Windows Analysis Report
valliant.document.08.11.2022.doc

Overview

General Information

Sample Name:	valliant.document.08.11.2022.doc
Analysis ID:	682606
MD5:	cadb9d5ed47b8df81a2addefed302a03
SHA1:	f7197fa991510f99f25af2b502c40d3b48d1abbc
SHA256:	9cb01729327bd958e32aa9481d5a81303627ab7a59b9ae134fb6600ef4e5b680
Tags:	docIcedID
Infos:

Errors Corrupt sample or wrongly selected analyzer.

Detection

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Document exploit detected (creates forbidden files)

Multi AV Scanner detection for submitted file

Document contains an embedded VBA macro with suspicious strings

Document exploit detected (process start blacklist hit)

Document exploit detected (UrlDownloadToFile)

Machine Learning detection for sample

One or more processes crash

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Document contains an embedded VBA macro which executes code when the document is opened / closed

Document contains embedded VBA macros

Potential document exploit detected (performs HTTP gets)

IP address seen in connection with other malware

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: valliant.document.08.11.2022.doc	Virustotal: Detection: 26%			Perma Link
Source: valliant.document.08.11.2022.doc	ReversingLabs: Detection: 18%

Machine Learning detection for sample

Source: valliant.document.08.11.2022.doc

Joe Sandbox ML: detected

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source:	Binary string: P:\DocGeneratingSigning\ShellcodeDoc\DllLoaderShellcode\Build\RemoteDllLoader\Release-x32\RemoteDllLoader.pdb source: WINWORD.EXE, 00000000.00000000.286197791.0000000014DE0000.00000040.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.304891180.00000000148D7000.00000040.00000001.00020000.00000000.sdmp
Source:	Binary string: P:\DocGeneratingSigning\ShellcodeDoc\DllLoaderShellcode\Build\MemLoader\Release-x32\MemLoader.pdb source: WINWORD.EXE, 00000000.00000000.286197791.0000000014DE0000.00000040.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.304891180.00000000148D7000.00000040.00000001.00020000.00000000.sdmp
Source:	Binary string: P:\DocGeneratingSigning\ShellcodeDoc\DllLoaderShellcode\Build\RemoteDllLoader\Release-x32\RemoteDllLoader.pdb source: WINWORD.EXE, 00000000.00000000.286197791.0000000014DE0000.00000040.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.304891180.00000000148D7000.00000040.00000001.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\PROGRA~2\COMMON~1\MICROS~1\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\PROGRA~2\COMMON~1\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\Program Files (x86)\Common Files\Microsoft Shared\VBA\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\Program Files (x86)\Common Files\Microsoft Shared\VBA\VBA7.1\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\PROGRA~2\COMMON~1\MICROS~1\VBA\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\PROGRA~2\COMMON~1\MICROS~1\VBA\VBA7.1\	Jump to behavior

Software Vulnerabilities

Document exploit detected (creates forbidden files)

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\yD159.tmp.dll

Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Process created: C:\Windows\SysWOW64\WerFault.exe

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Section loaded: unknown origin: URLDownloadToFileA

Jump to behavior

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.3:49741 -> 45.8.146.139:80
Source: global traffic	TCP traffic: 45.8.146.139:80 -> 192.168.2.3:49741
Source: global traffic	TCP traffic: 192.168.2.3:49741 -> 45.8.146.139:80
Source: global traffic	TCP traffic: 192.168.2.3:49741 -> 45.8.146.139:80
Source: global traffic	TCP traffic: 45.8.146.139:80 -> 192.168.2.3:49741
Source: global traffic	TCP traffic: 45.8.146.139:80 -> 192.168.2.3:49741
Source: global traffic	TCP traffic: 192.168.2.3:49741 -> 45.8.146.139:80
Source: global traffic	TCP traffic: 45.8.146.139:80 -> 192.168.2.3:49741
Source: global traffic	TCP traffic: 192.168.2.3:49741 -> 45.8.146.139:80
Source: global traffic	TCP traffic: 192.168.2.3:49741 -> 45.8.146.139:80

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.3:49741 -> 45.8.146.139:80

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /fhfty/SKWR8YXON-RX9R4781JWMO3UUH0NGDBO/-f HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 45.8.146.139Connection: Keep-Alive

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 45.8.146.139 45.8.146.139

Source: unknown	TCP traffic detected without corresponding DNS query: 45.8.146.139
Source: unknown	TCP traffic detected without corresponding DNS query: 45.8.146.139
Source: unknown	TCP traffic detected without corresponding DNS query: 45.8.146.139
Source: unknown	TCP traffic detected without corresponding DNS query: 45.8.146.139
Source: unknown	TCP traffic detected without corresponding DNS query: 45.8.146.139
Source: unknown	TCP traffic detected without corresponding DNS query: 45.8.146.139

