Loyalty..docx
| Engine | Download Report | Detection | Info |
|---|---|---|---|
|
suspicious
Score: 21
|
Error: Incomplete analysis, please check the report for detailed error information
System: unknown
|
|
|
|
suspicious
Score: 22
|
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run Condition: Potential for more IOCs and behavior
|
| IP | Country | Detection |
|---|---|---|
| 172.217.23.227 | United States |  |
| 45.56.217.107 | Canada | |
| Name | IP | Detection |
|---|---|---|
| korkoladesign.com | 45.56.217.107 | |
| www.google.co.za | 172.217.23.227 | |
| www.korkoladesign.com | 0.0.0.0 | |
| Name | Detection |
|---|---|
| http://www.ask.com/ | |
| https://login.windows.net/common/oauth2/authorizeics | |
| https://www.google.co.za/favicon.icoc | |
| Click to see the 97 hidden entries | |
| https://management.azure.comp | |
| https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArtice9 | |
| https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json | |
| https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bings | |
| http://sads.myspace.com/ | |
| https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.jsonMBI_SSLpeople.directory. | |
| http://www.amazon.de/ | |
| https://www.google.co.za/favicon.icoU | |
| http://search.auction.co.kr/ | |
| http://www.google.it/ | |
| https://login.windows.net/common/oauth2/authorizeled:t | |
| https://graph.windows.net | |
| http://www.microsofttranslator.com/BVPrev.aspx?ref=IE8Activity | |
| https://pki.goog/repository/0 | |
| http://ocsp.pki.goog/gsr202 | |
| https://login.windows.net/common/oauth2/authorize32P | |
| https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA29 | |
| https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDriveceZ | |
| http://buscar.ozu.es/ | |
| https://www.odwebp.svc.ms | |
| https://login.windows.net/common/oauth2/authorizel1234 | |
| http://search.msn.co.jp/results.aspx?q= | |
| http://uk.search.yahoo.com/ | |
| http://search.nifty.com/ | |
| http://www.founder.com.cn/cn/bThe | |
| http://www.korkoladesign.com/portfolio_page/ontario-lottery | |
| http://www.gmarket.co.kr/ | |
| https://login.windows.net/common/oauth2/authorized | |
| http://search.yahoo.co.jp/favicon.ico | |
| http://openimage.interpark.com/interpark.ico | |
| https://api.powerbi.com/v1.0/myorg/datasetsBearer | |
| http://search.sify.com/ | |
| https://login.windows.net/common/oauth2/authorizebled | |
| http://www.ozu.es/favicon.ico | |
| https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml | |
| https://onedrive.live.com/embed?i | |
| https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios | |
| https://templatelogging.office.com/client/log1AppAcquisitionLogginghttps:// | |
| http://www.rambler.ru/favicon.ico | |
| http://list.taobao.com/browse/search_visual.htm?n=15&q= | |
| http://google.pchome.com.tw/ | |
| http://crl.pki.goog/gsr2/gsr2.crl0? | |
| http://browse.guardian.co.uk/favicon.ico | |
| http://www.pchome.com.tw/favicon.ico | |
| http://weather.service.msn.com/data.aspx | |
| https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/ | |
| https://login.windows.net/common/oauth2/authorizeabled | |
| https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr | |
| https://login.windows.net/common/oauth2/authorizeMRUU | |
| http://in.search.yahoo.com/ | |
| https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy | |
| http://fr.search.yahoo.com/ | |
| https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile | |
| https://www.google.co.za/favicon.icoz | |
| https://autodiscover-s.outlook.com/autodiscover/autodiscover.xmlbled | |
| https://www.google.co.za/favicon.ico~ | |
| https://lookup.onenote.com/lookup/geolocation/v1 | |
| https://rpsticket.partnerservices.getmicrosoftkey.com | |
| https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/ | |
| https://login.windows.net/common/oauth2/authorize1ed8r | |
| http://img.shopzilla.com/shopzilla/shopzilla.ico | |
| https://www.google.co.za/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=gn.com/portfolio_pa | |
| https://login.windows-ppe.net/common/oauth2/authorize? | |
| https://login.windows.net/common/oauth2/authorizeal | |
| https://www.google.co.za/favicon.icok | |
| http://www.dailymail.co.uk/ | |
| https://shell.suite.office.com:1443er | |
| http://www.korkoladesign.com/wp-content/uploads/2015/11/olg.pngg | |
| http://www.merlin.com.pl/favicon.ico | |
| https://login.windows.net/common/oauth2/authorizedngk | |
| http://www.mercadolivre.com.br/ | |
| http://search.chol.com/favicon.ico | |
| http://www.ya.com/favicon.ico | |
| http://ocsp.pki.goog/gts1o10 | |
| http://cgi.search.biglobe.ne.jp/favicon.ico | |
| https://wus2-000.pagecontentsync. | |
| http://search.hanafos.com/favicon.ico | |
| http://cps.letsencrypt.org0 | |
| https://store.office.cn/addinstemplate | |
