IOCReport

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\D098D95B-642E-42EF-92A5-23F41BB7DAD7

XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{09A8A274-0F83-4D32-A1A8-2C46EB8A646D}.tmp

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{4B58F8FA-D276-4F58-BC02-3B3873E56BFB}.tmp

data

dropped

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\DOC0798.LNK

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Sep 30 13:47:05 2020, mtime=Wed Jun 16 18:03:35 2021, atime=Wed Jun 16 18:03:31 2021, length=1613819, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

data

dropped

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Little-endian UTF-16 Unicode text, with CR line terminators

dropped

C:\Users\user\Desktop\~$OC0798.doc

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{6899A86A-6F93-4194-97B0-E6749671AC21}.tmp

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E42C9A4D-C73B-45F3-859A-E103BFD96442}.tmp

data

dropped

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

'C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE' /Automation -Embedding

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding

C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding

C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding

https://api.diagnosticssdf.office.com

unknown

https://login.microsoftonline.com/

unknown

https://shell.suite.office.com:1443

unknown

https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize

unknown

https://autodiscover-s.outlook.com/

unknown

https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr

unknown

https://cdn.entity.

unknown

https://api.addins.omex.office.net/appinfo/query

unknown

https://clients.config.office.net/user/v1.0/tenantassociationkey

unknown

https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/

unknown

femto.pw

188.165.215.31

188.165.215.31

femto.pw

France

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

),6

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

*,6

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

LastBootTime

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

:/6

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

RemoteClearDate

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Last

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

FilePath

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

StartDate

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

EndDate

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Properties