Source: WINWORD.EXE, 00000000.00000000.298474157.00000000127EC000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.268127860.000000000DD5A000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.291945137.000000000DD5A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://45.8.146.139/
Source: WINWORD.EXE, 00000000.00000000.298474157.00000000127EC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://45.8.146.139/8YXON-RX9R4781JWMO3UUH0NGDBO/-f
Source: WINWORD.EXE, 00000000.00000000.268334868.000000000DDD1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://45.8.146.139/fhfty/SKWR8YXON-RX9R4781JWMO3UUH0NGDBO/-f
Source: WINWORD.EXE, 00000000.00000000.291653462.000000000DCF7000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267974065.000000000DCF7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://45.8.146.139/fhfty/SKWR8YXON-RX9R4781JWMO3UUH0NGDBO/-f71USERNAME=userUSERPROFILE=C:
Source: WINWORD.EXE, 00000000.00000000.279533534.00000000127CF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://45.8.146.139/fhfty/SKWR8YXON-RX9R4781JWMO3UUH0NGDBO/-f:
Source: WINWORD.EXE, 00000000.00000000.268298008.000000000DDB6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://45.8.146.139/fhfty/SKWR8YXON-RX9R4781JWMO3UUH0NGDBO/-fC:
Source: WINWORD.EXE, 00000000.00000000.299025740.000000000D0BF000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.265671015.000000000D0BF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://45.8.146.139/fhfty/SKWR8YXON-RX9R4781JWMO3UUH0NGDBO/-fLMEM
Source: WINWORD.EXE, 00000000.00000000.299992544.000000000D27B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://45.8.146.139/fhfty/SKWR8YXON-RX9R4781JWMO3UUH0NGDBO/-fOOC:
Source: WINWORD.EXE, 00000000.00000000.290613577.000000000DBD9000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267559667.000000000DBD9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://45.8.146.139/fhfty/SKWR8YXON-RX9R4781JWMO3UUH0NGDBO/-fR
Source: WINWORD.EXE, 00000000.00000000.290613577.000000000DBD9000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267559667.000000000DBD9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://45.8.146.139/fhfty/SKWR8YXON-RX9R4781JWMO3UUH0NGDBO/-fc
Source: WINWORD.EXE, 00000000.00000000.290613577.000000000DBD9000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267559667.000000000DBD9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://45.8.146.139/fhfty/SKWR8YXON-RX9R4781JWMO3UUH0NGDBO/-fq
Source: WINWORD.EXE, 00000000.00000000.290613577.000000000DBD9000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267559667.000000000DBD9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://45.8.146.139/fhfty/SKWR8YXON-RX9R4781JWMO3UUH0NGDBO/-fv
Source: WINWORD.EXE, 00000000.00000000.298337380.0000000012780000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://45.8.146.139/fhfty/SKWR8YXON-RX9R4781JWMO3UUH0NGDBO/-fw
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://b.c2r.ts.cdn.office.net/prpoint
Source: WINWORD.EXE, 00000000.00000000.299778746.000000000D211000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266222017.000000000D211000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/prpoint
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: WINWORD.EXE, 00000000.00000000.289192987.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266167152.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glidesr
Source: WINWORD.EXE, 00000000.00000000.296099721.000000000B3DE000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.263614877.000000000B3DE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/drawingml/diagram823
Source: WINWORD.EXE, 00000000.00000000.296099721.000000000B3DE000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.263614877.000000000B3DE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/drawingml/table
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionloggingTZ
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticatedp
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/queryI
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/removevV
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://analysis.windows.net/powerbi/api3
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://analysis.windows.net/powerbi/apiU
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechE
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.aadrm.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.cortana.ai
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.diagnostics.office.comnq
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedbackD
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.diagnosticssdf.office.comXm
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.microsoftstream.com/api/=r
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.office.net
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.office.netC
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.office.net_
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.onedrive.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets_
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://augloop.office.com
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://augloop.office.com/v2(
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://augloop.office.com/v2G
Source: WINWORD.EXE, 00000000.00000000.267335179.000000000DAE6000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.290124050.000000000DAE6000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: WINWORD.EXE, 00000000.00000000.299025740.000000000D0BF000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.265671015.000000000D0BF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml=3s
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://cdn.entity.
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.pngHH
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: WINWORD.EXE, 00000000.00000000.289192987.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266167152.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsellnt
Source: WINWORD.EXE, 00000000.00000000.289192987.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266167152.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://clients.config.office.net/&sC
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallationGZ
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://clients.config.office.net/ds
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://clients.config.office.net/is
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://clients.config.office.net/user/v1.0/iosE
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://clients.config.office.net/user/v1.0/mack
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkeymx
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkeynH6
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://config.edge.skype.comK
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://cortana.ai
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://cortana.ai/api
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cortana.aietl
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://cr.office.com
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dataservice.o365filtering.com)n0
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dataservice.o365filtering.com/Ep
Source: WINWORD.EXE, 00000000.00000000.289192987.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266167152.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dataservice.o365filtering.com/ym
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dataservice.o365filtering.com2p7
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dataservice.o365filtering.com6m3
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dataservice.o365filtering.comMq
Source: WINWORD.EXE, 00000000.00000000.289192987.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266167152.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: WINWORD.EXE, 00000000.00000000.299221788.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.265756794.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dev0-api.acompli.net/autodetecttm
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://directory.services.
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1WQ
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1VP
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/=Ig
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: WINWORD.EXE, 00000000.00000000.289192987.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266167152.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.jsonb
Source: WINWORD.EXE, 00000000.00000000.289192987.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266167152.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: WINWORD.EXE, 00000000.00000000.289192987.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266167152.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://enrichment.osi.office.net/fp
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://entitlement.diagnostics.office.comS
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://entity.osi.office.net/t
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech)
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-androidv.
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://globaldisco.crm.dynamics.comom
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://graph.ppe.windows.net/%
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://graph.windows.net
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://graph.windows.net/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://graph.windows.net/e
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://graph.windows.net:
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://hubble.officeapps.live.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://hubble.officeapps.live.com?
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://hubble.officeapps.live.comT
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://hubble.officeapps.live.com~
Source: WINWORD.EXE, 00000000.00000000.290115292.000000000DADE000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1;
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: WINWORD.EXE, 00000000.00000000.290115292.000000000DADE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?Gc
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://inclient.store.office.com/gyro/clientM
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore?
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=ImmersiveApp
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: WINWORD.EXE, 00000000.00000000.289192987.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266167152.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bingript
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: WINWORD.EXE, 00000000.00000000.299221788.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.265756794.000000000D11D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArts.dll_
Source: WINWORD.EXE, 00000000.00000000.299221788.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.265756794.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: WINWORD.EXE, 00000000.00000000.289192987.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266167152.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: WINWORD.EXE, 00000000.00000000.299221788.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.265756794.000000000D11D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrivey
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://invites.office.com/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://invites.office.com/v
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: WINWORD.EXE, 00000000.00000000.302831274.000000000DCD1000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267878607.000000000DCD1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/m)
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorizeMz
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorizes
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://login.windows.local
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.localtesB3
Source: WINWORD.EXE, 00000000.00000000.298963829.000000000D096000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.265566787.000000000D096000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorize&zJ
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorize(
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorize)t7
Source: WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorize-
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorize/_
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorize0_
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorize8z(
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorize:t&
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorize;
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorize;u%
Source: WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorize=
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorize?
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeA$
Source: WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeB
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeB%
Source: WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeC
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeE_
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeF
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeH
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeN
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeOt
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizePt
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeQu
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeR
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeR$
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeS
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeW
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeX
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeY
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeb
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizecom
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorized
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeficr&
Source: WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeize
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizel
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizen
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizenu
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeo
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizep
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizep$
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeq
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeq%
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizer
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizet_
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeteT
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeu
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizev
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorize~t
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/.
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://management.azure.com
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://management.azure.com/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://management.azure.com/t
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://messaging.action.office.com/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://messaging.action.office.com/setuseraction16A
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregatorjZ
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://messaging.office.com/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: WINWORD.EXE, 00000000.00000000.299025740.000000000D0BF000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.265671015.000000000D0BF000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechA
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: WINWORD.EXE, 00000000.00000000.299221788.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.265756794.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://nexus.officeapps.live.com
Source: WINWORD.EXE, 00000000.00000000.289322705.000000000D24F000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266526921.000000000D24F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://nexus.officeapps.live.com/G
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://nexus.officeapps.live.com/nexus/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://nexus.officeapps.live.com/nexus/rules
Source: WINWORD.EXE, 00000000.00000000.266497071.000000000D23F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://nexus.officeapps.live.com/nexus/rules?Application=winword.exe&Version=16.0.4954.1000&ClientI
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord8
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://officeapps.live.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.com$7
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.com071
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.com:67
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.comD6
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.comF0
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.comJ6
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.comL0
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.comP6
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.comR0
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.comV7
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.comh6
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.comj0
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.comn7
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.comp0
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.comt7
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.comz7
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.com~6
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeci.azurewebsites.net/api/;m
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdateddll
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://onedrive.live.com
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false-
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/embed?i
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.comrts#
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://osi.office.net
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://osi.office.net$aC
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://osi.office.net6a1
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://osi.office.neta
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://osi.office.netna
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://osi.office.netst
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.290115292.000000000DADE000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://outlook.office.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office.com&
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://outlook.office.com/
Source: WINWORD.EXE, 00000000.00000000.299221788.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.265756794.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office.comR
Source: WINWORD.EXE, 00000000.00000000.290115292.000000000DADE000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://outlook.office365.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activitiesr
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.jsonV
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office365.com/d0
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/V_
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlookc
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspxS
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: WINWORD.EXE, 00000000.00000000.299221788.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.265756794.000000000D11D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptionsF
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: WINWORD.EXE, 00000000.00000000.289192987.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266167152.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json00
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.jsonp
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13db8
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetectU
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectoryTV
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://roaming.edog.
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://settings.outlook.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://settings.outlook.comS
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://store.office.cn/addinstemplateFl
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://substrate.office.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://substrate.office.com/Todo-Internal.ReadWrite.
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://substrate.office.comN
Source: WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://substrate.office.comP
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://substrate.office.comV
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://substrate.office.comW
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://substrate.office.comp
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: WINWORD.EXE, 00000000.00000000.289192987.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266167152.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFiley
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://tasks.office.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://tellmeservice.osi.office.netst
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: WINWORD.EXE, 00000000.00000000.289192987.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266167152.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: WINWORD.EXE, 00000000.00000000.299221788.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.265756794.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://web.microsoftstream.com/video/#rF
Source: WINWORD.EXE, 00000000.00000000.289192987.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266167152.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: WINWORD.EXE, 00000000.00000000.299221788.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.265756794.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.odwebp.svc.msm

