IOC Report
https://gemmini-tllogiiess-wrx.godaddysites.com/

loading gif

Files

File Path
Type
Category
Malicious
Chrome Cache Entry: 142
ASCII text, with very long lines (51853)
downloaded
Chrome Cache Entry: 143
ASCII text, with very long lines (1352)
downloaded
Chrome Cache Entry: 144
ASCII text, with very long lines (51853)
dropped
Chrome Cache Entry: 145
ASCII text, with very long lines (905)
dropped
Chrome Cache Entry: 146
ASCII text, with very long lines (1352)
dropped
Chrome Cache Entry: 147
Web Open Font Format (Version 2), TrueType, length 11644, version 1.0
downloaded
Chrome Cache Entry: 148
ASCII text, with very long lines (65536), with no line terminators
dropped
Chrome Cache Entry: 149
Unicode text, UTF-8 text, with very long lines (63425)
dropped
Chrome Cache Entry: 150
HTML document, ASCII text
downloaded
Chrome Cache Entry: 151
Web Open Font Format (Version 2), TrueType, length 23040, version 1.0
downloaded
Chrome Cache Entry: 152
ASCII text, with very long lines (23126)
downloaded
Chrome Cache Entry: 153
ASCII text, with very long lines (21556)
downloaded
Chrome Cache Entry: 154
ASCII text
dropped
Chrome Cache Entry: 155
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 192x192, components 3
dropped
Chrome Cache Entry: 156
ASCII text, with very long lines (1211)
dropped
Chrome Cache Entry: 157
GIF image data, version 89a, 1 x 1
downloaded
Chrome Cache Entry: 158
JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=5, orientation=upper-left, xresolution=74, yresolution=82, resolutionunit=2], baseline, precision 8, 1535x688, components 3
dropped
Chrome Cache Entry: 159
Web Open Font Format (Version 2), TrueType, length 11728, version 1.0
downloaded
Chrome Cache Entry: 160
Unicode text, UTF-8 text, with very long lines (20947)
downloaded
Chrome Cache Entry: 161
ASCII text
downloaded
Chrome Cache Entry: 162
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 163
ASCII text, with very long lines (905)
downloaded
Chrome Cache Entry: 164
ASCII text, with very long lines (383)
dropped
Chrome Cache Entry: 165
ASCII text, with very long lines (13834)
dropped
Chrome Cache Entry: 166
ASCII text
downloaded
Chrome Cache Entry: 167
GIF image data, version 89a, 1 x 1
dropped
Chrome Cache Entry: 168
HTML document, Unicode text, UTF-8 text, with very long lines (8163)
downloaded
Chrome Cache Entry: 169
ASCII text, with very long lines (383)
downloaded
Chrome Cache Entry: 170
RIFF (little-endian) data, Web/P image
downloaded
Chrome Cache Entry: 171
GIF image data, version 89a, 1 x 1
downloaded
Chrome Cache Entry: 172
ASCII text
dropped
Chrome Cache Entry: 173
ASCII text, with very long lines (516)
downloaded
Chrome Cache Entry: 174
ASCII text
downloaded
Chrome Cache Entry: 175
ASCII text, with very long lines (8076)
dropped
Chrome Cache Entry: 176
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 177
Unicode text, UTF-8 text, with very long lines (63425)
downloaded
Chrome Cache Entry: 178
ASCII text, with very long lines (330)
downloaded
Chrome Cache Entry: 179
ASCII text
dropped
Chrome Cache Entry: 180
GIF image data, version 89a, 1 x 1
downloaded
Chrome Cache Entry: 181
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 32x32, components 3
dropped
Chrome Cache Entry: 182
ASCII text, with very long lines (3043)
dropped
Chrome Cache Entry: 183
ASCII text, with very long lines (21556)
dropped
Chrome Cache Entry: 184
ASCII text, with very long lines (330)
dropped
Chrome Cache Entry: 185
ASCII text, with very long lines (516)
dropped
Chrome Cache Entry: 186
ASCII text, with very long lines (3043)
downloaded
Chrome Cache Entry: 187
ASCII text
dropped
Chrome Cache Entry: 188
JSON data
downloaded
Chrome Cache Entry: 189
GIF image data, version 89a, 1 x 1
dropped
Chrome Cache Entry: 190
ASCII text, with very long lines (1211)
downloaded
Chrome Cache Entry: 191
ASCII text, with very long lines (829)
dropped
Chrome Cache Entry: 192
ASCII text, with very long lines (23126)
dropped
Chrome Cache Entry: 193
Unicode text, UTF-8 text, with very long lines (20947)
dropped
Chrome Cache Entry: 194
Web Open Font Format (Version 2), TrueType, length 23580, version 1.0
downloaded
Chrome Cache Entry: 195
ASCII text, with very long lines (522)
downloaded
Chrome Cache Entry: 196
RIFF (little-endian) data, Web/P image
downloaded
Chrome Cache Entry: 197
ASCII text, with very long lines (13834)
downloaded
Chrome Cache Entry: 198
ASCII text, with very long lines (1824)
dropped
Chrome Cache Entry: 199
ASCII text, with very long lines (829)
downloaded
Chrome Cache Entry: 200
ASCII text, with very long lines (65536), with no line terminators
dropped
Chrome Cache Entry: 201
ASCII text, with very long lines (522)
dropped
Chrome Cache Entry: 202
ASCII text
downloaded
Chrome Cache Entry: 203
ASCII text, with very long lines (8076)
downloaded
Chrome Cache Entry: 204
ASCII text, with very long lines (32986), with no line terminators
downloaded
Chrome Cache Entry: 205
ASCII text, with very long lines (1824)
downloaded
Chrome Cache Entry: 206
RIFF (little-endian) data, Web/P image
downloaded
There are 56 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1712 --field-trial-handle=2020,i,14739926256914341888,4208355801869281692,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://gemmini-tllogiiess-wrx.godaddysites.com/"

