Windows Analysis Report
cnewton doc 08.11.2022.doc

Overview

General Information

Sample Name: cnewton doc 08.11.2022.doc
Analysis ID: 682599
MD5: ee1d6eb5b07b99e65fc0cb477193c35c
SHA1: 9d4dbf701c8ede93a79036dd5a0316da988a2eeb
SHA256: 23b9a20a59041fc7d484957e49ffa7e0f6dba7dbbec0628a4adb69c2e05863ab
Tags: docIcedID
Infos:
Errors
  • Corrupt sample or wrongly selected analyzer.

Detection

Score: 80
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Document exploit detected (creates forbidden files)
Multi AV Scanner detection for submitted file
Document contains an embedded VBA macro with suspicious strings
Document exploit detected (process start blacklist hit)
Document exploit detected (UrlDownloadToFile)
Machine Learning detection for sample
One or more processes crash
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Potential document exploit detected (performs HTTP gets)
IP address seen in connection with other malware

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: cnewton doc 08.11.2022.doc Virustotal: Detection: 21% Perma Link
Source: cnewton doc 08.11.2022.doc ReversingLabs: Detection: 15%
Machine Learning detection for sample
Source: cnewton doc 08.11.2022.doc Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File opened: C:\Windows\SysWOW64\MSVCR100.dll Jump to behavior
Source: Binary string: P:\DocGeneratingSigning\ShellcodeDoc\DllLoaderShellcode\Build\RemoteDllLoader\Release-x32\RemoteDllLoader.pdb source: WINWORD.EXE, 00000000.00000000.348321457.000000001496F000.00000040.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.337697577.0000000014BF0000.00000040.00000001.00020000.00000000.sdmp
Source: Binary string: P:\DocGeneratingSigning\ShellcodeDoc\DllLoaderShellcode\Build\MemLoader\Release-x32\MemLoader.pdb source: WINWORD.EXE, 00000000.00000000.348321457.000000001496F000.00000040.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.337697577.0000000014BF0000.00000040.00000001.00020000.00000000.sdmp
Source: Binary string: P:\DocGeneratingSigning\ShellcodeDoc\DllLoaderShellcode\Build\RemoteDllLoader\Release-x32\RemoteDllLoader.pdb source: WINWORD.EXE, 00000000.00000000.348321457.000000001496F000.00000040.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.337697577.0000000014BF0000.00000040.00000001.00020000.00000000.sdmp
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\PROGRA~2\COMMON~1\MICROS~1\ Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\PROGRA~2\COMMON~1\ Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\Program Files (x86)\Common Files\Microsoft Shared\VBA\ Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\Program Files (x86)\Common Files\Microsoft Shared\VBA\VBA7.1\ Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\PROGRA~2\COMMON~1\MICROS~1\VBA\ Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\PROGRA~2\COMMON~1\MICROS~1\VBA\VBA7.1\ Jump to behavior

Software Vulnerabilities
barindex
Document exploit detected (creates forbidden files)
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\y5A7.tmp.dll Jump to behavior
Document exploit detected (process start blacklist hit)
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Windows\SysWOW64\WerFault.exe
Document exploit detected (UrlDownloadToFile)
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Section loaded: unknown origin: URLDownloadToFileA Jump to behavior
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.3:49741 -> 45.8.146.139:80
Source: global traffic TCP traffic: 45.8.146.139:80 -> 192.168.2.3:49741
Source: global traffic TCP traffic: 192.168.2.3:49741 -> 45.8.146.139:80
Source: global traffic TCP traffic: 192.168.2.3:49741 -> 45.8.146.139:80
Source: global traffic TCP traffic: 45.8.146.139:80 -> 192.168.2.3:49741
Source: global traffic TCP traffic: 45.8.146.139:80 -> 192.168.2.3:49741
Source: global traffic TCP traffic: 192.168.2.3:49741 -> 45.8.146.139:80
Source: global traffic TCP traffic: 45.8.146.139:80 -> 192.168.2.3:49741
Source: global traffic TCP traffic: 192.168.2.3:49741 -> 45.8.146.139:80
Source: global traffic TCP traffic: 192.168.2.3:49741 -> 45.8.146.139:80
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.3:49741 -> 45.8.146.139:80
