Windows Analysis Report
https://logg_koonbase.godaddysites.com/

Overview

General Information

Sample URL:	https://logg_koonbase.godaddysites.com/
Analysis ID:	1522069
Tags:	openphish
Infos:

Detection

HTMLPhisher

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish64

Performs DNS queries to domains with low reputation

HTML body contains low number of good links

HTML title does not match URL

Classification

Signatures

Phishing

Yara detected HtmlPhish64

Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML

HTML body contains low number of good links

Source: https://logg_koonbase.godaddysites.com/

HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://logg_koonbase.godaddysites.com/

HTTP Parser: Title: oinbase Pro Login - Digital Asset Exchange. does not match URL

Source: https://logg_koonbase.godaddysites.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://logg_koonbase.godaddysites.com/	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49802 version: TLS 1.2

Networking

Performs DNS queries to domains with low reputation

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: sytfbklsdabx.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: sytfbklsdabx.xyz
Source:	DNS query: sytfbklsdabx.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: sytfbklsdabx.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: sytfbklsdabx.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: sytfbklsdabx.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: sytfbklsdabx.xyz
Source:	DNS query: sytfbklsdabx.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: sytfbklsdabx.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: sytfbklsdabx.xyz
Source:	DNS query: sytfbklsdabx.xyz
Source:	DNS query: sytfbklsdabx.xyz

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: logg_koonbase.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /markup/ad HTTP/1.1Host: logg_koonbase.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://logg_koonbase.godaddysites.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1
Source: global traffic	HTTP traffic detected: GET /sw.js HTTP/1.1Host: logg_koonbase.godaddysites.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://logg_koonbase.godaddysites.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1
Source: global traffic	HTTP traffic detected: GET /manifest.webmanifest HTTP/1.1Host: logg_koonbase.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://logg_koonbase.godaddysites.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: logg_koonbase.godaddysites.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://logg_koonbase.godaddysites.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1
Source: global traffic	HTTP traffic detected: GET /markup/ad HTTP/1.1Host: logg_koonbase.godaddysites.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1
Source: global traffic	HTTP traffic detected: GET /i.gif?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjozNjk2NjY5OTcsImNoIjo1NDQ0NSwiY2siOnt9LCJjciI6NDA4ODkzMDIyLCJkaSI6IjBkMTcyMzQ5ZmRkMTQzYjViODBmZGM0OWVhMjI1ZDYyIiwiZGoiOjAsImlpIjoiNWUxNmY5NjE3ZjY4NDRmODllZGQxN2VmMTY3Yzk2MjEiLCJkbSI6MywiZmMiOjU4Mzk1MjEyMywiZmwiOjU3MTk5NDU0MywiaXAiOiI2NC4yMDIuMTYwLjAiLCJrdyI6Int7a2V5d29yZH19IiwibnciOjEwNjYzLCJwYyI6MCwib3AiOjAsIm1wIjowLCJlYyI6MCwiZ20iOjAsImVwIjpudWxsLCJwciI6MjE4NDY1LCJydCI6MSwicnMiOjUwMCwic2EiOiI1MiIsInNiIjoiaS0wZjJkNDAyYmMxYmMwNjJjMyIsInNwIjoyMjUxOTk5LCJzdCI6MTI3NjI2NCwidWsiOiJ1ZTEtMzdlMmMzYTE2YjdmNGVkMTgzYTQ0ZTlmZmU5YmE1ZmEiLCJ6biI6MzA3NDk1LCJ0cyI6MTcyNzU5MDEzMDQ0MiwicG4iOiJ3YW0iLCJnYyI6dHJ1ZSwiZ0MiOnRydWUsImdzIjoibm9uZSIsImRjIjoxLCJ0eiI6IlVUQyIsImJhIjoxLCJmcSI6MH0&s=TsH1hKr6YSUj6GVyz_A0XSt2THE&publisher_website_key=wam.md5.a16fc9606dd4c9d27a764a3bb277b01f HTTP/1.1Host: ms.godaddy.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://logg_koonbase.godaddysites.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i.gif?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjozNjk2NjY5OTcsImNoIjo1NDQ0NSwiY2siOnt9LCJjciI6NDA4ODkzMDIyLCJkaSI6IjBkMTcyMzQ5ZmRkMTQzYjViODBmZGM0OWVhMjI1ZDYyIiwiZGoiOjAsImlpIjoiNWUxNmY5NjE3ZjY4NDRmODllZGQxN2VmMTY3Yzk2MjEiLCJkbSI6MywiZmMiOjU4Mzk1MjEyMywiZmwiOjU3MTk5NDU0MywiaXAiOiI2NC4yMDIuMTYwLjAiLCJrdyI6Int7a2V5d29yZH19IiwibnciOjEwNjYzLCJwYyI6MCwib3AiOjAsIm1wIjowLCJlYyI6MCwiZ20iOjAsImVwIjpudWxsLCJwciI6MjE4NDY1LCJydCI6MSwicnMiOjUwMCwic2EiOiI1MiIsInNiIjoiaS0wZjJkNDAyYmMxYmMwNjJjMyIsInNwIjoyMjUxOTk5LCJzdCI6MTI3NjI2NCwidWsiOiJ1ZTEtMzdlMmMzYTE2YjdmNGVkMTgzYTQ0ZTlmZmU5YmE1ZmEiLCJ6biI6MzA3NDk1LCJ0cyI6MTcyNzU5MDEzMDQ0MiwicG4iOiJ3YW0iLCJnYyI6dHJ1ZSwiZ0MiOnRydWUsImdzIjoibm9uZSIsImRjIjoxLCJ0eiI6IlVUQyIsImJhIjoxLCJmcSI6MH0&s=TsH1hKr6YSUj6GVyz_A0XSt2THE&publisher_website_key=wam.md5.a16fc9606dd4c9d27a764a3bb277b01f HTTP/1.1Host: ms.godaddy.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: azk=ue1-37e2c3a16b7f4ed183a44e9ffe9ba5fa; azk-ss=true

