IOC Report
https://conbassprox-lgoinz.godaddysites.com/

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Sep 28 04:18:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Sep 28 04:18:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Sep 28 04:18:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Sep 28 04:18:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Sep 28 04:18:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 157
ASCII text, with very long lines (852)
dropped
Chrome Cache Entry: 158
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 192x192, components 3
dropped
Chrome Cache Entry: 159
Web Open Font Format (Version 2), TrueType, length 14712, version 1.0
downloaded
Chrome Cache Entry: 160
ASCII text, with very long lines (1352)
downloaded
Chrome Cache Entry: 161
ASCII text, with very long lines (32970), with no line terminators
downloaded
Chrome Cache Entry: 162
ASCII text, with very long lines (905)
dropped
Chrome Cache Entry: 163
Unicode text, UTF-8 text, with very long lines (63425)
dropped
Chrome Cache Entry: 164
Web Open Font Format (Version 2), TrueType, length 14200, version 1.0
downloaded
Chrome Cache Entry: 165
Web Open Font Format (Version 2), TrueType, length 14104, version 1.0
downloaded
Chrome Cache Entry: 166
ASCII text, with very long lines (1352)
dropped
Chrome Cache Entry: 167
ASCII text, with very long lines (6969)
downloaded
Chrome Cache Entry: 168
Web Open Font Format (Version 2), TrueType, length 14892, version 1.0
downloaded
Chrome Cache Entry: 169
ASCII text, with very long lines (23126)
downloaded
Chrome Cache Entry: 170
ASCII text, with very long lines (21556)
downloaded
Chrome Cache Entry: 171
HTML document, Unicode text, UTF-8 text, with very long lines (6691)
downloaded
Chrome Cache Entry: 172
RIFF (little-endian) data, Web/P image
downloaded
Chrome Cache Entry: 173
ASCII text
dropped
Chrome Cache Entry: 174
ASCII text, with very long lines (51862)
dropped
Chrome Cache Entry: 175
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 176
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 1535x1281, components 3
dropped
Chrome Cache Entry: 177
Unicode text, UTF-8 text, with very long lines (63425)
downloaded
Chrome Cache Entry: 178
ASCII text, with very long lines (786)
downloaded
Chrome Cache Entry: 179
ASCII text, with very long lines (1211)
dropped
Chrome Cache Entry: 180
Unicode text, UTF-8 text, with very long lines (20947)
downloaded
Chrome Cache Entry: 181
GIF image data, version 89a, 1 x 1
downloaded
Chrome Cache Entry: 182
ASCII text
downloaded
Chrome Cache Entry: 183
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 184
ASCII text, with very long lines (905)
downloaded
Chrome Cache Entry: 185
ASCII text, with very long lines (383)
dropped
Chrome Cache Entry: 186
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 32x32, components 3
dropped
Chrome Cache Entry: 187
ASCII text
downloaded
Chrome Cache Entry: 188
Web Open Font Format (Version 2), TrueType, length 14780, version 1.0
downloaded
Chrome Cache Entry: 189
RIFF (little-endian) data, Web/P image
downloaded
Chrome Cache Entry: 190
ASCII text, with very long lines (383)
downloaded
Chrome Cache Entry: 191
GIF image data, version 89a, 1 x 1
downloaded
Chrome Cache Entry: 192
ASCII text
dropped
Chrome Cache Entry: 193
ASCII text
downloaded
Chrome Cache Entry: 194
ASCII text, with very long lines (12251)
dropped
Chrome Cache Entry: 195
ASCII text, with very long lines (330)
downloaded
Chrome Cache Entry: 196
ASCII text
dropped
Chrome Cache Entry: 197
Web Open Font Format (Version 2), TrueType, length 38372, version 1.0
downloaded
Chrome Cache Entry: 198
ASCII text, with very long lines (3043)
dropped
Chrome Cache Entry: 199
GIF image data, version 89a, 1 x 1
downloaded
Chrome Cache Entry: 200
ASCII text, with very long lines (21556)
dropped
Chrome Cache Entry: 201
JSON data
downloaded
Chrome Cache Entry: 202
ASCII text, with very long lines (330)
dropped
Chrome Cache Entry: 203
ASCII text, with very long lines (786)
dropped
Chrome Cache Entry: 204
ASCII text, with very long lines (3043)
downloaded
Chrome Cache Entry: 205
ASCII text, with very long lines (65536), with no line terminators
dropped
Chrome Cache Entry: 206
ASCII text
dropped
Chrome Cache Entry: 207
GIF image data, version 89a, 1 x 1
dropped
Chrome Cache Entry: 208
Web Open Font Format (Version 2), TrueType, length 33092, version 1.0
downloaded
Chrome Cache Entry: 209
ASCII text, with very long lines (1211)
downloaded
Chrome Cache Entry: 210
ASCII text, with very long lines (829)
dropped
Chrome Cache Entry: 211
ASCII text, with very long lines (23126)
dropped
Chrome Cache Entry: 212
Unicode text, UTF-8 text, with very long lines (20947)
dropped
Chrome Cache Entry: 213
ASCII text, with very long lines (522)
downloaded
Chrome Cache Entry: 214
ASCII text, with very long lines (6969)
dropped
Chrome Cache Entry: 215
ASCII text, with very long lines (51862)
downloaded
Chrome Cache Entry: 216
ASCII text, with very long lines (12251)
downloaded
Chrome Cache Entry: 217
ASCII text, with very long lines (852)
downloaded
Chrome Cache Entry: 218
RIFF (little-endian) data, Web/P image
downloaded
Chrome Cache Entry: 219
ASCII text, with very long lines (1824)
dropped
Chrome Cache Entry: 220
ASCII text, with very long lines (829)
downloaded
Chrome Cache Entry: 221
ASCII text, with very long lines (65536), with no line terminators
dropped
Chrome Cache Entry: 222
ASCII text, with very long lines (522)
dropped
Chrome Cache Entry: 223
ASCII text
downloaded
Chrome Cache Entry: 224
Web Open Font Format (Version 2), TrueType, length 14160, version 1.0
downloaded
Chrome Cache Entry: 225
ASCII text, with very long lines (1824)
downloaded
Chrome Cache Entry: 226
GIF image data, version 89a, 1 x 1
dropped
There are 67 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=2212,i,6446329969754612965,15831060339190228914,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://conbassprox-lgoinz.godaddysites.com/"

