1C3B3E6F000

unkown

page read and write

1C3B3E71000

unkown

page read and write

7FF57F4BA000

unkown

page readonly

1C3B3CE0000

unkown

page readonly

209A8E70000

unkown

page read and write

7FF50C00B000

unkown

page readonly

7FF5AD47B000

unkown

page readonly

234DF770000

unkown

page readonly

7FF533636000

unkown

page readonly

14200210000

unkown

page readonly

1427FE3C000

unkown

page read and write

47DC27D000

unkown

page read and write

223C2720000

unkown

page readonly

47DBF9C000

unkown

page read and write

234DDC29000

unkown

page read and write

C6288FD000

unkown

page read and write

22CFDF08000

unkown

page read and write

209A8E70000

unkown

page read and write

209A8E70000

unkown

page read and write

7FF5AD683000

unkown

page readonly

7FF5339BF000

unkown

page readonly

7FF57F030000

unkown

page readonly

223C6E11000

unkown

page read and write

223C6C20000

unkown

page read and write

1C3B3F00000

unkown

page read and write

7FF5AD5A1000

unkown

page readonly

47DC4FB000

unkown

page read and write

47DC2FE000

unkown

page read and write

7FF533A28000

unkown

page readonly

283D575000

unkown

page read and write

7FF53399F000

unkown

page readonly

7FF50BF64000

unkown

page readonly

47DC77E000

unkown

page read and write

7FF5337BF000

unkown

page readonly

209AB233000

unkown

page read and write

7FF50C02F000

unkown

page readonly

234DDB80000

heap default

page read and write

1C3B3E6D000

unkown

page read and write

7FF5368B6000

unkown

page readonly

7FF536AB3000

unkown

page readonly

223C2400000

unkown

page read and write

7FF53323D000

unkown

page readonly

22CFDE53000

unkown

page read and write

223C2A71000

unkown

page read and write

1C3B3E13000

unkown

page read and write

1427FF02000

unkown

page read and write

7FF5339CA000

unkown

page readonly

7FF50C054000

unkown

page readonly

1427FE21000

unkown

page read and write

22CFDF02000

unkown

page read and write

7FF5AD6CB000

unkown

page readonly

209A8E70000

unkown

page read and write

22CFE402000

unkown

page read and write

22CFE600000

unkown

page readonly

7FF57F475000

unkown

page readonly

7FF533A48000

unkown

page readonly

7FF5369F3000

unkown

page readonly

C628B7A000

unkown

page read and write

7FF536915000

unkown

page readonly

7FF57F561000

unkown

page readonly

209AC110000

unkown

page read and write

209A8F32000

unkown

page read and write

7FF57F4C4000

unkown

page readonly

223C1E02000

unkown

page read and write

7FF5AD6BA000

unkown

page readonly

7FF57F4ED000

unkown

page readonly

14200B40000

unkown

page readonly

22CFDF00000

unkown

page read and write

7FF5AD4E5000

unkown

page readonly

7FF50BCD9000

unkown

page readonly

7FF50C000000

unkown

page readonly

1C3B3F13000

unkown

page read and write

7FF57F2C1000

unkown

page readonly

22CFE940000

unkown

page readonly

223C2510000

unkown

page read and write

234DDBE0000

unkown

page readonly

7FF533671000

unkown

page readonly

7FF533A17000

unkown

page readonly

4D73C7E000

unkown

page read and write

7FF50BE51000

unkown

page readonly

223C6D14000

unkown

page readonly

7FF50BBC6000

unkown

page readonly

223C163E000

unkown

page read and write

1C3B3E6D000

unkown

page read and write

223C6D90000

unkown

page read and write

C62907F000

unkown

page read and write

209A8F1E000

unkown

page read and write

234DDB20000

heap private

page read and write

22CFDD20000

unkown

page readonly

7FF536B4E000

unkown

page readonly

7FF536AEA000

unkown

page readonly

7FF533A24000

unkown

page readonly

7FF5AD5BB000

unkown

page readonly

7FF5339A3000

unkown

page readonly

223C7070000

unkown

page read and write

7FF533AD1000

unkown

page readonly

223C1F18000

unkown

page read and write

7FF536AEE000

unkown

page readonly

7FF5367BA000

unkown

page readonly

7FF5339DE000

unkown

page readonly

7FF536911000

unkown

page readonly

234DDC02000

unkown

page read and write

1427FE4C000

unkown

page read and write

223C1E00000

unkown

page read and write

7FF50C017000

unkown

page readonly

223C1C60000

unkown

page readonly

7FF533A59000

unkown

page readonly

7FF57F4A7000

unkown

page readonly

7FF5AD6C0000

unkown

page readonly

7FF50C0E4000

unkown

page readonly

7FF50C0EA000

unkown

page readonly

209AB23E000

unkown

page read and write

22CFDF13000

unkown

page read and write

7FF50C05F000

unkown

page readonly

5B30D7E000

unkown

page read and write

223C6E61000

unkown

