IOC Report
https://logi_us_gemini.godaddysites.com/

loading gif

Files

File Path
Type
Category
Malicious
Chrome Cache Entry: 100
ASCII text, with very long lines (13834)
dropped
Chrome Cache Entry: 101
ASCII text
downloaded
Chrome Cache Entry: 102
ASCII text, with very long lines (483)
downloaded
Chrome Cache Entry: 103
ASCII text, with very long lines (483)
dropped
Chrome Cache Entry: 104
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 105
ASCII text, with very long lines (383)
downloaded
Chrome Cache Entry: 106
JSON data
downloaded
Chrome Cache Entry: 107
ASCII text
dropped
Chrome Cache Entry: 108
ASCII text, with very long lines (516)
downloaded
Chrome Cache Entry: 109
ASCII text
downloaded
Chrome Cache Entry: 110
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 111
ASCII text, with very long lines (17294)
downloaded
Chrome Cache Entry: 112
ASCII text, with very long lines (330)
downloaded
Chrome Cache Entry: 113
ASCII text
dropped
Chrome Cache Entry: 114
ASCII text, with very long lines (3043)
dropped
Chrome Cache Entry: 115
ASCII text, with very long lines (21556)
dropped
Chrome Cache Entry: 116
ASCII text, with very long lines (330)
dropped
Chrome Cache Entry: 117
ASCII text, with very long lines (516)
dropped
Chrome Cache Entry: 118
ASCII text, with very long lines (51853)
dropped
Chrome Cache Entry: 119
Web Open Font Format (Version 2), TrueType, length 25548, version 1.0
downloaded
Chrome Cache Entry: 120
ASCII text, with very long lines (51853)
downloaded
Chrome Cache Entry: 121
ASCII text, with very long lines (3043)
downloaded
Chrome Cache Entry: 122
GIF image data, version 89a, 1 x 1
dropped
Chrome Cache Entry: 123
GIF image data, version 89a, 1 x 1
downloaded
Chrome Cache Entry: 124
ASCII text
dropped
Chrome Cache Entry: 125
RIFF (little-endian) data, Web/P image
downloaded
Chrome Cache Entry: 126
ASCII text, with very long lines (1211)
downloaded
Chrome Cache Entry: 127
ASCII text, with very long lines (829)
dropped
Chrome Cache Entry: 128
ASCII text, with very long lines (23126)
dropped
Chrome Cache Entry: 129
Unicode text, UTF-8 text, with very long lines (63425)
dropped
Chrome Cache Entry: 130
Unicode text, UTF-8 text, with very long lines (20947)
dropped
Chrome Cache Entry: 131
ASCII text, with very long lines (522)
downloaded
Chrome Cache Entry: 132
ASCII text, with very long lines (13834)
downloaded
Chrome Cache Entry: 133
Web Open Font Format (Version 2), TrueType, length 23992, version 1.0
downloaded
Chrome Cache Entry: 134
GIF image data, version 89a, 1 x 1
dropped
Chrome Cache Entry: 135
ASCII text, with very long lines (1824)
dropped
Chrome Cache Entry: 136
ASCII text, with very long lines (829)
downloaded
Chrome Cache Entry: 137
RIFF (little-endian) data, Web/P image
downloaded
Chrome Cache Entry: 138
ASCII text, with very long lines (65536), with no line terminators
dropped
Chrome Cache Entry: 139
ASCII text, with very long lines (522)
dropped
Chrome Cache Entry: 140
GIF image data, version 89a, 1 x 1
downloaded
Chrome Cache Entry: 141
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 1440x720, components 3
dropped
Chrome Cache Entry: 142
ASCII text, with very long lines (1824)
downloaded
Chrome Cache Entry: 143
HTML document, Unicode text, UTF-8 text, with very long lines (6691)
downloaded
Chrome Cache Entry: 144
GIF image data, version 89a, 1 x 1
downloaded
Chrome Cache Entry: 81
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 82
ASCII text, with very long lines (1352)
downloaded
Chrome Cache Entry: 83
ASCII text, with very long lines (905)
dropped
Chrome Cache Entry: 84
Web Open Font Format (Version 2), TrueType, length 23676, version 1.0
downloaded
Chrome Cache Entry: 85
ASCII text, with very long lines (32954), with no line terminators
downloaded
Chrome Cache Entry: 86
ASCII text, with very long lines (1352)
dropped
Chrome Cache Entry: 87
ASCII text, with very long lines (65536), with no line terminators
dropped
Chrome Cache Entry: 88
ASCII text, with very long lines (23126)
downloaded
Chrome Cache Entry: 89
ASCII text, with very long lines (21556)
downloaded
Chrome Cache Entry: 90
Web Open Font Format (Version 2), TrueType, length 24364, version 1.0
downloaded
Chrome Cache Entry: 91
ASCII text, with very long lines (17294)
dropped
Chrome Cache Entry: 92
Unicode text, UTF-8 text, with very long lines (63425)
downloaded
Chrome Cache Entry: 93
RIFF (little-endian) data, Web/P image
downloaded
Chrome Cache Entry: 94
ASCII text, with very long lines (1211)
dropped
Chrome Cache Entry: 95
Unicode text, UTF-8 text, with very long lines (20947)
downloaded
Chrome Cache Entry: 96
ASCII text
downloaded
Chrome Cache Entry: 97
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 98
ASCII text, with very long lines (905)
downloaded
Chrome Cache Entry: 99
ASCII text, with very long lines (383)
dropped
There are 55 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=1952,i,277707491414956433,7613160729464678560,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://logi_us_gemini.godaddysites.com/"