URLs

Name
IP
Malicious
https://conbassprox-lgoinz.godaddysites.com/
malicious
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7osDJT9g.woff2)
unknown
https://conbassprox-lgoinz.godaddysites.com/sw.js
13.248.243.5
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNa7lqDY.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkids18Q.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7qsDJT9g.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdh18Smxg.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7ksDJT9g.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlBduz8A.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwmRduz8A.woff2)
unknown
https://conbassprox-lgoinz.godaddysites.com/
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdv18Smxg.woff2)
unknown
https://img1.wsimg.com/gfonts/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wdhyzbi.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkidi18Smxg.woff2)
unknown
https://img1.wsimg.com/gfonts/s/playfairdisplay/v37/nuFiD-vYSZviVYUb_rj3ij__anPXDTjYgFE_.woff2)
unknown
https://img1.wsimg.com/gfonts/s/playfairdisplay/v37/nuFiD-vYSZviVYUb_rj3ij__anPXDTzYgA.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkidg18Smxg.woff2)
unknown
https://img1.wsimg.com/gfonts/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459WZhyzbi.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlBduz8A.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNq7lqDY.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qN67lqDY.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qO67lqDY.woff2)
unknown
https://conbassprox-lgoinz.godaddysites.com/manifest.webmanifest
13.248.243.5
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwmhduz8A.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwmBduz8A.woff2)
unknown
https://github.com/JulietaUla/Montserrat)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwmhduz8A.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkido18Smxg.woff2)
unknown
https://img1.wsimg.com/gfonts/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2)
unknown
https://img1.wsimg.com/isteam/ip/517127d9-1f12-4ae8-8878-c12e207212fd/con-base-pro.jpg
unknown
http://jedwatson.github.io/classnames
unknown
https://github.com/clauseggers/Playfair-Display)
unknown
https://img1.wsimg.com/gfonts/s/playfairdisplay/v37/nuFiD-vYSZviVYUb_rj3ij__anPXDTPYgFE_.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7psDJT9g.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7rsDJT9g.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdg18Smxg.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdi18Smxg.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwmBduz8A.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7jsDJT9g.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwmxduz8A.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdo18Smxg.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwkxduz8A.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkidv18Smxg.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNK7lqDY.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkidj18Smxg.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qPK7lqDY.woff2)
unknown
https://img1.wsimg.com/gfonts/s/playfairdisplay/v37/nuFiD-vYSZviVYUb_rj3ij__anPXDTLYgFE_.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkidh18Smxg.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSds18Q.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7nsDI.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwmRduz8A.woff2)
unknown
https://img1.wsimg.com/poly/v3/polyfill.min.js?rum=0&unknown=polyfill&flags=gated&features=Intl.~loc
unknown
https://img1.wsimg.com/gfonts/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459WRhyzbi.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwmxduz8A.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwkxduz8A.woff2)
unknown
http://scripts.sil.org/OFL
unknown
https://img1.wsimg.com/gfonts/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459W1hyzbi.woff2)
unknown
https://img1.wsimg.com/gfonts/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSdj18Smxg.woff2)
unknown
There are 50 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
bg.microsoft.map.fastly.net
199.232.214.172
www.google.com
142.250.74.196
conbassprox-lgoinz.godaddysites.com
13.248.243.5
isteam.wsimg.com
3.121.64.201
fp2e7a.wpc.phicdn.net
192.229.221.95
img1.wsimg.com
unknown
csp.secureserver.net
unknown
events.api.secureserver.net
unknown

IPs

IP
Domain
Country
Malicious
3.121.64.201
isteam.wsimg.com
United States
13.248.243.5
conbassprox-lgoinz.godaddysites.com
United States
192.168.2.6
unknown
unknown
192.168.2.5
unknown
unknown
239.255.255.250
unknown
Reserved
142.250.74.196
www.google.com
United States

DOM / HTML

URL
Malicious
https://conbassprox-lgoinz.godaddysites.com/
 malicious