IOC Report
https://0nline1.logs-trading.site/?O462BZ3P81OgZBK

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 31 12:11:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 31 12:11:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 31 12:11:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 31 12:11:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 31 12:11:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 100
MS Windows icon resource - 6 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 24x24 with PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
dropped
Chrome Cache Entry: 101
gzip compressed data, from Unix, original size modulo 2^32 407106
dropped
Chrome Cache Entry: 102
GIF image data, version 89a, 352 x 3
downloaded
Chrome Cache Entry: 103
ASCII text, with very long lines (18308)
downloaded
Chrome Cache Entry: 104
ASCII text, with very long lines (1434), with no line terminators
dropped
Chrome Cache Entry: 105
gzip compressed data, from Unix, original size modulo 2^32 113378
downloaded
Chrome Cache Entry: 106
PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 107
ASCII text, with no line terminators
dropped
Chrome Cache Entry: 108
gzip compressed data, original size modulo 2^32 1864
dropped
Chrome Cache Entry: 109
gzip compressed data, from Unix, original size modulo 2^32 113811
downloaded
Chrome Cache Entry: 110
ASCII text, with very long lines (18308)
dropped
Chrome Cache Entry: 111
GIF image data, version 89a, 352 x 3
dropped
Chrome Cache Entry: 112
gzip compressed data, from Unix, original size modulo 2^32 3570
downloaded
Chrome Cache Entry: 113
gzip compressed data, from Unix, original size modulo 2^32 57443
downloaded
Chrome Cache Entry: 114
gzip compressed data, original size modulo 2^32 1592
downloaded
Chrome Cache Entry: 115
ASCII text, with very long lines (1434), with no line terminators
downloaded
Chrome Cache Entry: 116
GIF image data, version 89a, 352 x 3
dropped
Chrome Cache Entry: 117
gzip compressed data, from Unix, original size modulo 2^32 142327
downloaded
Chrome Cache Entry: 118
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 119
gzip compressed data, from Unix, original size modulo 2^32 15769
dropped
Chrome Cache Entry: 120
gzip compressed data, from Unix, original size modulo 2^32 407106
downloaded
Chrome Cache Entry: 121
gzip compressed data, from Unix, original size modulo 2^32 449943
dropped
Chrome Cache Entry: 122
gzip compressed data, from Unix, original size modulo 2^32 57443
dropped
Chrome Cache Entry: 123
Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
downloaded
Chrome Cache Entry: 124
gzip compressed data, from Unix, original size modulo 2^32 3570
downloaded
Chrome Cache Entry: 125
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 126
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 127
gzip compressed data, from Unix, original size modulo 2^32 449943
downloaded
Chrome Cache Entry: 86
gzip compressed data, original size modulo 2^32 1592
dropped
Chrome Cache Entry: 87
gzip compressed data, original size modulo 2^32 3651
dropped
Chrome Cache Entry: 88
gzip compressed data, from Unix, original size modulo 2^32 15769
downloaded
Chrome Cache Entry: 89
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 90
PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
downloaded
Chrome Cache Entry: 91
gzip compressed data, from Unix, original size modulo 2^32 142327
dropped
Chrome Cache Entry: 92
ASCII text, with very long lines (701)
downloaded
Chrome Cache Entry: 93
gzip compressed data, original size modulo 2^32 3651
downloaded
Chrome Cache Entry: 94
MS Windows icon resource - 6 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 24x24 with PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
downloaded
Chrome Cache Entry: 95
gzip compressed data, original size modulo 2^32 1864
downloaded
Chrome Cache Entry: 96
ASCII text, with very long lines (701)
downloaded
Chrome Cache Entry: 97
GIF image data, version 89a, 352 x 3
downloaded
Chrome Cache Entry: 98
ASCII text, with very long lines (701)
dropped
Chrome Cache Entry: 99
gzip compressed data, from Unix, original size modulo 2^32 113811
dropped
There are 39 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2020,i,8026553192597337689,2549318013970377598,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://0nline1.logs-trading.site/?O462BZ3P81OgZBK"