page read and write

7FF57F36B000

unkown

page readonly

7FF5367BF000

unkown

page readonly

283D47F000

unkown

page read and write

223C1689000

unkown

page read and write

7FF5AD739000

unkown

page readonly

C62927C000

unkown

page read and write

7FF50BFFE000

unkown

page readonly

7FF533821000

unkown

page readonly

22CFDD10000

unkown

page readonly

223C6B20000

unkown

page read and write

7FF5336CA000

unkown

page readonly

7FF5368AB000

unkown

page readonly

7FF5339F7000

unkown

page readonly

7FF536949000

unkown

page readonly

7FF533814000

unkown

page readonly

7FF57F4CF000

unkown

page readonly

209AB23A000

unkown

page read and write

223C6AD0000

unkown

page readonly

7FF57E8F1000

unkown

page readonly

7FF536B1C000

unkown

page readonly

223C6D60000

unkown

page read and write

209AB202000

unkown

page read and write

223C1F13000

unkown

page read and write

1427FE4B000

unkown

page read and write

209A8E70000

unkown

page read and write

7FF57F45C000

unkown

page readonly

7FF5AD519000

unkown

page readonly

234DDED0000

unkown

page readonly

209A8E70000

unkown

page read and write

1C3B3E34000

unkown

page read and write

223C6C24000

unkown

page read and write

7FF57F554000

unkown

page readonly

283D87E000

unkown

page read and write

4D73DFF000

unkown

page read and write

223C15E0000

unkown

page readonly

7FF5369EB000

unkown

page readonly

22CFDE8E000

unkown

page read and write

1427FE50000

unkown

page read and write

7FF57F351000

unkown

page readonly

209A8E70000

unkown

page read and write

234DF670000

unkown

page read and write

223C1678000

unkown

page read and write

223C6C40000

unkown

page read and write

234DDC6C000

unkown

page read and write

5B31079000

unkown

page read and write

209A8E8C000

unkown

page read and write

209A8E6D000

unkown

page read and write

5B3117F000

unkown

page read and write

1427FE52000

unkown

page read and write

7FF536AFB000

unkown

page readonly

7FF5339DA000

unkown

page readonly

7FF57F3BD000

unkown

page readonly

1427FE54000

unkown

page read and write

1C3B3E29000

unkown

page read and write

234DDD00000

unkown

page read and write

22CFDBD0000

heap private

page read and write

7FF533980000

unkown

page readonly

7FF5369F8000

unkown

page readonly

C6290FF000

unkown

page read and write

7FF5AD38F000

unkown

page readonly

7FF5AD7A4000

unkown

page readonly

7FF536B3A000

unkown

page readonly

1C3B3E6F000

unkown

page read and write

47DC57E000

unkown

page read and write

223C1658000

unkown

page read and write

7FF57F4B4000

unkown

page readonly

7FF5339E0000

unkown

page readonly

7FF57F49C000

unkown

page readonly

209AB2CB000

unkown

page read and write

7FF5AD736000

unkown

page readonly

223C2A90000

unkown

page read and write

223C26F0000

unkown

page readonly

1C3B3E6D000

unkown

page read and write

223C6DD0000

unkown

page readonly

223C2730000

unkown

page readonly

223C18D0000

unkown

page readonly

14200000000

heap private

page read and write

14200490000

unkown

page read and write

7FF533A3F000

unkown

page readonly

7FF50C07D000

unkown

page readonly

5B310FA000

unkown

page read and write

1427FE46000

unkown

page read and write

223C6A90000

unkown

page read and write

7FF5AD7B2000

unkown

page readonly

7FF5AD71E000

unkown

page readonly

1427FE4D000

unkown

page read and write

7FF50C005000

unkown

page readonly

1C3B58C0000

unkown

page readonly

C628E7B000

unkown

page read and write

7FF57F487000

unkown

page readonly

7FF536BDA000

unkown

page readonly

223C1F58000

unkown

page read and write

234DDC6C000

unkown

page read and write

22CFDE3C000

unkown

page read and write

223C1560000

heap private

page read and write

22CFDDF0000

unkown

page readonly

22CFDE82000

unkown

page read and write

7FF53634D000

unkown

page readonly

283D12B000

unkown

page read and write

223C6D29000

unkown

page write copy

223C6D70000

unkown

page read and write

C628D7F000

unkown

page read and write

223C6E49000

unkown

page read and write

4D73CFF000

unkown

page read and write

7FF536B6D000

unkown

page readonly

22CFE390000

unkown

page read and write

47DC87F000

unkown

page read and write

7FF57F562000

unkown

page readonly

22CFDE00000

unkown

page read and write

22CFDE70000

unkown

page read and write

223C26D0000

unkown

page readonly

234DDC6C000

unkown

page read and write

7FF5AD6F8000

unkown

page readonly

223C16FA000

unkown

page read and write