Source: global traffic	DNS traffic detected: DNS query: logg_koonbase.godaddysites.com
Source: global traffic	DNS traffic detected: DNS query: img1.wsimg.com
Source: global traffic	DNS traffic detected: DNS query: isteam.wsimg.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ms.godaddy.com
Source: global traffic	DNS traffic detected: DNS query: sytfbklsdabx.xyz
Source: global traffic	DNS traffic detected: DNS query: google.com

Source: chromecache_84.2.dr, chromecache_123.2.dr, chromecache_124.2.dr, chromecache_88.2.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_102.2.dr	String found in binary or memory: http://scripts.sil.org/OFL
Source: chromecache_102.2.dr	String found in binary or memory: https://github.com/FAlthausen/Vollkorn-Typeface)
Source: chromecache_96.2.dr	String found in binary or memory: https://img1.wsimg.com/blobby/go/font/LeagueSpartan/LeagueSpartan.woff)
Source: chromecache_96.2.dr	String found in binary or memory: https://img1.wsimg.com/blobby/go/font/LeagueSpartan/LeagueSpartan.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/poppins/v21/pxiByp8kv8JHgFVrLCz7Z1JlFc-K.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/poppins/v21/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/poppins/v21/pxiByp8kv8JHgFVrLDz8Z1JlFc-K.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/poppins/v21/pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/poppins/v21/pxiByp8kv8JHgFVrLEj6Z1JlFc-K.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/poppins/v21/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/poppins/v21/pxiEyp8kv8JHgFVrJJfecg.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/poppins/v21/pxiEyp8kv8JHgFVrJJnecmNE.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/vollkorn/v23/0yb9GDoxxrvAnPhYGxkkaE0GrQ.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/vollkorn/v23/0yb9GDoxxrvAnPhYGxkmaE0GrQ.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/vollkorn/v23/0yb9GDoxxrvAnPhYGxknaE0GrQ.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/vollkorn/v23/0yb9GDoxxrvAnPhYGxkpaE0.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/vollkorn/v23/0yb9GDoxxrvAnPhYGxkqaE0GrQ.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/vollkorn/v23/0yb9GDoxxrvAnPhYGxktaE0GrQ.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/poly/v3/polyfill.min.js?rum=0&unknown=polyfill&flags=gated&features=Intl.~loc
Source: chromecache_102.2.dr	String found in binary or memory: https://logg_koonbase.godaddysites.com/
Source: chromecache_73.2.dr, chromecache_133.2.dr	String found in binary or memory: https://ms.godaddy.com/i.gif?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjoz
Source: chromecache_73.2.dr, chromecache_133.2.dr	String found in binary or memory: https://ms.godaddy.com/r?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjozNjk2
Source: chromecache_102.2.dr	String found in binary or memory: https://www.fontsquirrel.com/license/league-spartan

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49802 version: TLS 1.2

Source: classification engine

Classification label: mal52.phis.troj.win@21/102@32/7

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=2364,i,18366499957688085511,10167160284856967565,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://logg_koonbase.godaddysites.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=2364,i,18366499957688085511,10167160284856967565,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.184.196	www.google.com	United States	15169	GOOGLEUS	false
13.248.243.5	logg_koonbase.godaddysites.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
3.64.248.63	isteam.wsimg.com	United States	16509	AMAZON-02US	false
34.250.180.246	e-prod-alb-s102-eu-west-1-02.adzerk.net	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.6
192.168.2.5

