IOCReport

Claim Covid Tvx - Bandoir PBR.docx

Microsoft Word 2007+

initial sample

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\017E6514-9C86-422D-A14F-55B0CD085360

XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{6D4EB022-1520-42A7-BC21-5CFC71D64976}.tmp

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{EDB964CD-34DB-46C8-9731-E5F81802CF02}.tmp

data

dropped

C:\Users\user\AppData\Local\Temp\msoA226.tmp

GIF image data, version 89a, 15 x 15

dropped

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Claim Covid Tvx - Bandoir PBR.LNK

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Sep 30 13:47:07 2020, mtime=Thu May 20 02:17:33 2021, atime=Thu May 20 02:17:30 2021, length=16919, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

data

dropped

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Little-endian UTF-16 Unicode text, with CR line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryFR040c.lex

Little-endian UTF-16 Unicode text, with no line terminators

dropped

C:\Users\user\Desktop\~$aim Covid Tvx - Bandoir PBR.docx

data

dropped

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

'C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE' /Automation -Embedding

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding

https://api.diagnosticssdf.office.com

unknown

https://login.microsoftonline.com/

unknown

https://shell.suite.office.com:1443

unknown

https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize

unknown

https://autodiscover-s.outlook.com/

unknown

https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr

unknown

https://cdn.entity.

unknown

https://api.addins.omex.office.net/appinfo/query

unknown

https://clients.config.office.net/user/v1.0/tenantassociationkey

unknown

https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/

unknown

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

?':

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

`':

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

LastBootTime

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

5):

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

RemoteClearDate

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Last

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

FilePath

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

StartDate

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

EndDate

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Properties