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /fhfty/NH1-X8NL7CO4_YNJ-MEFY7BW9QYIJW1I/-f HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 45.8.146.139Connection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 45.8.146.139 45.8.146.139
Source: unknown TCP traffic detected without corresponding DNS query: 45.8.146.139
Source: unknown TCP traffic detected without corresponding DNS query: 45.8.146.139
Source: unknown TCP traffic detected without corresponding DNS query: 45.8.146.139
Source: unknown TCP traffic detected without corresponding DNS query: 45.8.146.139
Source: unknown TCP traffic detected without corresponding DNS query: 45.8.146.139
Source: unknown TCP traffic detected without corresponding DNS query: 45.8.146.139
Source: WINWORD.EXE, 00000000.00000000.319693683.0000000012350000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://45.8.146.139/
Source: WINWORD.EXE, 00000000.00000000.331890958.000000000DCF2000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.330024190.000000000DAF0000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.319834136.0000000012362000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://45.8.146.139/fhfty/NH1-X8NL7CO4_YNJ-MEFY7BW9QYIJW1I/-f
Source: WINWORD.EXE, 00000000.00000000.330024190.000000000DAF0000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://45.8.146.139/fhfty/NH1-X8NL7CO4_YNJ-MEFY7BW9QYIJW1I/-f.
Source: WINWORD.EXE, 00000000.00000000.310100247.000000000DCA8000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://45.8.146.139/fhfty/NH1-X8NL7CO4_YNJ-MEFY7BW9QYIJW1I/-f71USERNAME=userUSERPROFILE=C:
Source: WINWORD.EXE, 00000000.00000000.330024190.000000000DAF0000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://45.8.146.139/fhfty/NH1-X8NL7CO4_YNJ-MEFY7BW9QYIJW1I/-f=
Source: WINWORD.EXE, 00000000.00000000.339121868.00000000123F7000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://45.8.146.139/fhfty/NH1-X8NL7CO4_YNJ-MEFY7BW9QYIJW1I/-fC:
Source: WINWORD.EXE, 00000000.00000000.303139501.000000000B0EF000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.352872367.000000000B0EF000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://45.8.146.139/fhfty/NH1-X8NL7CO4_YNJ-MEFY7BW9QYIJW1I/-fOOC:
Source: WINWORD.EXE, 00000000.00000000.331890958.000000000DCF2000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://45.8.146.139/fhfty/NH1-X8NL7CO4_YNJ-MEFY7BW9QYIJW1I/-fe
Source: WINWORD.EXE, 00000000.00000000.319834136.0000000012362000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://45.8.146.139/fhfty/NH1-X8NL7CO4_YNJ-MEFY7BW9QYIJW1I/-fn
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://b.c2r.ts.cdn.office.net/prpointjm#M
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://f.c2r.ts.cdn.office.net/prpoint(mmM
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: WINWORD.EXE, 00000000.00000000.303139501.000000000B0EF000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.352872367.000000000B0EF000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://purl.oclc.org/ooxml/drawingml/diagram-E0
Source: WINWORD.EXE, 00000000.00000000.303139501.000000000B0EF000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.352872367.000000000B0EF000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://purl.oclc.org/ooxml/drawingml/table
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://weather.service.msn.com/data.aspxBD
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: WINWORD.EXE, 00000000.00000000.325229073.000000000D281000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalledg
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticatedx
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://addinslicensing.store.office.com/apps/removeK
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/removeId
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query)
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://analysis.windows.net/powerbi/api/
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechRS
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://api.aadrm.com
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://api.aadrm.com/
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.addins.omex.office.net/appstate/query?