Contacted Domains

Name	IP	Active
google.com	142.250.184.238	true
logg_koonbase.godaddysites.com	13.248.243.5	true
e-prod-alb-s102-eu-west-1-02.adzerk.net	34.250.180.246	true
www.google.com	142.250.184.196	true
isteam.wsimg.com	3.64.248.63	true
fp2e7a.wpc.phicdn.net	192.229.221.95	true
img1.wsimg.com	unknown	unknown
sytfbklsdabx.xyz	unknown	unknown
ms.godaddy.com	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
https://logg_koonbase.godaddysites.com/	false	unknown
https://logg_koonbase.godaddysites.com/sw.js	false	unknown
https://logg_koonbase.godaddysites.com/manifest.webmanifest	false	unknown
https://ms.godaddy.com/i.gif?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjozNjk2NjY5OTcsImNoIjo1NDQ0NSwiY2siOnt9LCJjciI6NDA4ODkzMDIyLCJkaSI6IjBkMTcyMzQ5ZmRkMTQzYjViODBmZGM0OWVhMjI1ZDYyIiwiZGoiOjAsImlpIjoiNWUxNmY5NjE3ZjY4NDRmODllZGQxN2VmMTY3Yzk2MjEiLCJkbSI6MywiZmMiOjU4Mzk1MjEyMywiZmwiOjU3MTk5NDU0MywiaXAiOiI2NC4yMDIuMTYwLjAiLCJrdyI6Int7a2V5d29yZH19IiwibnciOjEwNjYzLCJwYyI6MCwib3AiOjAsIm1wIjowLCJlYyI6MCwiZ20iOjAsImVwIjpudWxsLCJwciI6MjE4NDY1LCJydCI6MSwicnMiOjUwMCwic2EiOiI1MiIsInNiIjoiaS0wZjJkNDAyYmMxYmMwNjJjMyIsInNwIjoyMjUxOTk5LCJzdCI6MTI3NjI2NCwidWsiOiJ1ZTEtMzdlMmMzYTE2YjdmNGVkMTgzYTQ0ZTlmZmU5YmE1ZmEiLCJ6biI6MzA3NDk1LCJ0cyI6MTcyNzU5MDEzMDQ0MiwicG4iOiJ3YW0iLCJnYyI6dHJ1ZSwiZ0MiOnRydWUsImdzIjoibm9uZSIsImRjIjoxLCJ0eiI6IlVUQyIsImJhIjoxLCJmcSI6MH0&s=TsH1hKr6YSUj6GVyz_A0XSt2THE&publisher_website_key=wam.md5.a16fc9606dd4c9d27a764a3bb277b01f	false	unknown
https://logg_koonbase.godaddysites.com/markup/ad	false	unknown

