macOS Analysis Report
9A - Khensu - (Pachons) 2025.docx

Overview

General Information

Sample name:	9A - Khensu - (Pachons) 2025.docx
Analysis ID:	1466596
MD5:	8d96b29acbca3c42bbd0bbe36bcab29b
SHA1:	a9e917aef1a262b2fa6d31c8c5599edb351b71af
SHA256:	d41d7d88064912873737e9f9d1f9cd5c93c34f0c88628ca1e76e5db30b7cc832
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false

Signatures

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

Reads hardware related sysctl values

Reads the systems OS release and/or type

Reads the systems hostname

Classification

Signatures

Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49347 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.248.207.68:443 -> 192.168.11.12:49348 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49349 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49352 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49482 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49486 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49488 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49490 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.8:443 -> 192.168.11.12:49503 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.8:443 -> 192.168.11.12:49504 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.8:443 -> 192.168.11.12:49506 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49513 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49514 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49515 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49516 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49517 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49518 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49522 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.69
Source: unknown	TCP traffic detected without corresponding DNS query: 184.51.216.242
Source: unknown	TCP traffic detected without corresponding DNS query: 184.51.216.242
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /2024/patches/052-54451/D609556E-69B1-482E-9C33-B2E3510A1311/com_apple_MobileAsset_TimeZoneUpdate/c5a4d0df08e8faecf4faebbbadc4d96a07d9d990.zip HTTP/1.1Host: updates.cdn-apple.comAccept: /Accept-Language: en-usConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: mobileassetd (unknown version) CFNetwork/976 Darwin/18.2.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /2024/patches/062-08173/234EE7F7-CC33-4CD3-85FC-60590A103560/com_apple_MobileAsset_CoreSuggestions/84f6102e2a09dd10dd694d795792a7771b6014fc.zip HTTP/1.1Host: updates.cdn-apple.comAccept: /Accept-Language: en-usConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: mobileassetd (unknown version) CFNetwork/976 Darwin/18.2.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /2021/mobileassets/041-40471/B96AF6E1-5FF6-4786-9956-944A1AFE086A/com_apple_MobileAsset_KextDenyList/404087a7302927411b6ea0e05114d2c68355185e.zip HTTP/1.1Host: updates.cdn-apple.comAccept: /Accept-Language: en-usConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: mobileassetd (unknown version) CFNetwork/976 Darwin/18.2.0 (x86_64)

Source: global traffic	DNS traffic detected: DNS query: updates.cdn-apple.com
Source: global traffic	DNS traffic detected: DNS query: h3.apis.apple.map.fastly.net

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)