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://api.addins.store.office.com/app/query
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.addins.store.office.com/app/queryl
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://api.cortana.ai
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.cortana.aiL
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.cortana.aiU
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://api.diagnostics.office.com
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.diagnostics.office.comointk
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.diagnostics.office.comom
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.diagnostics.office.comq
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://api.diagnosticssdf.office.com
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file#ZsN?
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://api.microsoftstream.com/api/
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://api.office.net
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.office.net.&
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.office.netA&.H
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.office.netd&
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://api.onedrive.com
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.powerbi.com/beta/myorg/importshG&M
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groupsQG
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://apis.live.net/v5.0/
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://augloop.office.com
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://augloop.office.com/v2
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://augloop.office.com/v2R
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://augloop.office.com/v2c
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://autodiscover-s.outlook.com/
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://cdn.entity.
Source: WINWORD.EXE, 00000000.00000000.325229073.000000000D281000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://clients.config.office.net/
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://clients.config.office.net/a.
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallationr
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies_J
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://clients.config.office.net/user/v1.0/ios%
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://clients.config.office.net/user/v1.0/iosR
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: WINWORD.EXE, 00000000.00000000.325229073.000000000D281000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey=3niE
Source: WINWORD.EXE, 00000000.00000000.325229073.000000000D281000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkeyhips
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://config.edge.skype.com
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://config.edge.skype.com2qWIt
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://cortana.ai
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://cortana.ai/api
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cortana.ai/apih
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cortana.aietl
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://cr.office.com
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://dataservice.o365filtering.com
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://dataservice.o365filtering.com/
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFileN
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://dataservice.o365filtering.com/oc&O8
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://dataservice.o365filtering.com2ckO1
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://dataservice.o365filtering.comVb
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFileY
Source: WINWORD.EXE, 00000000.00000000.305945925.000000000D311000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://dev.cortana.ai
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://devnull.onenote.com
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://devnull.onenote.comt
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://directory.services.
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://enrichment.osi.office.net/
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://enrichment.osi.office.net/E
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1VU
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1yW
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1#R
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.jsonGS
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml8SQM
Source: WINWORD.EXE, 00000000.00000000.306084548.000000000D32A000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://enrichment.osi.office.net/y
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://entitlement.diagnostics.office.com
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://entitlement.diagnostics.office.comIE
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://entity.osi.office.net/t
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech)P
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechZQwO
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-androidi
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://globaldisco.crm.dynamics.comom
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://graph.ppe.windows.net
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://graph.ppe.windows.net/
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://graph.ppe.windows.net=
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://graph.windows.net
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://graph.windows.net/
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://graph.windows.net/ent
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://hubble.officeapps.live.com
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://hubble.officeapps.live.comu
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://hubble.officeapps.live.comx
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: WINWORD.EXE, 00000000.00000000.325229073.000000000D281000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3das/
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: WINWORD.EXE, 00000000.00000000.325229073.000000000D281000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1=
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1o
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://incidents.diagnostics.office.com
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://incidents.diagnostics.office.com2ElO
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://inclient.store.office.com/gyro/clientl
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://inclient.store.office.com/gyro/clientstoret
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=ImmersiveApp
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: WINWORD.EXE, 00000000.00000000.305945925.000000000D311000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: WINWORD.EXE, 00000000.00000000.305945925.000000000D311000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebookf
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: WINWORD.EXE, 00000000.00000000.305945925.000000000D311000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrivec-HO
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: WINWORD.EXE, 00000000.00000000.306545880.000000000D3BB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmediamlr%
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://invites.office.com/
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetvoicesN_
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://lifecycle.office.com
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://lifecycle.office.comP
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://lifecycle.office.comov
Source: WINWORD.EXE, 00000000.00000000.320784675.000000001252E000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.live.comj
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://login.microsoftonline.com/
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorizeIM
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorizewM%M
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://login.windows.local
Source: WINWORD.EXE, 00000000.00000000.306836673.000000000D407000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.localtes
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize#
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize#xdN6
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize$
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize-
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize.