Name	Type	MD5	SHA1	SHA256
Chrome Cache Entry: 100	ASCII text, with very long lines (516)	0D42FFB998A9CF7C25824CF365C7D0C9	7A95B87AC3B0C813F195EA46EFB9E792023EAFBE	3418AA0FB5D19C3909DD89CCF081C9B59EBAD2A0334EED58373ED395D228487A
Chrome Cache Entry: 101	ASCII text, with very long lines (51853)	A28B064344B1B0FB28B49BC96F1CD084	9F3ABFD14A24B426EC073A3F99DA77E14C3C2524	9AE1C6CF7FA6A9E859EC1802C1F3D655E71657E30825B97344B4675729487215
Chrome Cache Entry: 102	HTML document, Unicode text, UTF-8 text, with very long lines (10137)	E870AB0B2CC1F84F241901DF5BFEC84F	612BA922DE64B1B6FCCA299D026FC4ADE25DFA8C	CF6D811DE9485BE4221674EB91C152C43417D91F778FCCA4AC6CD46C2774EB35
Chrome Cache Entry: 103	ASCII text	8578A331AD09BB2EF6359FEC3916BEFC	38B68F5C02CBDB6E29C50F8858710E0392B0B8D6	3D7E7552E3801941A408C504AA732223FE2BED5D12E248680847D772182CB639
Chrome Cache Entry: 104	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	B8D34C44F725FD43B1F066C37C0441C7	336E324A86AA890857DB2AD947F8F8D447BE6DD5	DEF02E22B656322F8C0AFB977E4FB00DCBE4CD2F0493C3DB981188A01DADBFA4
Chrome Cache Entry: 105	ASCII text, with very long lines (12251)	DFB4BEE7C6378574342CDFCE62FDD1D7	75679AE1470880C7209353283879CB58C010621B	BFF3C0C2907BCFFD63DEDC687B8FCA61197E8B783C644B3D665AC3620C383E3C
Chrome Cache Entry: 106	ASCII text, with very long lines (65536), with no line terminators	55BAF821A59FAD53AA754C85AE19D0EA	B1662F5F5B119836E5E9C91C5E4A448BCD6CCC6D	D26724E378F16CC4135849CCABF5A1BA738C3F4BA952950ACB34E73F24869E83
Chrome Cache Entry: 107	Web Open Font Format (Version 2), TrueType, length 12608, version 1.0	DFF31121551877252E72ABEEA3763956	E737B81F5E42B29C5E35764B97A787051F7639F2	EA1C6A5CBFD48A40A9BE1FC339BA713290831C2A65585966D8EC6FE7AB8269D9
Chrome Cache Entry: 108	ASCII text, with very long lines (330)	C86B7F8224FA45FB1682AC94D8F75AC6	9561F67AAE74B14702DB79C22F9C7F9E6F3B3239	010083B88E95F18CEFDB90796ACCE02073E91FC8DFEFB27A7F5F3F75529E4906
Chrome Cache Entry: 109	ASCII text	8578A331AD09BB2EF6359FEC3916BEFC	38B68F5C02CBDB6E29C50F8858710E0392B0B8D6	3D7E7552E3801941A408C504AA732223FE2BED5D12E248680847D772182CB639
Chrome Cache Entry: 110	ASCII text, with very long lines (3043)	852CBC5322260E00B44F2C682F88B2C7	BCAF229E6134F43EB5F974C9891E4D16FAF1D344	BAE437DBEFE58377D88C9D579DB7C59F4202F3FBF88866D0005FB375BE6B2CD7
Chrome Cache Entry: 111	ASCII text, with very long lines (330)	C86B7F8224FA45FB1682AC94D8F75AC6	9561F67AAE74B14702DB79C22F9C7F9E6F3B3239	010083B88E95F18CEFDB90796ACCE02073E91FC8DFEFB27A7F5F3F75529E4906
Chrome Cache Entry: 112	ASCII text, with very long lines (516)	0D42FFB998A9CF7C25824CF365C7D0C9	7A95B87AC3B0C813F195EA46EFB9E792023EAFBE	3418AA0FB5D19C3909DD89CCF081C9B59EBAD2A0334EED58373ED395D228487A
Chrome Cache Entry: 113	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Google], baseline, precision 8, 1240x1035, components 3	6A44236F4D02B735A283200411B30119	103D95AA920AF79C96F92DB226842621ACFE35C0	44A9DB5D50375DE3F969D0EFAD5D83DFC6066BA92ED494411D05865025D39873
Chrome Cache Entry: 114	ASCII text, with very long lines (786)	31B521136207C11FF1F9985264424E8A	9EAF6B9717979CAEB5C7E846E17B2A89A08DC266	C818B56446AE5A8D0466FC9C51D85104584E36F6D8B1C77E08A2D354E845E2CD
Chrome Cache Entry: 115	ASCII text, with very long lines (32950), with no line terminators	B75654D4E507CEAC5F25A25F2D9B48BC	03629468EECCD5F5A64AEC90B8C6B7657382DD15	2FC22BC69B0F9D55F6349832385AA85F122D11B33CA6DF3ADE177CCE96270638
Chrome Cache Entry: 116	ASCII text, with very long lines (3043)	852CBC5322260E00B44F2C682F88B2C7	BCAF229E6134F43EB5F974C9891E4D16FAF1D344	BAE437DBEFE58377D88C9D579DB7C59F4202F3FBF88866D0005FB375BE6B2CD7
Chrome Cache Entry: 117	RIFF (little-endian) data, Web/P image	BE0DE83CF32C28A816FC044A2148AE30	4CCB31900EFCA06901F92D77EAC9F42F009E75C7	C5403EA13BAD9D57E437F07E5F5B45686BD74593F7EF897BE1EE493C034D901B
Chrome Cache Entry: 118	ASCII text	8F12765EB30FBDCFCDC116D13F7FC272	506E45B7D3930756EACCE0DAD449A3C8CDB3EAC6	265995EB76326E95613750F6F6570B850F5C22280D262DE9B9632A16CEB98B9B
Chrome Cache Entry: 119	JSON data	521221CFE2954EF5C75B8C6B647D4D3F	FC2698D0EF669B7BBACA70693675F0F68681EFA2	06DDE98621FD0FDA008EFD65469E5B7B00B9F34E1B6523B56E1848A95AD0EA66
Chrome Cache Entry: 120	ASCII text, with very long lines (1211)	CB9BFA0FBDD957FBE7F4841B70341DB2	9CAD12A3580D3E4D340CB867E88B687C75564C5A	513864FD4EBD1926F3E1E78B436A90C2BC3A5D16835B50415E7B318D7DEEC2A2