Source: global traffic

System Summary

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable editing" button on W a the top bar, and then click "Enable content". p gb .Lm"^. - . 0
Source: Screenshot number: 4	Screenshot OCR: Enable content". p gb .Lm"^. - . 0 PO I ' am Vk b4 r H m % I i '00% O Type here to sear

Document contains an embedded VBA macro with suspicious strings

Source: valliant.document.08.11.2022.doc	OLE, VBA macro line: Private Declare PtrSafe Function Lib "kernel32" Alias "VirtualProtect" (ByVal As LongPtr, ByVal As LongPtr, ByVal As LongPtr, As LongPtr) As LongPtr
Source: valliant.document.08.11.2022.doc	OLE, VBA macro line: Set = CallByName((), tITeCC_iA6p("evEOscajIaM"), VbGet, )
Source: valliant.document.08.11.2022.doc	OLE, VBA macro line: Set = CallByName((tITeCC_iA6p("ArNmaAhd3cdR")), tITeCC_iA6p("BCdu5uMzXrdf"), VbGet, tITeCC_iA6p("exLSMEco"))
Source: valliant.document.08.11.2022.doc	OLE, VBA macro line: Set = CallByName((), tITeCC_iA6p("VYLYrWqAG19hy"), VbGet, )

One or more processes crash

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 4128

Document contains an embedded VBA macro which executes code when the document is opened / closed

Source: valliant.document.08.11.2022.doc

OLE, VBA macro line: Private Sub Document_Open()

Document contains embedded VBA macros

Source: valliant.document.08.11.2022.doc

OLE indicator, VBA macros: true

Source: valliant.document.08.11.2022.doc	Virustotal: Detection: 26%
Source: valliant.document.08.11.2022.doc	ReversingLabs: Detection: 18%