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize/2
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize0
Source: WINWORD.EXE, 00000000.00000000.306545880.000000000D3BB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize054
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize2hiL
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize3
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize3khM
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize4
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize6ziL
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize7ehM
Source: WINWORD.EXE, 00000000.00000000.306545880.000000000D3BB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize874
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize8e_M
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize;BiL
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize=
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeAx
Source: WINWORD.EXE, 00000000.00000000.306545880.000000000D3BB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeCache
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeCz
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeDe
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeGB
Source: WINWORD.EXE, 00000000.00000000.306545880.000000000D3BB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeH.4
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeHB
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeM
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeN=
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeOh
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizePh
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeQ
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeR
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeRxuN7
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeS
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeTz
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeYB
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeZM
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeaz&L
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizebe%M
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizecomfM6M
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeeB7L
Source: WINWORD.EXE, 00000000.00000000.306545880.000000000D3BB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizefic
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeg
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeize
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizej
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizek
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizek27L
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizen
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeox
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizep
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeq
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizer
Source: WINWORD.EXE, 00000000.00000000.306545880.000000000D3BB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizerdml
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizese
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizetenk%M
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizevB&L
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizexM
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize~h
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://management.azure.com
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://management.azure.com/
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://management.azure.com/#
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://messaging.action.office.com/
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://messaging.action.office.com/setcampaignactionh
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://messaging.engagement.office.com/
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregatorO
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://messaging.lifecycle.office.com/
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16T
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://messaging.office.com/
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy0RhN
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://ncus.contentsync.
Source: WINWORD.EXE, 00000000.00000000.305945925.000000000D311000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://ncus.pagecontentsync.
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://nexus.officeapps.live.com
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://nexus.officeapps.live.com/
Source: WINWORD.EXE, 00000000.00000000.306545880.000000000D3BB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://nexus.officeapps.live.com/nexus/U
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://nexus.officeapps.live.com/nexus/rules4
Source: WINWORD.EXE, 00000000.00000000.320827190.000000001253A000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://nexus.officeapps.live.com/nexus/rules?Application=winword.exe&Version=16.0.4954.1000&ClientI
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://nexus.officeapps.live.comq
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.netFE
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.306010951.000000000D31E000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://officeapps.live.com
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://officeapps.live.com.0
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://officeapps.live.com:
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://officeapps.live.comN
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://officeapps.live.comary
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://officeapps.live.comc
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://officeapps.live.comd
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://officeapps.live.comp
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://officeapps.live.comument
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://officeapps.live.comx
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://officeapps.live.comy
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asksCP
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://officesetup.getmicrosoftkey.com%
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/rz
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities69sM
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: WINWORD.EXE, 00000000.00000000.325229073.000000000D281000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdateddll6
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: WINWORD.EXE, 00000000.00000000.325229073.000000000D281000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiest.dllL3L
Source: WINWORD.EXE, 00000000.00000000.325229073.000000000D281000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://onedrive.live.com
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://onedrive.live.com/embed?
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://onedrive.live.com/embed?i
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://onedrive.live.comew
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://onedrive.live.comz
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://osi.office.net
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://osi.office.net##
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://osi.office.netst
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://otelrules.azureedge.net
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://otelrules.azureedge.netnp#N
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://outlook.office.com
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://outlook.office.com/
Source: WINWORD.EXE, 00000000.00000000.305945925.000000000D311000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.office.com2006
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.office.comBr
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://outlook.office365.com
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://outlook.office365.com/
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.office365.com/.dll
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: WINWORD.EXE, 00000000.00000000.306836673.000000000D407000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://pages.store.office.com/review/query
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://pages.store.office.com/review/querydZ2ND
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: WINWORD.EXE, 00000000.00000000.305945925.000000000D311000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json4
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://powerlift.acompli.net
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://powerlift.acompli.netPrqL
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectoryxT
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://roaming.edog.