Chrome Cache Entry: 121	ASCII text, with very long lines (829)	9219CF782ED219BD3929A51E99503BC2	6AAC399854EC0405949566FAFDCA8C121F0CDA58	89388608D7BCECED5AD74231681FFCE822AD580ACB9FD7E492970176E3E38347
Chrome Cache Entry: 122	ASCII text, with very long lines (23126)	3D092EF4ABA019B14F01C40747E40554	1C26145272FCF4CA91AF501288CCE84B1BFFD38B	B4C48B77BBE6BBACF7D16BDAA81F5509FB8EA0FBFDDFBF2D12307F7A88518846
Chrome Cache Entry: 123	Unicode text, UTF-8 text, with very long lines (63425)	D8A1FE8B9FD01233B8A030EA79C21DF0	1B2B4474F72FCEE56977101E7C85A8201F730903	91DEC32BF6596B875CDEB8C7BFFC8B5029A870657D3D7C790E8939F17E24DC20
Chrome Cache Entry: 124	Unicode text, UTF-8 text, with very long lines (20947)	753CB19EE1A756E46FAA0F118B1B4E01	248885E3BFE7E71989BA9FFFB33B6EFF18166FEC	ED9FFA2FBA5ECC75AF2F99E6EBADD5B927086F258037C2A848E94449CC579991
Chrome Cache Entry: 125	ASCII text, with very long lines (522)	FADB3719FFA2A9E96CDC64FFEA0220FA	B9B00833E59E99ECE036B518D8429AF5EFEC1163	E8A5463FF98210D3017DEEE55D5A287AD01AAA11DBE7DEB7D07F7D15D7F609F2
Chrome Cache Entry: 126	ASCII text, with very long lines (6969)	DAD318033A09F6ABA68D6EE66F1CDACE	F538D0C3973677A6CDF14E9223AFB432FCF1CF8C	E8FCFB1552D918B5D9FD715F711255465D6DD4348B4DCEDD362CB00DF9D3DBEF
Chrome Cache Entry: 127	ASCII text, with very long lines (12251)	DFB4BEE7C6378574342CDFCE62FDD1D7	75679AE1470880C7209353283879CB58C010621B	BFF3C0C2907BCFFD63DEDC687B8FCA61197E8B783C644B3D665AC3620C383E3C
Chrome Cache Entry: 128	ASCII text, with very long lines (1824)	EDC15AD5DAAC3CFA744BFFDB1E0174BE	E314A5CA702D0E77B2C2C023ADDADE266EA223B2	3B54AEACFDA01BE53800632989A82F6F5A7F92E927159A37A4324B38D3DFFEF8
Chrome Cache Entry: 129	ASCII text, with very long lines (829)	9219CF782ED219BD3929A51E99503BC2	6AAC399854EC0405949566FAFDCA8C121F0CDA58	89388608D7BCECED5AD74231681FFCE822AD580ACB9FD7E492970176E3E38347
Chrome Cache Entry: 130	ASCII text, with very long lines (522)	FADB3719FFA2A9E96CDC64FFEA0220FA	B9B00833E59E99ECE036B518D8429AF5EFEC1163	E8A5463FF98210D3017DEEE55D5A287AD01AAA11DBE7DEB7D07F7D15D7F609F2
Chrome Cache Entry: 131	ASCII text	ACD4F2B6117E5054FC9BF848AE8121CA	AE4D5F41D854BA8D99A4A1EC6EE6D6C3C0A859B8	66774F89FCFA5674BE9AEF60E3FE3CB81E4DD88246BDE4E5392DF8B99FEFD4DB
Chrome Cache Entry: 132	RIFF (little-endian) data, Web/P image	BE0DE83CF32C28A816FC044A2148AE30	4CCB31900EFCA06901F92D77EAC9F42F009E75C7	C5403EA13BAD9D57E437F07E5F5B45686BD74593F7EF897BE1EE493C034D901B
Chrome Cache Entry: 133	HTML document, ASCII text, with very long lines (1781)	0F8BFFA0B6640C867629EE966B6DC0C9	25E66C179811A16B4C50902AB8259CD62FE7C989	E974610AC2D8E2AF67EDB6AED9B38D34ADFF8AC09B7C3283FDEDAAFDC9AFEAD3
Chrome Cache Entry: 134	ASCII text, with very long lines (1824)	EDC15AD5DAAC3CFA744BFFDB1E0174BE	E314A5CA702D0E77B2C2C023ADDADE266EA223B2	3B54AEACFDA01BE53800632989A82F6F5A7F92E927159A37A4324B38D3DFFEF8
Chrome Cache Entry: 135	Web Open Font Format (Version 2), TrueType, length 46448, version 1.0	19349478C87D6BEEC5677C7CB74EC2FB	753FF818664737D238616BF6E6AD3380080ECEC6	BB27B60DB2C5FB11D568AE6CF79A8977DF9796A2CFCD37B46162A49B09B96C01
Chrome Cache Entry: 136	Web Open Font Format (Version 2), TrueType, length 7816, version 1.0	25B0E113CA7CCE3770D542736DB26368	CB726212D5D525021752A1D8470A0FB593E0C49E	9338E65FC077355C7A87AE0D64CC101E23B9BF8AD78AE65F0F319C857311B526
Chrome Cache Entry: 73	HTML document, ASCII text, with very long lines (1781)	9EA2BCFAA3BD4293FF7DE2109D9E7A52	5598B81D92F6BF72E0D7108723850781D2084F34	838C85D299741AF43B9CCFAAAEB8079D19CDAF22CEB631361B791B9F3AF9831E
Chrome Cache Entry: 74	ASCII text, with very long lines (1352)	5CC6B93D41889C0A55C6C4FCD2D89713	51A59C1DAE337817C4EBAC39FBE61C232705A893	8671CFDFA128168DB2136D7C17F55BA98DDBA221CDD1ACBBE559D4969280FD51
Chrome Cache Entry: 75	Web Open Font Format (Version 2), TrueType, length 7840, version 1.0	8D91EC1CA2D8B56640A47117E313A3E9	A9E9BAFE64666F4595051A0E895B47A5FA39E67E	78BC3AA78FAEC288BBB3BF26C9A0FA4EB67B1E69DA94A17233C5CAB60525EFDB
Chrome Cache Entry: 76	ASCII text, with very long lines (905)	62A914B2C847D4D02B76164D7A2A54C6	20D9F49A90A51FA6C8420640610DF77F7A96D919	B08C2864EC27736C507B1CA4B3A225A19147841B861CD8494DAF95FA370FE639
Chrome Cache Entry: 77	ASCII text, with very long lines (1352)	5CC6B93D41889C0A55C6C4FCD2D89713	51A59C1DAE337817C4EBAC39FBE61C232705A893	8671CFDFA128168DB2136D7C17F55BA98DDBA221CDD1ACBBE559D4969280FD51