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 4128
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 4132

Source: valliant.document.08.11.2022.doc.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\valliant.document.08.11.2022.doc

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2908

Source: valliant.document.08.11.2022.doc

OLE indicator, Word Document stream: true

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{8011A935-294F-4F63-BF68-112F881F16E0} - OProcSessId.dat

Jump to behavior

Source: classification engine

Classification label: mal80.expl.winDOC@3/11@0/2

Source: valliant.document.08.11.2022.doc	OLE document summary: title field not present or empty
Source: valliant.document.08.11.2022.doc	OLE document summary: author field not present or empty
Source: valliant.document.08.11.2022.doc	OLE document summary: edited time not present or 0

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: valliant.document.08.11.2022.doc

Initial sample: OLE zip file path = docProps/custom.xml

Source: valliant.document.08.11.2022.doc

Static file information: File size 2316502 > 1048576

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source:	Binary string: P:\DocGeneratingSigning\ShellcodeDoc\DllLoaderShellcode\Build\RemoteDllLoader\Release-x32\RemoteDllLoader.pdb source: WINWORD.EXE, 00000000.00000000.286197791.0000000014DE0000.00000040.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.304891180.00000000148D7000.00000040.00000001.00020000.00000000.sdmp
Source:	Binary string: P:\DocGeneratingSigning\ShellcodeDoc\DllLoaderShellcode\Build\MemLoader\Release-x32\MemLoader.pdb source: WINWORD.EXE, 00000000.00000000.286197791.0000000014DE0000.00000040.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.304891180.00000000148D7000.00000040.00000001.00020000.00000000.sdmp
Source:	Binary string: P:\DocGeneratingSigning\ShellcodeDoc\DllLoaderShellcode\Build\RemoteDllLoader\Release-x32\RemoteDllLoader.pdb source: WINWORD.EXE, 00000000.00000000.286197791.0000000014DE0000.00000040.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.304891180.00000000148D7000.00000040.00000001.00020000.00000000.sdmp

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\PROGRA~2\COMMON~1\MICROS~1\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\PROGRA~2\COMMON~1\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\Program Files (x86)\Common Files\Microsoft Shared\VBA\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\Program Files (x86)\Common Files\Microsoft Shared\VBA\VBA7.1\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\PROGRA~2\COMMON~1\MICROS~1\VBA\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\PROGRA~2\COMMON~1\MICROS~1\VBA\VBA7.1\	Jump to behavior

Source: WINWORD.EXE, 00000000.00000000.265780649.000000000D129000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.288935152.000000000D129000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: WINWORD.EXE, 00000000.00000000.289016717.000000000D17B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: WINWORD.EXE, 00000000.00000000.296099721.000000000B3DE000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.263614877.000000000B3DE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: WINWORD.EXE, 00000000.00000000.259111820.0000000001C20000.00000002.00000001.00040000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.280547961.0000000001C20000.00000002.00000001.00040000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.289832763.0000000001C20000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: WINWORD.EXE, 00000000.00000000.259111820.0000000001C20000.00000002.00000001.00040000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.280547961.0000000001C20000.00000002.00000001.00040000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.289832763.0000000001C20000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: WINWORD.EXE, 00000000.00000000.259111820.0000000001C20000.00000002.00000001.00040000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.280547961.0000000001C20000.00000002.00000001.00040000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.289832763.0000000001C20000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: WINWORD.EXE, 00000000.00000000.259111820.0000000001C20000.00000002.00000001.00040000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.280547961.0000000001C20000.00000002.00000001.00040000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.289832763.0000000001C20000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: WProgram Manager

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.8.146.139	unknown	Russian Federation		44676	VMAGE-ASRU	false

Private

IP
192.168.2.1

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://45.8.146.139/fhfty/SKWR8YXON-RX9R4781JWMO3UUH0NGDBO/-f	false	Avira URL Cloud: safe	unknown

AV Detection

Multi AV Scanner detection for submitted file

Source: valliant.document.08.11.2022.doc	Virustotal: Detection: 26%			Perma Link
Source: valliant.document.08.11.2022.doc	ReversingLabs: Detection: 18%

Machine Learning detection for sample

Source: valliant.document.08.11.2022.doc

Joe Sandbox ML: detected

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source:	Binary string: P:\DocGeneratingSigning\ShellcodeDoc\DllLoaderShellcode\Build\RemoteDllLoader\Release-x32\RemoteDllLoader.pdb source: WINWORD.EXE, 00000000.00000000.286197791.0000000014DE0000.00000040.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.304891180.00000000148D7000.00000040.00000001.00020000.00000000.sdmp
Source:	Binary string: P:\DocGeneratingSigning\ShellcodeDoc\DllLoaderShellcode\Build\MemLoader\Release-x32\MemLoader.pdb source: WINWORD.EXE, 00000000.00000000.286197791.0000000014DE0000.00000040.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.304891180.00000000148D7000.00000040.00000001.00020000.00000000.sdmp
Source:	Binary string: P:\DocGeneratingSigning\ShellcodeDoc\DllLoaderShellcode\Build\RemoteDllLoader\Release-x32\RemoteDllLoader.pdb source: WINWORD.EXE, 00000000.00000000.286197791.0000000014DE0000.00000040.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.304891180.00000000148D7000.00000040.00000001.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\PROGRA~2\COMMON~1\MICROS~1\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\PROGRA~2\COMMON~1\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\Program Files (x86)\Common Files\Microsoft Shared\VBA\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\Program Files (x86)\Common Files\Microsoft Shared\VBA\VBA7.1\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\PROGRA~2\COMMON~1\MICROS~1\VBA\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\PROGRA~2\COMMON~1\MICROS~1\VBA\VBA7.1\	Jump to behavior