7FF533885000

unkown

page readonly

22CFE000000

unkown

page readonly

234DDE00000

unkown

page readonly

7FF57F55A000

unkown

page readonly

1C3B3E6A000

unkown

page read and write

223C2500000

unkown

page read and write

7FF536B66000

unkown

page readonly

223C169B000

unkown

page read and write

7FF5335F5000

unkown

page readonly

209AB2D0000

unkown

page read and write

7FF57F3C3000

unkown

page readonly

7FF50BEFB000

unkown

page readonly

7FF533A4E000

unkown

page readonly

209A8E70000

unkown

page read and write

7FF57F4E9000

unkown

page readonly

209AC113000

unkown

page read and write

7FF50BF4D000

unkown

page readonly

283D67B000

unkown

page read and write

7FF53378A000

unkown

page readonly

283D777000

unkown

page read and write

7FF5AD714000

unkown

page readonly

7FF57F49F000

unkown

page readonly

7FF533279000

unkown

page readonly

223C6D80000

unkown

page read and write

7FF5336C4000

unkown

page readonly

7FF5AD660000

unkown

page readonly

7FF536BD4000

unkown

page readonly

223C6DC0000

unkown

page readonly

7FF5AD5C8000

unkown

page readonly

7FF5AD7AA000

unkown

page readonly

1427FE4F000

unkown

page read and write

1C3B3E6A000

unkown

page read and write

7FF5367C7000

unkown

page readonly

7FF5ACF21000

unkown

page readonly

209A8F61000

unkown

page read and write

223C6CF0000

unkown

page read and write

1C3B3E6D000

unkown

page read and write

7FF57F4D8000

unkown

page readonly

1427FE86000

unkown

page read and write

7FF536B61000

unkown

page readonly

1C3B3E00000

unkown

page read and write

223C168E000

unkown

page read and write

7FF533ACA000

unkown

page readonly

7FF533872000

unkown

page readonly

223C6CF4000

unkown

page read and write

7FF536B28000

unkown

page readonly

223C7060000

unkown

page readonly

7FF533AC4000

unkown

page readonly

1C3B3E3F000

unkown

page read and write

223C6C21000

unkown

page read and write

7FF57F045000

unkown

page readonly

209A8F1D000

unkown

page read and write

223C6D80000

unkown

page read and write

7FF5338A1000

unkown

page readonly

223C7000000

unkown

page readonly

7FF5369D1000

unkown

page readonly

209A8F3F000

unkown

page read and write

234DDC6C000

unkown

page read and write

223C162A000

unkown

page read and write

209A8E70000

unkown

page read and write

223C1F59000

unkown

page read and write

7FF536B07000

unkown

page readonly

7FF57F46E000

unkown

page readonly

7FF533831000

unkown

page readonly

209AB242000

unkown

page read and write

223C1E15000

unkown

page read and write

7FF5337A6000

unkown

page readonly

4D73999000

unkown

page read and write

7FF533300000

unkown

page readonly

7FF50C0F2000

unkown

page readonly

223C6D50000

unkown

page read and write

7FF533183000

unkown

page readonly

7FF5337D1000

unkown

page readonly

209A8E6A000

unkown

page read and write

1427FE13000

unkown

page read and write

7FF536351000

unkown

page readonly

1C3B3E6D000

unkown

page read and write

223C6D30000

unkown

page read and write

223C6D70000

unkown

page read and write

223C1673000

unkown

page read and write

7FF53318D000

unkown

page readonly

7FF57F1E7000

unkown

page readonly

7FF5AD731000

unkown

page readonly

5B30CFB000

unkown

page read and write

4D73D79000

unkown

page read and write

223C2101000

unkown

page read and write

223C6D40000

unkown

page read and write

7FF5339CC000

unkown

page readonly

7FF53375F000

unkown

page readonly

223C6C44000

unkown

page read and write

223C6E1E000

unkown

page read and write

There are 543 hidden memdumps, click here to show them.

DOM / HTML

URL

Malicious

https://kezenelectric.ca/First-America/

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdXhLgZAAAAAApDk1usB-6gn8C_jiuIVL8OTDth&co=aHR0cHM6Ly93cGhvb3QuY29tOjQ0Mw..&hl=en&v=CdDdhZfPbLLrfYLBdThNS0-Y&size=invisible&cb=hoe0si3it1gs

https://kezenelectric.ca/home/about-us/accreditations-certifications/

https://kezenelectric.ca/home/contact-us/

https://wphoot.com/themes/metrolo/

https://kezenelectric.ca/home/about-us/meet-our-team/

https://kezenelectric.ca/home/about-us/

https://kezenelectric.ca/exec/fd_helpWin?topic=8#main

https://kezenelectric.ca/

https://kezenelectric.ca/exec/fd_helpWin?topic=8

https://kezenelectric.ca/home/past-projects/

https://kezenelectric.ca/home/contact-us/testamonials/

There are 2 hidden doms, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOCReport

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

DOM / HTML