Chrome Cache Entry: 78	Web Open Font Format (Version 2), TrueType, length 28000, version 1.66	A4BCA6C95FED0D0C5CC46CF07710DCEC	73B56E33B82B42921DB8702A33EFD0F2B2EC9794	5A51D246AF54D903F67F07F2BD820CE77736F8D08C5F1602DB07469D96DBF77F
Chrome Cache Entry: 79	ASCII text, with very long lines (6969)	DAD318033A09F6ABA68D6EE66F1CDACE	F538D0C3973677A6CDF14E9223AFB432FCF1CF8C	E8FCFB1552D918B5D9FD715F711255465D6DD4348B4DCEDD362CB00DF9D3DBEF
Chrome Cache Entry: 80	ASCII text, with very long lines (65536), with no line terminators	55BAF821A59FAD53AA754C85AE19D0EA	B1662F5F5B119836E5E9C91C5E4A448BCD6CCC6D	D26724E378F16CC4135849CCABF5A1BA738C3F4BA952950ACB34E73F24869E83
Chrome Cache Entry: 81	ASCII text, with very long lines (23126)	3D092EF4ABA019B14F01C40747E40554	1C26145272FCF4CA91AF501288CCE84B1BFFD38B	B4C48B77BBE6BBACF7D16BDAA81F5509FB8EA0FBFDDFBF2D12307F7A88518846
Chrome Cache Entry: 82	RIFF (little-endian) data, Web/P image	61057628AF7693025B6643DE1627F361	42FC8141BDFAE474172D95673067D40CA661CF37	4C02D419820F5177175FB99BA238BDC2B5E946CC80CC94B3F3CD3C77346D79D7
Chrome Cache Entry: 83	ASCII text	ACD4F2B6117E5054FC9BF848AE8121CA	AE4D5F41D854BA8D99A4A1EC6EE6D6C3C0A859B8	66774F89FCFA5674BE9AEF60E3FE3CB81E4DD88246BDE4E5392DF8B99FEFD4DB
Chrome Cache Entry: 84	Unicode text, UTF-8 text, with very long lines (63425)	D8A1FE8B9FD01233B8A030EA79C21DF0	1B2B4474F72FCEE56977101E7C85A8201F730903	91DEC32BF6596B875CDEB8C7BFFC8B5029A870657D3D7C790E8939F17E24DC20
Chrome Cache Entry: 85	ASCII text, with very long lines (786)	31B521136207C11FF1F9985264424E8A	9EAF6B9717979CAEB5C7E846E17B2A89A08DC266	C818B56446AE5A8D0466FC9C51D85104584E36F6D8B1C77E08A2D354E845E2CD
Chrome Cache Entry: 86	ASCII text, with very long lines (1211)	CB9BFA0FBDD957FBE7F4841B70341DB2	9CAD12A3580D3E4D340CB867E88B687C75564C5A	513864FD4EBD1926F3E1E78B436A90C2BC3A5D16835B50415E7B318D7DEEC2A2
Chrome Cache Entry: 87	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	B8D34C44F725FD43B1F066C37C0441C7	336E324A86AA890857DB2AD947F8F8D447BE6DD5	DEF02E22B656322F8C0AFB977E4FB00DCBE4CD2F0493C3DB981188A01DADBFA4
Chrome Cache Entry: 88	Unicode text, UTF-8 text, with very long lines (20947)	753CB19EE1A756E46FAA0F118B1B4E01	248885E3BFE7E71989BA9FFFB33B6EFF18166FEC	ED9FFA2FBA5ECC75AF2F99E6EBADD5B927086F258037C2A848E94449CC579991
Chrome Cache Entry: 89	ASCII text	8F12765EB30FBDCFCDC116D13F7FC272	506E45B7D3930756EACCE0DAD449A3C8CDB3EAC6	265995EB76326E95613750F6F6570B850F5C22280D262DE9B9632A16CEB98B9B
Chrome Cache Entry: 90	ASCII text, with very long lines (905)	62A914B2C847D4D02B76164D7A2A54C6	20D9F49A90A51FA6C8420640610DF77F7A96D919	B08C2864EC27736C507B1CA4B3A225A19147841B861CD8494DAF95FA370FE639
Chrome Cache Entry: 91	ASCII text, with very long lines (383)	21AD22788E6CAA18A4E9E57F7372B108	50EBDD2452193BEAB7D1899F788FBBF32D90DD55	0FE26F07B9E5D49590F55D31CBC381CA9337850F89B09940E3B384FCD6D26464
Chrome Cache Entry: 92	ASCII text	DAA79AD7558674F6A12D962ABF47F2F6	03EEA0EBEBD11EC14CFA5A651EB0ACA2604829A7	604281887CD770ED21601933E9636A7A9C8A57A30D7D796AE7D760EEF64D5089
Chrome Cache Entry: 93	ASCII text, with very long lines (51853)	A28B064344B1B0FB28B49BC96F1CD084	9F3ABFD14A24B426EC073A3F99DA77E14C3C2524	9AE1C6CF7FA6A9E859EC1802C1F3D655E71657E30825B97344B4675729487215
Chrome Cache Entry: 94	Web Open Font Format (Version 2), TrueType, length 8000, version 1.0	72993DDDF88A63E8F226656F7DE88E57	179F97EC0275F09603A8DB94D4380EB584D81CD5	F4E80D9DFD374D02989B87A27B5ED4CB78FBB177C27F1478E9A8B0AFB7513149
Chrome Cache Entry: 95	ASCII text, with very long lines (383)	21AD22788E6CAA18A4E9E57F7372B108	50EBDD2452193BEAB7D1899F788FBBF32D90DD55	0FE26F07B9E5D49590F55D31CBC381CA9337850F89B09940E3B384FCD6D26464
Chrome Cache Entry: 96	ASCII text	1E154E5ED919387FF6D969C8D6C56619	8E9D50DD4961C69460CF1881232CEA4BACCC6EB4	45FAAA17694E6BA660358AC8005E4A87EEEB817D99BA2A2E8E6684A591EEFDBC
Chrome Cache Entry: 97	Web Open Font Format (Version 2), TrueType, length 28584, version 1.66	17081510F3A6F2F619EC8C6F244523C7	87F34B2A1532C50F2A424C345D03FE028DB35635	2C7292014E2EF00374AEB63691D9F23159A010455784EE0B274BA7DB2BCCA956
Chrome Cache Entry: 98	Web Open Font Format (Version 2), TrueType, length 7884, version 1.0	9212F6F9860F9FC6C69B02FEDF6DB8C3	AC6D71B4D5FDD2B3DABC9A06FF6C001E4251DA0B	7D93459D86585BFCDBB7E0376056226ADB25821EE54B96236FE2123E9560929F
Chrome Cache Entry: 99	ASCII text	DAA79AD7558674F6A12D962ABF47F2F6	03EEA0EBEBD11EC14CFA5A651EB0ACA2604829A7	604281887CD770ED21601933E9636A7A9C8A57A30D7D796AE7D760EEF64D5089