Software Vulnerabilities

Document exploit detected (creates forbidden files)

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\yD159.tmp.dll

Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Process created: C:\Windows\SysWOW64\WerFault.exe

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Section loaded: unknown origin: URLDownloadToFileA

Jump to behavior

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.3:49741 -> 45.8.146.139:80
Source: global traffic	TCP traffic: 45.8.146.139:80 -> 192.168.2.3:49741
Source: global traffic	TCP traffic: 192.168.2.3:49741 -> 45.8.146.139:80
Source: global traffic	TCP traffic: 192.168.2.3:49741 -> 45.8.146.139:80
Source: global traffic	TCP traffic: 45.8.146.139:80 -> 192.168.2.3:49741
Source: global traffic	TCP traffic: 45.8.146.139:80 -> 192.168.2.3:49741
Source: global traffic	TCP traffic: 192.168.2.3:49741 -> 45.8.146.139:80
Source: global traffic	TCP traffic: 45.8.146.139:80 -> 192.168.2.3:49741
Source: global traffic	TCP traffic: 192.168.2.3:49741 -> 45.8.146.139:80
Source: global traffic	TCP traffic: 192.168.2.3:49741 -> 45.8.146.139:80

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.3:49741 -> 45.8.146.139:80

Uses a known web browser user agent for HTTP communication

Source: global traffic

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 45.8.146.139 45.8.146.139

Source: unknown	TCP traffic detected without corresponding DNS query: 45.8.146.139
Source: unknown	TCP traffic detected without corresponding DNS query: 45.8.146.139
Source: unknown	TCP traffic detected without corresponding DNS query: 45.8.146.139
Source: unknown	TCP traffic detected without corresponding DNS query: 45.8.146.139
Source: unknown	TCP traffic detected without corresponding DNS query: 45.8.146.139
Source: unknown	TCP traffic detected without corresponding DNS query: 45.8.146.139