URLs

Name
IP
Malicious
https://logi_us_gemini.godaddysites.com/
malicious
https://logi_us_gemini.godaddysites.com/sw.js
13.248.243.5
malicious
https://logi_us_gemini.godaddysites.com/manifest.webmanifest
13.248.243.5
malicious
https://logi_us_gemini.godaddysites.com/
malicious
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVepFq4dHc.woff2)
unknown
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVepVq4dHc.woff2)
unknown
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQrbh3o1vLImiwAVvYawgcf2eVWEX-tRlZfX80.woff2)
unknown
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQrbh3o1vLImiwAVvYawgcf2eVWEX-tT1ZfX80.woff2)
unknown
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q0bHNiZg.woff2)
unknown
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVeqlq4.woff2)
unknown
https://img1.wsimg.com/poly/v3/polyfill.min.js?rum=0&unknown=polyfill&flags=gated&features=Intl.~loc
unknown
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q1bHNiZg.woff2)
unknown
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q6bHM.woff2)
unknown
https://img1.wsimg.com/gfonts/s/karla/v31/qkB9XvYC6trAT55ZBi1ueQVIjQTD-JrIH2G7nytkHRyQ8p4wUje6bg.wof
unknown
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQrbh3o1vLImiwAVvYawgcf2eVWEX-tRVZfX80.woff2)
unknown
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q3bHNiZg.woff2)
unknown
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVerlq4dHc.woff2)
unknown
http://scripts.sil.org/OFL
unknown
https://img1.wsimg.com/gfonts/s/karla/v31/qkB9XvYC6trAT55ZBi1ueQVIjQTD-JrIH2G7nytkHRyQ8p4wUjm6bnEr.w
unknown
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQrbh3o1vLImiwAVvYawgcf2eVWEX-tS1Zf.woff2)
unknown
https://img1.wsimg.com/isteam/ip/56a8951b-3b02-47d8-b3d9-819ad1d760dd/gemini.jpg
unknown
http://jedwatson.github.io/classnames
unknown
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQrbh3o1vLImiwAVvYawgcf2eVWEX-tRFZfX80.woff2)
unknown
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQsbh3o1vLImiwAVvYawgcf2eVer2q-bHNiZg.woff2)
unknown
https://img1.wsimg.com/gfonts/s/oldstandardtt/v20/MwQubh3o1vLImiwAVvYawgcf2eVep1q4dHc.woff2)
unknown
There are 14 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
bg.microsoft.map.fastly.net
199.232.214.172
logi_us_gemini.godaddysites.com
13.248.243.5
www.google.com
172.217.23.100
isteam.wsimg.com
3.121.64.201
fp2e7a.wpc.phicdn.net
192.229.221.95
img1.wsimg.com
unknown
csp.secureserver.net
unknown
events.api.secureserver.net
unknown

IPs

IP
Domain
Country
Malicious
3.121.64.201
isteam.wsimg.com
United States
13.248.243.5
logi_us_gemini.godaddysites.com
United States
192.168.2.4
unknown
unknown
192.168.2.6
unknown
unknown
239.255.255.250
unknown
Reserved
172.217.23.100
www.google.com
United States

DOM / HTML

URL
Malicious
https://logi_us_gemini.godaddysites.com/
malicious