Phishing

Yara detected HtmlPhish64

Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML

HTML body contains low number of good links

Source: https://logg_koonbase.godaddysites.com/

HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://logg_koonbase.godaddysites.com/

HTTP Parser: Title: oinbase Pro Login - Digital Asset Exchange. does not match URL

Source: https://logg_koonbase.godaddysites.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://logg_koonbase.godaddysites.com/	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49802 version: TLS 1.2

Networking

Performs DNS queries to domains with low reputation

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: sytfbklsdabx.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: sytfbklsdabx.xyz
Source:	DNS query: sytfbklsdabx.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: sytfbklsdabx.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: sytfbklsdabx.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: sytfbklsdabx.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: sytfbklsdabx.xyz
Source:	DNS query: sytfbklsdabx.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: sytfbklsdabx.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: sytfbklsdabx.xyz
Source:	DNS query: sytfbklsdabx.xyz
Source:	DNS query: sytfbklsdabx.xyz

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: logg_koonbase.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /markup/ad HTTP/1.1Host: logg_koonbase.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://logg_koonbase.godaddysites.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1
Source: global traffic	HTTP traffic detected: GET /sw.js HTTP/1.1Host: logg_koonbase.godaddysites.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://logg_koonbase.godaddysites.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1
Source: global traffic	HTTP traffic detected: GET /manifest.webmanifest HTTP/1.1Host: logg_koonbase.godaddysites.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://logg_koonbase.godaddysites.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: logg_koonbase.godaddysites.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://logg_koonbase.godaddysites.com/sw.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1
Source: global traffic	HTTP traffic detected: GET /markup/ad HTTP/1.1Host: logg_koonbase.godaddysites.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: dps_site_id=us-east-1
Source: global traffic	HTTP traffic detected: GET /i.gif?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjozNjk2NjY5OTcsImNoIjo1NDQ0NSwiY2siOnt9LCJjciI6NDA4ODkzMDIyLCJkaSI6IjBkMTcyMzQ5ZmRkMTQzYjViODBmZGM0OWVhMjI1ZDYyIiwiZGoiOjAsImlpIjoiNWUxNmY5NjE3ZjY4NDRmODllZGQxN2VmMTY3Yzk2MjEiLCJkbSI6MywiZmMiOjU4Mzk1MjEyMywiZmwiOjU3MTk5NDU0MywiaXAiOiI2NC4yMDIuMTYwLjAiLCJrdyI6Int7a2V5d29yZH19IiwibnciOjEwNjYzLCJwYyI6MCwib3AiOjAsIm1wIjowLCJlYyI6MCwiZ20iOjAsImVwIjpudWxsLCJwciI6MjE4NDY1LCJydCI6MSwicnMiOjUwMCwic2EiOiI1MiIsInNiIjoiaS0wZjJkNDAyYmMxYmMwNjJjMyIsInNwIjoyMjUxOTk5LCJzdCI6MTI3NjI2NCwidWsiOiJ1ZTEtMzdlMmMzYTE2YjdmNGVkMTgzYTQ0ZTlmZmU5YmE1ZmEiLCJ6biI6MzA3NDk1LCJ0cyI6MTcyNzU5MDEzMDQ0MiwicG4iOiJ3YW0iLCJnYyI6dHJ1ZSwiZ0MiOnRydWUsImdzIjoibm9uZSIsImRjIjoxLCJ0eiI6IlVUQyIsImJhIjoxLCJmcSI6MH0&s=TsH1hKr6YSUj6GVyz_A0XSt2THE&publisher_website_key=wam.md5.a16fc9606dd4c9d27a764a3bb277b01f HTTP/1.1Host: ms.godaddy.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://logg_koonbase.godaddysites.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i.gif?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjozNjk2NjY5OTcsImNoIjo1NDQ0NSwiY2siOnt9LCJjciI6NDA4ODkzMDIyLCJkaSI6IjBkMTcyMzQ5ZmRkMTQzYjViODBmZGM0OWVhMjI1ZDYyIiwiZGoiOjAsImlpIjoiNWUxNmY5NjE3ZjY4NDRmODllZGQxN2VmMTY3Yzk2MjEiLCJkbSI6MywiZmMiOjU4Mzk1MjEyMywiZmwiOjU3MTk5NDU0MywiaXAiOiI2NC4yMDIuMTYwLjAiLCJrdyI6Int7a2V5d29yZH19IiwibnciOjEwNjYzLCJwYyI6MCwib3AiOjAsIm1wIjowLCJlYyI6MCwiZ20iOjAsImVwIjpudWxsLCJwciI6MjE4NDY1LCJydCI6MSwicnMiOjUwMCwic2EiOiI1MiIsInNiIjoiaS0wZjJkNDAyYmMxYmMwNjJjMyIsInNwIjoyMjUxOTk5LCJzdCI6MTI3NjI2NCwidWsiOiJ1ZTEtMzdlMmMzYTE2YjdmNGVkMTgzYTQ0ZTlmZmU5YmE1ZmEiLCJ6biI6MzA3NDk1LCJ0cyI6MTcyNzU5MDEzMDQ0MiwicG4iOiJ3YW0iLCJnYyI6dHJ1ZSwiZ0MiOnRydWUsImdzIjoibm9uZSIsImRjIjoxLCJ0eiI6IlVUQyIsImJhIjoxLCJmcSI6MH0&s=TsH1hKr6YSUj6GVyz_A0XSt2THE&publisher_website_key=wam.md5.a16fc9606dd4c9d27a764a3bb277b01f HTTP/1.1Host: ms.godaddy.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: azk=ue1-37e2c3a16b7f4ed183a44e9ffe9ba5fa; azk-ss=true