Source: WINWORD.EXE, 00000000.00000000.298474157.00000000127EC000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.268127860.000000000DD5A000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.291945137.000000000DD5A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://45.8.146.139/
Source: WINWORD.EXE, 00000000.00000000.298474157.00000000127EC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://45.8.146.139/8YXON-RX9R4781JWMO3UUH0NGDBO/-f
Source: WINWORD.EXE, 00000000.00000000.268334868.000000000DDD1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://45.8.146.139/fhfty/SKWR8YXON-RX9R4781JWMO3UUH0NGDBO/-f
Source: WINWORD.EXE, 00000000.00000000.291653462.000000000DCF7000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267974065.000000000DCF7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://45.8.146.139/fhfty/SKWR8YXON-RX9R4781JWMO3UUH0NGDBO/-f71USERNAME=userUSERPROFILE=C:
Source: WINWORD.EXE, 00000000.00000000.279533534.00000000127CF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://45.8.146.139/fhfty/SKWR8YXON-RX9R4781JWMO3UUH0NGDBO/-f:
Source: WINWORD.EXE, 00000000.00000000.268298008.000000000DDB6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://45.8.146.139/fhfty/SKWR8YXON-RX9R4781JWMO3UUH0NGDBO/-fC:
Source: WINWORD.EXE, 00000000.00000000.299025740.000000000D0BF000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.265671015.000000000D0BF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://45.8.146.139/fhfty/SKWR8YXON-RX9R4781JWMO3UUH0NGDBO/-fLMEM
Source: WINWORD.EXE, 00000000.00000000.299992544.000000000D27B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://45.8.146.139/fhfty/SKWR8YXON-RX9R4781JWMO3UUH0NGDBO/-fOOC:
Source: WINWORD.EXE, 00000000.00000000.290613577.000000000DBD9000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267559667.000000000DBD9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://45.8.146.139/fhfty/SKWR8YXON-RX9R4781JWMO3UUH0NGDBO/-fR
Source: WINWORD.EXE, 00000000.00000000.290613577.000000000DBD9000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267559667.000000000DBD9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://45.8.146.139/fhfty/SKWR8YXON-RX9R4781JWMO3UUH0NGDBO/-fc
Source: WINWORD.EXE, 00000000.00000000.290613577.000000000DBD9000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267559667.000000000DBD9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://45.8.146.139/fhfty/SKWR8YXON-RX9R4781JWMO3UUH0NGDBO/-fq
Source: WINWORD.EXE, 00000000.00000000.290613577.000000000DBD9000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267559667.000000000DBD9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://45.8.146.139/fhfty/SKWR8YXON-RX9R4781JWMO3UUH0NGDBO/-fv
Source: WINWORD.EXE, 00000000.00000000.298337380.0000000012780000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://45.8.146.139/fhfty/SKWR8YXON-RX9R4781JWMO3UUH0NGDBO/-fw
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://b.c2r.ts.cdn.office.net/prpoint
Source: WINWORD.EXE, 00000000.00000000.299778746.000000000D211000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266222017.000000000D211000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/prpoint
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: WINWORD.EXE, 00000000.00000000.289192987.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266167152.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glidesr
Source: WINWORD.EXE, 00000000.00000000.296099721.000000000B3DE000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.263614877.000000000B3DE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/drawingml/diagram823
Source: WINWORD.EXE, 00000000.00000000.296099721.000000000B3DE000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.263614877.000000000B3DE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://purl.oclc.org/ooxml/drawingml/table
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionloggingTZ
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticatedp
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/queryI
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/removevV
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://analysis.windows.net/powerbi/api3
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://analysis.windows.net/powerbi/apiU
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechE
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.aadrm.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.cortana.ai
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.diagnostics.office.comnq
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedbackD
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.diagnosticssdf.office.comXm
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.microsoftstream.com/api/=r
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.office.net
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.office.netC
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.office.net_
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.onedrive.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets_
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://augloop.office.com
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://augloop.office.com/v2(
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://augloop.office.com/v2G
Source: WINWORD.EXE, 00000000.00000000.267335179.000000000DAE6000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.290124050.000000000DAE6000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: WINWORD.EXE, 00000000.00000000.299025740.000000000D0BF000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.265671015.000000000D0BF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml=3s
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://cdn.entity.
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.pngHH
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: WINWORD.EXE, 00000000.00000000.289192987.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266167152.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsellnt
Source: WINWORD.EXE, 00000000.00000000.289192987.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266167152.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://clients.config.office.net/&sC
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallationGZ
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://clients.config.office.net/ds
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://clients.config.office.net/is
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://clients.config.office.net/user/v1.0/iosE
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://clients.config.office.net/user/v1.0/mack
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkeymx
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkeynH6
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://config.edge.skype.comK
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://cortana.ai
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://cortana.ai/api
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cortana.aietl
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://cr.office.com
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dataservice.o365filtering.com)n0
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dataservice.o365filtering.com/Ep
Source: WINWORD.EXE, 00000000.00000000.289192987.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266167152.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dataservice.o365filtering.com/ym
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dataservice.o365filtering.com2p7
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dataservice.o365filtering.com6m3
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dataservice.o365filtering.comMq
Source: WINWORD.EXE, 00000000.00000000.289192987.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266167152.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: WINWORD.EXE, 00000000.00000000.299221788.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.265756794.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dev0-api.acompli.net/autodetecttm
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://directory.services.
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1WQ
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1VP
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/=Ig
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: WINWORD.EXE, 00000000.00000000.289192987.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266167152.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.jsonb
Source: WINWORD.EXE, 00000000.00000000.289192987.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266167152.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: WINWORD.EXE, 00000000.00000000.289192987.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266167152.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://enrichment.osi.office.net/fp
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://entitlement.diagnostics.office.comS
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://entity.osi.office.net/t
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech)
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-androidv.
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://globaldisco.crm.dynamics.comom
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://graph.ppe.windows.net/%
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://graph.windows.net
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://graph.windows.net/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://graph.windows.net/e
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://graph.windows.net:
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://hubble.officeapps.live.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://hubble.officeapps.live.com?
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://hubble.officeapps.live.comT
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://hubble.officeapps.live.com~
Source: WINWORD.EXE, 00000000.00000000.290115292.000000000DADE000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1;
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: WINWORD.EXE, 00000000.00000000.290115292.000000000DADE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?Gc
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://inclient.store.office.com/gyro/clientM
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore?
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=ImmersiveApp
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: WINWORD.EXE, 00000000.00000000.289192987.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266167152.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bingript
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: WINWORD.EXE, 00000000.00000000.299221788.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.265756794.000000000D11D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArts.dll_
Source: WINWORD.EXE, 00000000.00000000.299221788.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.265756794.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: WINWORD.EXE, 00000000.00000000.289192987.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266167152.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: WINWORD.EXE, 00000000.00000000.299221788.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.265756794.000000000D11D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrivey
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://invites.office.com/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://invites.office.com/v
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: WINWORD.EXE, 00000000.00000000.302831274.000000000DCD1000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267878607.000000000DCD1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/m)
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorizeMz
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorizes
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://login.windows.local
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.localtesB3
Source: WINWORD.EXE, 00000000.00000000.298963829.000000000D096000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.265566787.000000000D096000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorize&zJ
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorize(
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorize)t7
Source: WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorize-
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorize/_
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorize0_
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorize8z(
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorize:t&
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorize;
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorize;u%
Source: WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorize=
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorize?
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeA$
Source: WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeB
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeB%
Source: WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeC
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeE_
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeF
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeH
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeN
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeOt
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizePt
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeQu
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeR
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeR$
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeS
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeW
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeX
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeY
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeb
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizecom
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorized
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeficr&
Source: WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeize
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizel
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizen
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizenu
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeo
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizep
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizep$
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeq
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeq%
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizer
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizet_
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeteT
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizeu
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorizev
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/common/oauth2/authorize~t
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/.
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://management.azure.com
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://management.azure.com/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://management.azure.com/t
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://messaging.action.office.com/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://messaging.action.office.com/setuseraction16A
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregatorjZ
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://messaging.office.com/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: WINWORD.EXE, 00000000.00000000.299025740.000000000D0BF000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.265671015.000000000D0BF000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechA
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: WINWORD.EXE, 00000000.00000000.299221788.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.265756794.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://nexus.officeapps.live.com
Source: WINWORD.EXE, 00000000.00000000.289322705.000000000D24F000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266526921.000000000D24F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://nexus.officeapps.live.com/G
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://nexus.officeapps.live.com/nexus/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://nexus.officeapps.live.com/nexus/rules
Source: WINWORD.EXE, 00000000.00000000.266497071.000000000D23F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://nexus.officeapps.live.com/nexus/rules?Application=winword.exe&Version=16.0.4954.1000&ClientI
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord8
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://officeapps.live.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.com$7
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.com071
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.com:67
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.comD6
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.comF0
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.comJ6
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.comL0
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.comP6
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.comR0
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.comV7
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.comh6
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.comj0
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.comn7
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.comp0
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.comt7
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.comz7
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.com~6
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://officeci.azurewebsites.net/api/;m
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdateddll
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://onedrive.live.com
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false-
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/embed?i
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.comrts#
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://osi.office.net
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://osi.office.net$aC
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://osi.office.net6a1
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://osi.office.neta
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://osi.office.netna
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://osi.office.netst
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.290115292.000000000DADE000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://outlook.office.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office.com&
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://outlook.office.com/
Source: WINWORD.EXE, 00000000.00000000.299221788.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.265756794.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office.comR
Source: WINWORD.EXE, 00000000.00000000.290115292.000000000DADE000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://outlook.office365.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activitiesr
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.jsonV
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office365.com/d0
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/V_
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlookc
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspxS
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: WINWORD.EXE, 00000000.00000000.299221788.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.265756794.000000000D11D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptionsF
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: WINWORD.EXE, 00000000.00000000.289192987.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266167152.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json00
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.jsonp
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13db8
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetectU
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectoryTV
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://roaming.edog.
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://settings.outlook.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://settings.outlook.comS
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://store.office.cn/addinstemplateFl
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://substrate.office.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://substrate.office.com/Todo-Internal.ReadWrite.
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://substrate.office.comN
Source: WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://substrate.office.comP
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://substrate.office.comV
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://substrate.office.comW
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://substrate.office.comp
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: WINWORD.EXE, 00000000.00000000.289192987.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266167152.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFiley
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://tasks.office.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://tellmeservice.osi.office.netst
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: WINWORD.EXE, 00000000.00000000.289192987.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266167152.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: WINWORD.EXE, 00000000.00000000.299221788.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.265756794.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://web.microsoftstream.com/video/#rF
Source: WINWORD.EXE, 00000000.00000000.289192987.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.266167152.000000000D1FB000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: WINWORD.EXE, 00000000.00000000.299221788.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.265756794.000000000D11D000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: WINWORD.EXE, 00000000.00000000.300743360.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267141726.000000000DA70000.00000004.00000001.00020000.00000000.sdmp, 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 2687EECC-4F43-442C-AA69-7E12CA414CA2.0.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: WINWORD.EXE, 00000000.00000000.290169035.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.267363427.000000000DAFD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.odwebp.svc.msm

