IOCReport

Bio-Solid Feed Stock Evaluation_.docx

Microsoft Word 2007+

initial sample

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\DF1C0634-A091-48ED-8FF2-AF628B96BF81

XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\88D6A842.png

PNG image data, 228 x 81, 8-bit/color RGBA, non-interlaced

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\mso8672.tmp

PNG image data, 1024 x 768, 8-bit/color RGBA, non-interlaced

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{B75B9AA0-2C2A-42AF-99FA-1A1373CEF798}.tmp

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{DE6EC9FB-3337-48EC-BC41-5E8E77CEDBD8}.tmp

data

dropped

C:\Users\user\AppData\Local\Temp\mso8538.tmp

GIF image data, version 89a, 15 x 15

dropped

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Bio-Solid Feed Stock Evaluation_.docx.LNK

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Sep 30 14:03:46 2020, mtime=Wed May 5 03:52:18 2021, atime=Wed May 5 03:52:15 2021, length=28469, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

data

dropped

C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Little-endian UTF-16 Unicode text, with no line terminators

dropped

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

'C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE' /Automation -Embedding

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding

https://api.diagnosticssdf.office.com

unknown

https://login.microsoftonline.com/

unknown

https://shell.suite.office.com:1443

unknown

https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize

unknown

https://autodiscover-s.outlook.com/

unknown

https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr

unknown

https://cdn.entity.

unknown

https://api.addins.omex.office.net/appinfo/query

unknown

https://clients.config.office.net/user/v1.0/tenantassociationkey

unknown

https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/

unknown

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

|c8

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

}c8

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

LastBootTime

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

2e8

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

RemoteClearDate

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Last

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

FilePath

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

StartDate

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

EndDate

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Properties