Reads from socket in process: data

Jump to behavior

Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: ProofingPrefs.plist.260.dr, com.microsoft.Word.securebookmarks.plist.260.dr, MeContact.plist.260.dr, login.keychain-db.sb-07d82885-p2be2j.260.dr	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.aadrm.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.aadrm.com/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.cortana.ai
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.microsoftstream.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.office.net
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.onedrive.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.scheduler.
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://app.powerbi.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://augloop.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://augloop.office.com/v2
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://cdn.entity.
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://clients.config.office.net
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://clients.config.office.net/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://config.edge.skype.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://cortana.ai
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://cortana.ai/api
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://cr.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://d.docs.live.net
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://designerapp.officeapps.live.com/designerapp
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://dev.cortana.ai
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://devnull.onenote.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://directory.services.
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://ecs.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://edge.skype.com/registrar/prod
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://edge.skype.com/rps
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://graph.windows.net
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://graph.windows.net/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://ic3.teams.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://invites.office.com/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://lifecycle.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://login.microsoftonline.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://login.microsoftonline.com/organizations
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://login.windows.local
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://make.powerautomate.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://management.azure.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://management.azure.com/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://messaging.action.office.com/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://messaging.office.com/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://ncus.contentsync.
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://officeapps.live.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://officepyservice.office.net/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://officepyservice.office.net/service.functionality
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://onedrive.live.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://otelrules.svc.static.microsoft
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://outlook.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://outlook.office.com/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://outlook.office365.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://outlook.office365.com/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://outlook.office365.com/connectors
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://powerlift.acompli.net
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://pushchannel.1drv.ms
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://res.cdn.office.net
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.40
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://res.cdn.office.net/polymer/models
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://service.powerapps.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://settings.outlook.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://staging.cortana.ai
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://substrate.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://tasks.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://templatesmetadata.office.net/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://webshell.suite.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://wus2.contentsync.
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://www.yammer.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49348
Source: unknown	Network traffic detected: HTTP traffic on port 49517 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49347
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49522
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49488
Source: unknown	Network traffic detected: HTTP traffic on port 49515 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49486
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49482
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49518
Source: unknown	Network traffic detected: HTTP traffic on port 49514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49517
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49516
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49515
Source: unknown	Network traffic detected: HTTP traffic on port 49348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49514
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49513
Source: unknown	Network traffic detected: HTTP traffic on port 49352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49327 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49518 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49482 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49516 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49352
Source: unknown	Network traffic detected: HTTP traffic on port 49522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49490
Source: unknown	Network traffic detected: HTTP traffic on port 49503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49504 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49506 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49513 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49490 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49347 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49506
Source: unknown	Network traffic detected: HTTP traffic on port 49349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49504
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49349
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49327
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49503

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)

Writes from socket in process: data

Jump to behavior

Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49347 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.248.207.68:443 -> 192.168.11.12:49348 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49349 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49352 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49482 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49486 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49488 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49490 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.8:443 -> 192.168.11.12:49503 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.8:443 -> 192.168.11.12:49504 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.8:443 -> 192.168.11.12:49506 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49513 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49514 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49515 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49516 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49517 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49518 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49522 version: TLS 1.2

Document contains embedded VBA macros

Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	OLE indicator, VBA macros: true
Source: CatalogCacheMetaData.xml.260.dr	OLE indicator, VBA macros: true
Source: microsoft word_Rules.xml.260.dr	OLE indicator, VBA macros: true

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: CatalogCacheMetaData.xml.260.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: microsoft word_Rules.xml.260.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: classification engine

Classification label: clean2.macDOCX@0/122@2/0

Source: 9A - Khensu - (Pachons) 2025.docx

OLE indicator, Word Document stream: true

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)	Random device file read: /dev/urandom	Jump to behavior
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)	Random device file read: /dev/urandom	Jump to behavior
Source: /usr/libexec/firmwarecheckers/eficheck/eficheck (PID: 669)	Random device file read: /dev/random	Jump to behavior

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)

AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist

Jump to behavior

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)

Log file created: /Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Caches/Microsoft/uls/com.microsoft.Word/logs/apple-device-log-20240703-0049.log

Jump to dropped file

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/TemporaryItems/(A Document Being Saved By Word)/ci.plist	Jump to dropped file
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)	XML plist file created: /Users/bernard/Library/Group Containers/UBF8T346G9.Office/MeContact.plist	Jump to dropped file
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)	XML plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/TemporaryItems/(A Document Being Saved By Word)/com.microsoft.Word.securebookmarks.plist	Jump to dropped file
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)	XML plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/TemporaryItems/(A Document Being Saved By Word)/ProofingPrefs.plist	Jump to dropped file
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)	Binary plist file created: /Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Caches/com.microsoft.ctrlstrcaches/com.microsoft.Word.ctrlstrcache.en.plist	Jump to dropped file

Reads hardware related sysctl values

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)	Sysctl read request: hw.availcpu (6.25)			Jump to behavior
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)	Sysctl read request: hw.ncpu (6.3)			Jump to behavior

Reads the systems OS release and/or type

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)	Sysctl requested: kern.ostype (1.1)			Jump to behavior
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)	Sysctl requested: kern.osrelease (1.2)			Jump to behavior