Source: global traffic

System Summary

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable editing" button on W a the top bar, and then click "Enable content". p gb .Lm"^. - . 0
Source: Screenshot number: 4	Screenshot OCR: Enable content". p gb .Lm"^. - . 0 PO I ' am Vk b4 r H m % I i '00% O Type here to sear

Document contains an embedded VBA macro with suspicious strings

Source: valliant.document.08.11.2022.doc	OLE, VBA macro line: Private Declare PtrSafe Function Lib "kernel32" Alias "VirtualProtect" (ByVal As LongPtr, ByVal As LongPtr, ByVal As LongPtr, As LongPtr) As LongPtr
Source: valliant.document.08.11.2022.doc	OLE, VBA macro line: Set = CallByName((), tITeCC_iA6p("evEOscajIaM"), VbGet, )
Source: valliant.document.08.11.2022.doc	OLE, VBA macro line: Set = CallByName((tITeCC_iA6p("ArNmaAhd3cdR")), tITeCC_iA6p("BCdu5uMzXrdf"), VbGet, tITeCC_iA6p("exLSMEco"))
Source: valliant.document.08.11.2022.doc	OLE, VBA macro line: Set = CallByName((), tITeCC_iA6p("VYLYrWqAG19hy"), VbGet, )

One or more processes crash

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 4128

Document contains an embedded VBA macro which executes code when the document is opened / closed

Source: valliant.document.08.11.2022.doc

OLE, VBA macro line: Private Sub Document_Open()

Document contains embedded VBA macros

Source: valliant.document.08.11.2022.doc

OLE indicator, VBA macros: true

Source: valliant.document.08.11.2022.doc	Virustotal: Detection: 26%
Source: valliant.document.08.11.2022.doc	ReversingLabs: Detection: 18%

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 4128
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 4132

Source: valliant.document.08.11.2022.doc.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\valliant.document.08.11.2022.doc

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2908

Source: valliant.document.08.11.2022.doc

OLE indicator, Word Document stream: true

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{8011A935-294F-4F63-BF68-112F881F16E0} - OProcSessId.dat

Jump to behavior

Source: classification engine

Classification label: mal80.expl.winDOC@3/11@0/2

Source: valliant.document.08.11.2022.doc	OLE document summary: title field not present or empty
Source: valliant.document.08.11.2022.doc	OLE document summary: author field not present or empty
Source: valliant.document.08.11.2022.doc	OLE document summary: edited time not present or 0

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: valliant.document.08.11.2022.doc

Initial sample: OLE zip file path = docProps/custom.xml

Source: valliant.document.08.11.2022.doc

Static file information: File size 2316502 > 1048576

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source:	Binary string: P:\DocGeneratingSigning\ShellcodeDoc\DllLoaderShellcode\Build\RemoteDllLoader\Release-x32\RemoteDllLoader.pdb source: WINWORD.EXE, 00000000.00000000.286197791.0000000014DE0000.00000040.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.304891180.00000000148D7000.00000040.00000001.00020000.00000000.sdmp
Source:	Binary string: P:\DocGeneratingSigning\ShellcodeDoc\DllLoaderShellcode\Build\MemLoader\Release-x32\MemLoader.pdb source: WINWORD.EXE, 00000000.00000000.286197791.0000000014DE0000.00000040.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.304891180.00000000148D7000.00000040.00000001.00020000.00000000.sdmp
Source:	Binary string: P:\DocGeneratingSigning\ShellcodeDoc\DllLoaderShellcode\Build\RemoteDllLoader\Release-x32\RemoteDllLoader.pdb source: WINWORD.EXE, 00000000.00000000.286197791.0000000014DE0000.00000040.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.304891180.00000000148D7000.00000040.00000001.00020000.00000000.sdmp

Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\PROGRA~2\COMMON~1\MICROS~1\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\PROGRA~2\COMMON~1\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\Program Files (x86)\Common Files\Microsoft Shared\VBA\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\Program Files (x86)\Common Files\Microsoft Shared\VBA\VBA7.1\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\PROGRA~2\COMMON~1\MICROS~1\VBA\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\PROGRA~2\COMMON~1\MICROS~1\VBA\VBA7.1\	Jump to behavior