URLs

Name
IP
Malicious
https://0nline1.logs-trading.site/?O462BZ3P81OgZBK
malicious
https://25d29ec1-e0aaf5f6.logs-trading.site/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_d0a803279e7397bef834.js
159.89.97.160
 malicious
https://0nline1.logs-trading.site/e0aaf5f6a7a242bfbdff532937cf3b8a/
159.89.97.160
 malicious
https://25d29ec1-e0aaf5f6.logs-trading.site/shared/1.0/content/js/ConvergedLogin_PCore_IzDt-l0Cuie0gYRUoEk15w2.js
159.89.97.160
 malicious
https://0nline1.logs-trading.site/?O462BZ3P81OgZBK
malicious
https://l1ve.logs-trading.site/Me.htm?v=3
159.89.97.160
 malicious
https://25d29ec1-e0aaf5f6.logs-trading.site/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif
159.89.97.160
 malicious
https://25d29ec1-e0aaf5f6.logs-trading.site/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
159.89.97.160
 malicious
https://0ffice.logs-trading.site/login
159.89.97.160
 malicious
https://25d29ec1-e0aaf5f6.logs-trading.site/ests/2.1/content/cdnbundles/converged.v2.login.min_nin8k2ycrbzww8zl5vxkaq2.css
159.89.97.160
 malicious
https://0nline1.logs-trading.site/favicon.ico
159.89.97.160
 malicious
https://25d29ec1-e0aaf5f6.logs-trading.site/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
159.89.97.160
 malicious
https://25d29ec1-e0aaf5f6.logs-trading.site/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4285088f1dbaf52a876d.js
159.89.97.160
 malicious
https://25d29ec1-e0aaf5f6.logs-trading.site/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
159.89.97.160
 malicious
https://25d29ec1-e0aaf5f6.logs-trading.site/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js
159.89.97.160
 malicious
https://25d29ec1-e0aaf5f6.logs-trading.site/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js
159.89.97.160
 malicious
https://902c417b-e0aaf5f6.logs-trading.site/api/report?catId=GW+estsfd+dub2
159.89.97.160
 malicious
https://25d29ec1-e0aaf5f6.logs-trading.site/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
159.89.97.160
 malicious
https://25d29ec1-e0aaf5f6.logs-trading.site/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif
159.89.97.160
 malicious
https://25d29ec1-e0aaf5f6.logs-trading.site/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js
159.89.97.160
 malicious
https://0nline1.logs-trading.site/?
159.89.97.160
 malicious
https://developers.google.com/recaptcha/docs/faq#localhost_support
unknown
https://www.gstatic.c..?/recaptcha/releases/-ZG7BC9TxCVEbzIO2m429usb/recaptcha__.
unknown
https://support.google.com/recaptcha#6262736
unknown
https://cloud.google.com/recaptcha-enterprise/billing-information
unknown
https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=-ZG7BC9TxCVEbzIO2m429usb
142.250.186.132
https://support.google.com/recaptcha/?hl=en#6223828
unknown
https://cloud.google.com/contact
unknown
https://www.google.com/recaptcha/api2/reload?k=6LfCznAqAAAAAJKA2X0viVJZIPt8Xd2-pJVk3zNh
142.250.186.132
https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
unknown
https://play.google.com/log?format=json&hasfast=true
unknown
https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
unknown
https://www.google.com/recaptcha/api2/userverify?k=6LfCznAqAAAAAJKA2X0viVJZIPt8Xd2-pJVk3zNh
142.250.186.132
https://www.google.com/recaptcha/api.js
142.250.185.100
https://support.google.com/recaptcha/#6175971
unknown
https://www.google.com/js/bg/b50FiC3GJqhOPkFyj4HYcajJNbVzXJ6nVw0XfMkHZ-k.js
142.250.186.132
https://www.google.com/recaptcha/api2/
unknown
https://www.google.com/recaptcha/api2/bframe?hl=en&v=-ZG7BC9TxCVEbzIO2m429usb&k=6LfCznAqAAAAAJKA2X0viVJZIPt8Xd2-pJVk3zNh
142.250.186.132
https://support.google.com/recaptcha
unknown
There are 28 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
0nline1.logs-trading.site
159.89.97.160
 malicious
25d29ec1-e0aaf5f6.logs-trading.site
159.89.97.160
 malicious
7afa81fe-e0aaf5f6.logs-trading.site
159.89.97.160
 malicious
l1ve.logs-trading.site
159.89.97.160
 malicious
0ffice.logs-trading.site
159.89.97.160
 malicious
902c417b-e0aaf5f6.logs-trading.site
159.89.97.160
 malicious
bg.microsoft.map.fastly.net
199.232.210.172
s-part-0017.t-0009.t-msedge.net
13.107.246.45
www.google.com
142.250.185.68
fp2e7a.wpc.phicdn.net
192.229.221.95

IPs

IP
Domain
Country
Malicious
192.168.2.5
unknown
unknown
malicious
159.89.97.160
0nline1.logs-trading.site
United States
malicious
142.250.185.68
www.google.com
United States
142.250.185.100
unknown
United States
192.168.2.9
unknown
unknown
239.255.255.250
unknown
Reserved
142.250.185.196
unknown
United States
142.250.186.132
unknown
United States