| http://www.korkoladesign.com/portfolio_page/ontario-lottery-and-gaming/res://ieframe.dll/dnserror.ht | |
| http://it.search.dada.net/favicon.ico | |
| https://ovisualuiapp.azurewebsites.net/pbiagave/nv5 | |
| https://incidents.diagnosticssdf.office.comavVHV= | |
| http://www.etmall.com.tw/favicon.ico | |
| https://www.google.co.za/favicon.ico2 | |
| https://loki.delve.office.com/api/v1/configuration/officewin32/u | |
| https://tasks.office.com | |
| https://res.getmicrosoftkey.com/api/redemptionevents | |
| https://api.powerbi.com/v1.0/myorg/groupsLasso | |
| http://busca.igbusca.com.br//app/static/images/favicon.ico | |
| http://www.reddit.com/ | |
| https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13che | |
| http://msk.afisha.ru/ | |
| https://settings.outlook.comSp | |
| https://login.windows.net/common/oauth2/authorized3 | |
| https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=ImmersiveApp | |
| https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies | |
| Name | File Type | Hashes | Detection |
|---|---|---|---|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VTIIBVU5\NewErrorPageTemplate[1] |
UTF-8 Unicode (with BOM) text, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{E4771163-FB58-4D23-BFA7-5B2E2A39EFFC}.tmp |
data | # | |
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{E9552E51-1A19-4DAE-9EEF-F989019CB74A}.tmp |
data | # | |
| Click to see the 34 hidden entries | |||
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\errorPageStrings[1] |
UTF-8 Unicode (with BOM) text, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\favicon[2].ico |
MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel | # | |
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\olg[1].htm |
HTML document, ASCII text | # | |
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\url[1].htm |
HTML document, ASCII text, with very long lines | # | |
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\V5D02472\dnserror[1] |
HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\V5D02472\down[1] |
PNG image data, 15 x 15, 8-bit colormap, non-interlaced | # | |
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VINVDFP6\olg[1].htm |
HTML document, ASCII text | # | |
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\7A6A84C0.png |
PNG image data, 128 x 78, 8-bit/color RGBA, non-interlaced | # | |
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VTIIBVU5\url[1].htm |
HTML document, ASCII text, with very long lines | # | |
C:\Users\user\AppData\Local\Temp\~DF11C1BB160A590842.TMP |
data | # | |
C:\Users\user\AppData\Local\Temp\~DF4A82A57BD599A196.TMP |
data | # | |
C:\Users\user\AppData\Local\Temp\~DFFA23D101D17A7DB4.TMP |
data | # | |
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Loyalty..LNK |
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu May 23 20:36:40 2019, mtime=Tue Dec 3 14:46:43 2019, atime=Tue Dec 3 14:46:35 2019, length=59237, window=hide | # | |
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat |
ASCII text, with CRLF line terminators | # | |
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm |
data | # | |
C:\Users\user\Desktop\~$yalty..docx |
data | # | |
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml |
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{2CF7092D-15E4-11EA-AADB-C25F135D3C65}.dat |
Microsoft Word Document | # | |
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{45D5DAAC-15E4-11EA-AADB-C25F135D3C65}.dat |
Microsoft Word Document | # | |
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml |
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml |
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml |
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml |
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml |
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml |
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2CF7092B-15E4-11EA-AADB-C25F135D3C65}.dat |
Microsoft Word Document | # | |
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml |
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml |
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\6aw4uvh\imagestore.dat |
data | # | |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\EBD278FA-94FE-46CF-B8F7-28DCF57A1CF9 |
XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml |
XML 1.0 document, ASCII text, with very long lines, with no line terminators | # | |
C:\Users\user\AppData\Local\Microsoft\Office\OTele\winword.exe.db-wal |
SQLite Write-Ahead Log, version 3007000 | # | |
C:\Users\user\AppData\Local\Microsoft\Office\OTele\winword.exe.db.session |
SQLite 3.x database, last written using SQLite version 3019003 | # | |
C:\Users\user\AppData\Local\Microsoft\Office\OTele\winword.exe.db.session-journal |
data | # | |