URLs

Name
IP
Malicious
https://gemmini-tllogiiess-wrx.godaddysites.com/
malicious
https://gemmini-tllogiiess-wrx.godaddysites.com/manifest.webmanifest
13.248.243.5
malicious
https://gemmini-tllogiiess-wrx.godaddysites.com/
malicious
https://gemmini-tllogiiess-wrx.godaddysites.com/sw.js
13.248.243.5
malicious
https://img1.wsimg.com/gfonts/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2)
unknown
https://img1.wsimg.com/gfonts/s/lusitana/v13/CSR74z9ShvucWzsMKyDmafctaNY.woff2)
unknown
https://img1.wsimg.com/gfonts/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2)
unknown
https://img1.wsimg.com/poly/v3/polyfill.min.js?rum=0&unknown=polyfill&flags=gated&features=Intl.~loc
unknown
https://img1.wsimg.com/gfonts/s/lato/v24/S6u9w4BMUTPHh6UVSwaPGR_p.woff2)
unknown
https://www.godaddy.com/websites/website-builder?isc=pwugc&utm_source=wsb&utm_medium=applications&utm_campaign=en-us_corp_applications_base
https://img1.wsimg.com/gfonts/s/lusitana/v13/CSR84z9ShvucWzsMKyhdTOI.woff2)
unknown
https://www.godaddy.com/websites/website-builder?isc=pwugc&utm_source=wsb&utm_medium=applica
unknown
http://scripts.sil.org/OFL
unknown
https://img1.wsimg.com/gfonts/s/lato/v24/S6uyw4BMUTPHjxAwXjeu.woff2)
unknown
https://img1.wsimg.com/isteam/ip/298a5d7a-6f41-46c8-88c7-196fd538185b/gemini-login-signin.jpg
unknown
http://jedwatson.github.io/classnames
unknown
There are 5 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
www.google.com
142.250.184.196
gemmini-tllogiiess-wrx.godaddysites.com
13.248.243.5
isteam.wsimg.com
3.64.248.63
fp2e7a.wpc.phicdn.net
192.229.221.95
img1.wsimg.com
unknown
csp.secureserver.net
unknown
events.api.secureserver.net
unknown
www.godaddy.com
unknown

IPs

IP
Domain
Country
Malicious
142.250.184.196
www.google.com
United States
13.248.243.5
gemmini-tllogiiess-wrx.godaddysites.com
United States
192.168.2.4
unknown
unknown
192.168.2.5
unknown
unknown
239.255.255.250
unknown
Reserved
3.64.248.63
isteam.wsimg.com
United States

DOM / HTML

URL
Malicious
https://gemmini-tllogiiess-wrx.godaddysites.com/
https://www.godaddy.com/websites/website-builder?isc=pwugc&utm_source=wsb&utm_medium=applications&utm_campaign=en-us_corp_applications_base