IOCReport

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\FB9D2E74-CF1E-446D-ADAF-5037AFCD61C7

XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{D02C9C23-9FAB-49C5-A520-B3B783F08DE0}.tmp

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{DFF4BA98-BA4E-4041-852E-34D88C256C56}.tmp

data

dropped

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\PO-0814.LNK

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Sep 30 06:35:49 2020, mtime=Wed Jun 16 09:12:55 2021, atime=Wed Jun 16 09:12:52 2021, length=1710047, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

data

dropped

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Little-endian UTF-16 Unicode text, with CR line terminators

dropped

C:\Users\user\Desktop\~$O-0814.doc

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{1BF24CA3-025D-4403-9DBE-B492A11253DC}.tmp

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{3A3DB071-4F03-4D2B-8C5C-F1ADB9722678}.tmp

data

dropped

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

'C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE' /Automation -Embedding

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding

C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding

C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding

https://api.diagnosticssdf.office.com

unknown

https://login.microsoftonline.com/

unknown

https://shell.suite.office.com:1443

unknown

https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize

unknown

https://autodiscover-s.outlook.com/

unknown

https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr

unknown

https://cdn.entity.

unknown

https://api.addins.omex.office.net/appinfo/query

unknown

https://clients.config.office.net/user/v1.0/tenantassociationkey

unknown

https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/

unknown

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

`,=

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

a,=

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

LastBootTime

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

p.=

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

RemoteClearDate

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Last

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

FilePath

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

StartDate

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

EndDate

C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Properties