Reads the systems hostname

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)

Sysctl requested: kern.hostname (1.10)

Jump to behavior

Source: /usr/bin/open (PID: 620)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
151.101.67.8	appledownload.map.fastly.net	United States	54113	FASTLYUS	false
151.101.3.6	h3.apis.apple.map.fastly.net	United States	54113	FASTLYUS	false
151.101.131.6	unknown	United States	54113	FASTLYUS	false
184.51.216.242	unknown	United States	16625	AKAMAI-ASUS	false
151.101.67.6	unknown	United States	54113	FASTLYUS	false

Contacted Domains

Name	IP	Active
appledownload.map.fastly.net	151.101.67.8	true
h3.apis.apple.map.fastly.net	151.101.3.6	true
updates.cdn-apple.com	unknown	unknown

Name	Type	MD5	SHA1	SHA256
/Users/bernard/Desktop/~$ - Khensu - (Pachons) 2025.docx	data	75839E735912F7903F7B45F035676F57	7C1BCAB9B006CAC4D01F3B810A394E6C84EE804E	41BA2D39B283EF215562B5BF59B4015D859FAC71F1F94B3413D59AAB2B9EA9F0
/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/FontCache/systemfontmetadata.json	JSON data	ACAF059AFEBFC46E06ADE831A514F256	5530CD79F99C4270088EFE83415D9B6355702B7D	BD9F09902F4E129B87A6A99CDBCBEDE57836813AC6AA89E52F2A11033C23D8CD
/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/CatalogCacheMetaData.xml	XML 1.0 document, ASCII text, with very long lines (13112), with no line terminators	9A7276B1C7611BBE7F17E85109C1E855	7DCB177F73823340574B46D843415A4368D86CEE	5F954E0BB6770D3E4EE58EA9A1BB57FFAAF7F264C89CA6A006B27A1851CD1AD8
/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectbronze_apple.jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 405x405, components 3	D8570FC799DD7D35BFED4D3098AB3E9D	7A1F0C7021BA61AEBD29E241AADCEDFB85C3642A	881266FF8DF6E91E4101F9C6F8E01B2241FFCAA680A1B26292165AFD0F14E5FC
/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectgalaxy_apple.jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 405x405, components 3	F2D3F4899AA489D5EC478DC7C3CBB5FB	6E3DAE737EBE40F38917D7C07B28CAFCF5555CD9	269197FEC12A677913CF6C9BB2F9B2A8B74EA4F5C52E578E89E1D9D2732229C5
/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectgold_apple.jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 405x405, components 3	0C4305204BE8030648DEEF0A6B772B85	00CFC8282A6DFCD01353A4A1636483B3FA59D850	D5BDD3A022CB46E5810D32264052D038B9E3FE7FE6B4D1D5A315E1379D568399
/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectlava_apple.jpg	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 405x405, components 3	C7115E54CE318F1A9F243008FE422AB1	D3BF56888DA8112AA15189ED66BEDAE83AE8433C	F831E10750920FE6B3B05E3B0F91A31FF87F4C84DC4A3210AA47ECC9C75455C1
/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectocean_apple.jpg	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 405x405, components 3	1291BC2D361ADFECECE17FC4BA39955B	A0D8349ECC1C87EA15E653E7DA0BB9D7F6A41888	73B734D4F546848D1ABDC4D5B97AF096B8503A4BF3ADC476B7F87E123C87377F
/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectrainbowglitter_apple.jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 405x405, components 3	1D6620FEF62D8E0D2429F0875C3BD004	8A1B52DE18DBF5F401B6D2E9BFA195870F9AED1B	38373A0F2AE2B95162802E45582602AA99CCF76595D1BC27DA32A95FB594F983