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://settings.outlook.com
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://shell.suite.office.com:1443
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://skyapi.live.net/Activity/
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://staging.cortana.ai
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://staging.cortana.ai7
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://staging.cortana.airlG
Source: WINWORD.EXE, 00000000.00000000.306545880.000000000D3BB000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://store.office.cn/addinstemplate
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://store.office.de/addinstemplate
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office.com
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office.com/Todo-Internal.ReadWrite/
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office.com3
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office.comP
Source: WINWORD.EXE, 00000000.00000000.327740515.000000000D436000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office.comW
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office.comXpyNZ
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office.combs
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://substrate.office.comrl
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile5QlO
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://tasks.office.com
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://tellmeservice.osi.office.netst
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/c
Source: WINWORD.EXE, 00000000.00000000.322203445.000000000B154000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: WINWORD.EXE, 00000000.00000000.305945925.000000000D311000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.htmll.dll
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://web.microsoftstream.com/video/
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://webshell.suite.office.com
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://wus2.contentsync.
Source: WINWORD.EXE, 00000000.00000000.305945925.000000000D311000.00000004.00000001.00020000.00000000.sdmp, AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://wus2.pagecontentsync.
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2Area
Source: AE1D8E82-09A3-4CE3-BB95-E3559641C73B.0.dr String found in binary or memory: https://www.odwebp.svc.ms
Source: WINWORD.EXE, 00000000.00000000.359196523.000000000D98F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.odwebp.svc.msom
Source: global traffic HTTP traffic detected: GET /fhfty/NH1-X8NL7CO4_YNJ-MEFY7BW9QYIJW1I/-f HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 45.8.146.139Connection: Keep-Alive

System Summary
barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: Enable editing" button on W a the top bar, and then click "Enable content'. m" 8^- q . . ,. l!
Source: Screenshot number: 4 Screenshot OCR: Enable content'. m" 8^- q . . ,. l!lll|| i i i "sm=m= O Type here to search Ki E a a g wg
Document contains an embedded VBA macro with suspicious strings
Source: cnewton doc 08.11.2022.doc OLE, VBA macro line: Private Declare PtrSafe Function Lib "kernel32" Alias "VirtualProtect" (ByVal As LongPtr, ByVal As LongPtr, ByVal As LongPtr, As LongPtr) As LongPtr
Source: cnewton doc 08.11.2022.doc OLE, VBA macro line: Set = CallByName((EF9Yq0sar_("DgrVRLL_I")), EF9Yq0sar_("kMNkamqH7"), VbGet, EF9Yq0sar_("RQeWcJp24"))
Source: cnewton doc 08.11.2022.doc OLE, VBA macro line: Set = CallByName((), EF9Yq0sar_("qWfCNVnD"), VbGet, )
Source: cnewton doc 08.11.2022.doc OLE, VBA macro line: Set = CallByName((), EF9Yq0sar_("Qa6ipUt"), VbGet, )
One or more processes crash
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 4160
Document contains an embedded VBA macro which executes code when the document is opened / closed
Source: cnewton doc 08.11.2022.doc OLE, VBA macro line: Private Sub Document_Open()
Document contains embedded VBA macros
Source: cnewton doc 08.11.2022.doc OLE indicator, VBA macros: true
Source: cnewton doc 08.11.2022.doc Virustotal: Detection: 21%
Source: cnewton doc 08.11.2022.doc ReversingLabs: Detection: 15%
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 4160
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 4152
Source: cnewton doc 08.11.2022.doc.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\cnewton doc 08.11.2022.doc
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1220
Source: cnewton doc 08.11.2022.doc OLE indicator, Word Document stream: true
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\{DDE00C9B-9E2F-46A2-8526-4216C14B0389} - OProcSessId.dat Jump to behavior
Source: classification engine Classification label: mal80.expl.winDOC@3/11@0/1