Source: global traffic	DNS traffic detected: DNS query: logg_koonbase.godaddysites.com
Source: global traffic	DNS traffic detected: DNS query: img1.wsimg.com
Source: global traffic	DNS traffic detected: DNS query: isteam.wsimg.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ms.godaddy.com
Source: global traffic	DNS traffic detected: DNS query: sytfbklsdabx.xyz
Source: global traffic	DNS traffic detected: DNS query: google.com

Source: chromecache_84.2.dr, chromecache_123.2.dr, chromecache_124.2.dr, chromecache_88.2.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_102.2.dr	String found in binary or memory: http://scripts.sil.org/OFL
Source: chromecache_102.2.dr	String found in binary or memory: https://github.com/FAlthausen/Vollkorn-Typeface)
Source: chromecache_96.2.dr	String found in binary or memory: https://img1.wsimg.com/blobby/go/font/LeagueSpartan/LeagueSpartan.woff)
Source: chromecache_96.2.dr	String found in binary or memory: https://img1.wsimg.com/blobby/go/font/LeagueSpartan/LeagueSpartan.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/poppins/v21/pxiByp8kv8JHgFVrLCz7Z1JlFc-K.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/poppins/v21/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/poppins/v21/pxiByp8kv8JHgFVrLDz8Z1JlFc-K.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/poppins/v21/pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/poppins/v21/pxiByp8kv8JHgFVrLEj6Z1JlFc-K.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/poppins/v21/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/poppins/v21/pxiEyp8kv8JHgFVrJJfecg.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/poppins/v21/pxiEyp8kv8JHgFVrJJnecmNE.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/vollkorn/v23/0yb9GDoxxrvAnPhYGxkkaE0GrQ.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/vollkorn/v23/0yb9GDoxxrvAnPhYGxkmaE0GrQ.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/vollkorn/v23/0yb9GDoxxrvAnPhYGxknaE0GrQ.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/vollkorn/v23/0yb9GDoxxrvAnPhYGxkpaE0.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/vollkorn/v23/0yb9GDoxxrvAnPhYGxkqaE0GrQ.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/gfonts/s/vollkorn/v23/0yb9GDoxxrvAnPhYGxktaE0GrQ.woff2)
Source: chromecache_102.2.dr	String found in binary or memory: https://img1.wsimg.com/poly/v3/polyfill.min.js?rum=0&unknown=polyfill&flags=gated&features=Intl.~loc
Source: chromecache_102.2.dr	String found in binary or memory: https://logg_koonbase.godaddysites.com/
Source: chromecache_73.2.dr, chromecache_133.2.dr	String found in binary or memory: https://ms.godaddy.com/i.gif?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjoz
Source: chromecache_73.2.dr, chromecache_133.2.dr	String found in binary or memory: https://ms.godaddy.com/r?e=eyJ2IjoiMS4xMiIsImF2IjoxMzc5NjY0LCJhdCI6MjQ0NywiYnQiOjAsImNtIjozNjk2
Source: chromecache_102.2.dr	String found in binary or memory: https://www.fontsquirrel.com/license/league-spartan

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49802 version: TLS 1.2

Source: classification engine

Classification label: mal52.phis.troj.win@21/102@32/7

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=2364,i,18366499957688085511,10167160284856967565,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://logg_koonbase.godaddysites.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=2364,i,18366499957688085511,10167160284856967565,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

ID:	1522069
Product:	CloudBasic
Start time:	08:07:44
Start date:	29.09.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://logg_koonbase.godaddysites.com/

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://logg_koonbase.godaddysites.com/

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://logg_koonbase.godaddysites.com/