DOM / HTML

URL
Malicious
https://0nline1.logs-trading.site/?O462BZ3P81OgZBK
 malicious
https://0nline1.logs-trading.site/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.logs-trading.site%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.logs-trading.site%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638659771326813838.ZWQ5MTBiNDktYTY0ZC00ZmEwLTlhM2UtMDRlMzhlNzhlNGZlNzlhMTUwM2EtNzIwZi00NmIxLWFlNTgtYjI4MTEyZTk1YTFi&ui_locales=en-US&mkt=en-US&client-request-id=f2d47f41-aea7-4d27-8855-a249306726d8&state=U10uurLgCUFN5DsJhXMK3a-nzIHqOXYXeR452swEE9U_8CMChxq50rc0dbEqpmPqwYNv3dC3M6Kyj8dzdabbHgxpZibLN35SXSUayxrJpUrtO2Tb26QwvYJ4Z-bHECcLY_2uvWRQcRvwisq8bNkrfhAShHG6-YqbLpGOlQiBZplsZJ2lYj228uFUInKaseZu7_ouePd3IZ3GnrPpi1xhACNepGPo1PjUao2C-SPmmcj_USaIk3-jnS5f3ZuB87vVBhMMQI7AK2W5DsDHas02xA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0
 malicious
https://0nline1.logs-trading.site/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.logs-trading.site%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.logs-trading.site%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638659771326813838.ZWQ5MTBiNDktYTY0ZC00ZmEwLTlhM2UtMDRlMzhlNzhlNGZlNzlhMTUwM2EtNzIwZi00NmIxLWFlNTgtYjI4MTEyZTk1YTFi&ui_locales=en-US&mkt=en-US&client-request-id=f2d47f41-aea7-4d27-8855-a249306726d8&state=U10uurLgCUFN5DsJhXMK3a-nzIHqOXYXeR452swEE9U_8CMChxq50rc0dbEqpmPqwYNv3dC3M6Kyj8dzdabbHgxpZibLN35SXSUayxrJpUrtO2Tb26QwvYJ4Z-bHECcLY_2uvWRQcRvwisq8bNkrfhAShHG6-YqbLpGOlQiBZplsZJ2lYj228uFUInKaseZu7_ouePd3IZ3GnrPpi1xhACNepGPo1PjUao2C-SPmmcj_USaIk3-jnS5f3ZuB87vVBhMMQI7AK2W5DsDHas02xA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true
 malicious
https://0nline1.logs-trading.site/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.logs-trading.site%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.logs-trading.site%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638659771326813838.ZWQ5MTBiNDktYTY0ZC00ZmEwLTlhM2UtMDRlMzhlNzhlNGZlNzlhMTUwM2EtNzIwZi00NmIxLWFlNTgtYjI4MTEyZTk1YTFi&ui_locales=en-US&mkt=en-US&client-request-id=f2d47f41-aea7-4d27-8855-a249306726d8&state=U10uurLgCUFN5DsJhXMK3a-nzIHqOXYXeR452swEE9U_8CMChxq50rc0dbEqpmPqwYNv3dC3M6Kyj8dzdabbHgxpZibLN35SXSUayxrJpUrtO2Tb26QwvYJ4Z-bHECcLY_2uvWRQcRvwisq8bNkrfhAShHG6-YqbLpGOlQiBZplsZJ2lYj228uFUInKaseZu7_ouePd3IZ3GnrPpi1xhACNepGPo1PjUao2C-SPmmcj_USaIk3-jnS5f3ZuB87vVBhMMQI7AK2W5DsDHas02xA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true
 malicious
https://0nline1.logs-trading.site/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.logs-trading.site%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.logs-trading.site%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638659771326813838.ZWQ5MTBiNDktYTY0ZC00ZmEwLTlhM2UtMDRlMzhlNzhlNGZlNzlhMTUwM2EtNzIwZi00NmIxLWFlNTgtYjI4MTEyZTk1YTFi&ui_locales=en-US&mkt=en-US&client-request-id=f2d47f41-aea7-4d27-8855-a249306726d8&state=U10uurLgCUFN5DsJhXMK3a-nzIHqOXYXeR452swEE9U_8CMChxq50rc0dbEqpmPqwYNv3dC3M6Kyj8dzdabbHgxpZibLN35SXSUayxrJpUrtO2Tb26QwvYJ4Z-bHECcLY_2uvWRQcRvwisq8bNkrfhAShHG6-YqbLpGOlQiBZplsZJ2lYj228uFUInKaseZu7_ouePd3IZ3GnrPpi1xhACNepGPo1PjUao2C-SPmmcj_USaIk3-jnS5f3ZuB87vVBhMMQI7AK2W5DsDHas02xA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true
 malicious
https://0nline1.logs-trading.site/?O462BZ3P81OgZBK
https://0nline1.logs-trading.site/?O462BZ3P81OgZBK
https://0nline1.logs-trading.site/?O462BZ3P81OgZBK
https://0nline1.logs-trading.site/?O462BZ3P81OgZBK
https://0nline1.logs-trading.site/?O462BZ3P81OgZBK
https://0nline1.logs-trading.site/?O462BZ3P81OgZBK
There are 1 hidden doms, click here to show them.