Source: cnewton doc 08.11.2022.doc OLE document summary: title field not present or empty
Source: cnewton doc 08.11.2022.doc OLE document summary: author field not present or empty
Source: cnewton doc 08.11.2022.doc OLE document summary: edited time not present or 0
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: cnewton doc 08.11.2022.doc Initial sample: OLE zip file path = docProps/custom.xml
Source: cnewton doc 08.11.2022.doc Static file information: File size 2343230 > 1048576
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File opened: C:\Windows\SysWOW64\MSVCR100.dll Jump to behavior
Source: Binary string: P:\DocGeneratingSigning\ShellcodeDoc\DllLoaderShellcode\Build\RemoteDllLoader\Release-x32\RemoteDllLoader.pdb source: WINWORD.EXE, 00000000.00000000.348321457.000000001496F000.00000040.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.337697577.0000000014BF0000.00000040.00000001.00020000.00000000.sdmp
Source: Binary string: P:\DocGeneratingSigning\ShellcodeDoc\DllLoaderShellcode\Build\MemLoader\Release-x32\MemLoader.pdb source: WINWORD.EXE, 00000000.00000000.348321457.000000001496F000.00000040.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.337697577.0000000014BF0000.00000040.00000001.00020000.00000000.sdmp
Source: Binary string: P:\DocGeneratingSigning\ShellcodeDoc\DllLoaderShellcode\Build\RemoteDllLoader\Release-x32\RemoteDllLoader.pdb source: WINWORD.EXE, 00000000.00000000.348321457.000000001496F000.00000040.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.337697577.0000000014BF0000.00000040.00000001.00020000.00000000.sdmp
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\PROGRA~2\COMMON~1\MICROS~1\ Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\PROGRA~2\COMMON~1\ Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\Program Files (x86)\Common Files\Microsoft Shared\VBA\ Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\Program Files (x86)\Common Files\Microsoft Shared\VBA\VBA7.1\ Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\PROGRA~2\COMMON~1\MICROS~1\VBA\ Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\PROGRA~2\COMMON~1\MICROS~1\VBA\VBA7.1\ Jump to behavior
Source: WINWORD.EXE, 00000000.00000000.303139501.000000000B0EF000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.306148125.000000000D349000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.352872367.000000000B0EF000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: WINWORD.EXE, 00000000.00000000.344345051.0000000001A30000.00000002.00000001.00040000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.311307089.0000000001A30000.00000002.00000001.00040000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.352795200.0000000001A30000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: WINWORD.EXE, 00000000.00000000.344345051.0000000001A30000.00000002.00000001.00040000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.311307089.0000000001A30000.00000002.00000001.00040000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.352795200.0000000001A30000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: WINWORD.EXE, 00000000.00000000.344345051.0000000001A30000.00000002.00000001.00040000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.311307089.0000000001A30000.00000002.00000001.00040000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.352795200.0000000001A30000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: WINWORD.EXE, 00000000.00000000.344345051.0000000001A30000.00000002.00000001.00040000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.311307089.0000000001A30000.00000002.00000001.00040000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.352795200.0000000001A30000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: WProgram Manager
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 682599 Sample: cnewton doc 08.11.2022.doc Startdate: 11/08/2022 Architecture: WINDOWS Score: 80 21 Multi AV Scanner detection for submitted file 2->21 23 Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros) 2->23 25 Machine Learning detection for sample 2->25 27 2 other signatures 2->27 6 WINWORD.EXE 30 46 2->6         started        process3 dnsIp4 19 45.8.146.139, 49741, 80 VMAGE-ASRU Russian Federation 6->19 15 C:\Users\...\cnewton doc 08.11.2022.doc.LNK, MS 6->15 dropped 17 C:\Users\user\AppData\Local\...\y5A7.tmp.dll, HTML 6->17 dropped 29 Document exploit detected (creates forbidden files) 6->29 31 Document exploit detected (UrlDownloadToFile) 6->31 11 WerFault.exe 23 9 6->11         started        13 WerFault.exe 6->13         started        file5 signatures6 process7
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
45.8.146.139
 unknown Russian Federation
44676 VMAGE-ASRU false