Source: WINWORD.EXE, 00000000.00000000.265780649.000000000D129000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.288935152.000000000D129000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: WINWORD.EXE, 00000000.00000000.289016717.000000000D17B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: WINWORD.EXE, 00000000.00000000.296099721.000000000B3DE000.00000004.00000001.00020000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.263614877.000000000B3DE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: WINWORD.EXE, 00000000.00000000.259111820.0000000001C20000.00000002.00000001.00040000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.280547961.0000000001C20000.00000002.00000001.00040000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.289832763.0000000001C20000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: WINWORD.EXE, 00000000.00000000.259111820.0000000001C20000.00000002.00000001.00040000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.280547961.0000000001C20000.00000002.00000001.00040000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.289832763.0000000001C20000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: WINWORD.EXE, 00000000.00000000.259111820.0000000001C20000.00000002.00000001.00040000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.280547961.0000000001C20000.00000002.00000001.00040000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.289832763.0000000001C20000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: WINWORD.EXE, 00000000.00000000.259111820.0000000001C20000.00000002.00000001.00040000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.280547961.0000000001C20000.00000002.00000001.00040000.00000000.sdmp, WINWORD.EXE, 00000000.00000000.289832763.0000000001C20000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: WProgram Manager

ID:	682606
Product:	CloudBasic
Start time:	18:57:37
Start date:	11.08.2022
Sample:	valliant.document.08.11.2022.doc
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	cadb9d5ed47b8df81a2addefed302a03
SHA1:	f7197fa991510f99f25af2b502c40d3b48d1abbc
SHA256:	9cb01729327bd958e32aa9481d5a81303627ab7a59b9ae134fb6600ef4e5b680
Filetype:	Word Microsoft Office Open XML Format document (49504/1) 49.01%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_WINWORD.EXE_2bb258ba8dfc7dfa5c63c367cd77571e93c8305c_5f94c319_0841aa39\Report.wer	Little-endian UTF-16 Unicode text, with CRLF line terminators	AC6EEF4FA3F48FD8D1EFE0C61C9404E6	2CF87F041CDFFFC1E6FFA75C936F0CC726F62460	CAB32F91FCE62092D1FB0AEAF4E7124F7BB45686540A1C5AD1BA0088843FAF79
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8FDB.tmp.dmp	Mini DuMP crash report, 15 streams, Fri Aug 12 01:59:11 2022, 0x1205a4 type	0E6F88ACF9FA9C8B3CEBC90B5A551E09	54C2E1F48112E383766187CC025B0514D164BDDD	79433D518689C5DF597DD314CB17529E505D73D24DF3C5D272763DDB50583745
C:\ProgramData\Microsoft\Windows\WER\Temp\WER980A.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	E716E2FE7257341D1DE1B62C1430DA3F	243865FDF0A967BED04F022CA74D75D759579C19	E87D4EC52A44A06A2DD0B71185095219B8E14CEDFAC16EB4CE013942FDF125B8
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9962.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	0013CEC3EB6831E813B3A8FA514E3AAD	1C70C828985F6ED1FE68B5405238B0F38FBFAB71	DA9A2C5C4613EBFE4BAF57447901018DA53F1E774A8EEAE1C1979AF4A3C7DEC5
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\2687EECC-4F43-442C-AA69-7E12CA414CA2	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators	621F80E05552B3ECF353464BC4E9B294	1E83E9E01E369F73C7C858E0ACC9FBD90BFF127D	D38400A3A86BD0DD654C844D8F867F49C6E428661BC88F9D8B335E2C0D7BC02B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\-f[1].htm	HTML document, ASCII text	33A7649A487B43D650E4D478C96E4588	F10EA1CC461B73EEE86CBE992CC4724F7B4C5175	469501F44D054081AD49D1D0AB0B8031ECCE6986D17D346CC39DFB7BCF327F76
C:\Users\user\AppData\Local\Temp\yD159.tmp.dll	HTML document, ASCII text	33A7649A487B43D650E4D478C96E4588	F10EA1CC461B73EEE86CBE992CC4724F7B4C5175	469501F44D054081AD49D1D0AB0B8031ECCE6986D17D346CC39DFB7BCF327F76
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat	ASCII text, with CRLF line terminators	3CB5E2D635FB7887310A38F71EA6ADDD	3B07E380CE6B8C0E07368C0CF952F496E21ADFD7	54314B21351BEC27FE14EB4EA2EC466892A9B1B433C85699C6920071C9D21871
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\valliant.document.08.11.2022.doc.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Mar 8 15:31:42 2022, mtime=Fri Aug 12 00:58:40 2022, atime=Fri Aug 12 00:58:35 2022, length=2221348, window=hide	D68B1F3E3D0554FA7E1A874C499BD3CF	D492C29EBCC85549BC4ABBFDDE00832D29A58364	4DC8E47EB7BDE47F406129F5670874BE7CA488A4AD50A1B60F0A535D77DF2E5C
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm	data	23A678C8A7437AA29240B630EDC73E46	2D47627B182956BFD3B6001F05E6598F87049A91	31B3A272B06650F92E6076C59E89ADA8E5E567ECE563EE8D5D890ACBDADE5104
C:\Users\user\Desktop\~$lliant.document.08.11.2022.doc	data	23A678C8A7437AA29240B630EDC73E46	2D47627B182956BFD3B6001F05E6598F87049A91	31B3A272B06650F92E6076C59E89ADA8E5E567ECE563EE8D5D890ACBDADE5104

Windows Analysis Report
valliant.document.08.11.2022.doc

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted URLs

Windows Analysis Report valliant.document.08.11.2022.doc

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted URLs

Windows Analysis Report
valliant.document.08.11.2022.doc