/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectrosegold_apple.jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 405x405, components 3	FD87DBA2227C56D76B7BF324A34C271E	B1F283D5614B416802E132B9789FE9B983688D6E	289FB85EC85BC9EBBC01F858F8E0ACA2A38BE697FF5217F96CBF0652CBC6AF1E
/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectsilver_apple.jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 405x405, components 3	72EDB703DA3FFA41A82650CC167CFA64	BD5357D5A8434DAC612038A1CA409C44B926E4A6	E56DBDF74A0D097769378CDBD44E3C967BAE4B83E932784A909575149E64E24D
/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/GraphicsCache/1/oart.json	JSON data	53D49444EAF92E0CF5D2985CCAEDE42B	DA2D6C55752243AA5E638750F038DADF3C9FE6CC	722A39658D2F3D5E333874F23485CEA9DA2B79EDA454FA7F5A9FEFBFDB9B2AD8
/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Office/16.0/Floodgate/Word.CampaignStates.json	JSON data	F1B59332B953B3C99B3C95A44249C0D2	1B16A2CA32BF8481E18FF8B7365229B598908991	138E49660D259061D8152137ABD8829ACDFB78B69179890BEB489FE3FFE23E0C
/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Office/16.0/WebServiceCache/AllUsers/officeclient.microsoft.com/BBF98802-4CD4-CD4C-9154-911C4F032D58	XML 1.0 document, ASCII text, with CRLF line terminators	E7F0A0BC3ECD570056D1C5D27DD136E8	7FC6449C5F56F861F8FE7B52834FCE76D6BDF286	599782A445B1C4550B90A1764CD77F34DCB6DE6E0995CC559AE84A7DA9D09D25
/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Office/16.0/microsoft word_Rules.xml	XML 1.0 document, ASCII text, with very long lines (65536), with no line terminators	AFA30877705866D794891003EC252FDC	DB2FBBF0834F7DE2FAC2EDFCFC638F169C66A18F	54C9CBCF365A0305E6FA7140725BE01EB178A1DA4D24CDF3EA762B4C1C17E1CB
/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Temp/~WRS{4FACBB30-11D3-734D-8C23-8C750BE30DEE}	data	EE8133D55E98DFA2E8BB801AC7342894	4B577019E17D7DD02C9372D8FDBA5F9739EEEC95	6C901B7D7040330EF4D95B1F7C75B4B1FA2909793777317C40BFEA16C597AAD1
/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Temp/~WRS{BA4279CA-9775-9046-9C80-6F4D100CD6B3}	data	FA286030266C55D3238407BB6BDA6FE9	1215557315F7B878E6FAA88E27CB18F77546CDCF	77B212187FDB6968273C4FD9D9D12F93F8A5D80794D626FB9C80E020C0831F80
/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Caches/Microsoft/uls/com.microsoft.Word/logs/apple-device-log-20240703-0049.log	ASCII text, with very long lines (786), with CRLF line terminators	A16292FC25BB8E34B6D47C447B5C6C72	8BD37618A22E89C07E9630CA1584DEDD31D5C92E	32BD74E2F73DB0A7A0061C522C916E951DCD2E9ADB9C2093E023B1387E8FB027
/Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Caches/com.microsoft.ctrlstrcaches/com.microsoft.Word.ctrlstrcache.en.plist	Apple binary property list	4EEB72D0A3BE9DDFCEFD6F652F24FAAB	74935D6564DF2AE3F11A6726A61EB35438FDE9FE	CD63BCE9B47359D63AD34668A8DCC3AFACA132B0A85B6EAEEA5EED8F55E301F6
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/Custom Dictionary	Unicode text, UTF-16, little-endian text, with no line terminators	F3B25701FE362EC84616A93A45CE9998	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/MeContact.plist	XML 1.0 document, ASCII text	20E2EE847F3F1DAE73A9025DA551A305	C0607E8701E244E97A4E7E48C25F447F146FBBC5	54FBFECCE3A3B4512D5B41C8549691C953774530C6CC6B67DF5CE2BABE28C08A
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/ar.strings	Unicode text, UTF-16, little-endian text, with no line terminators	4776CB70FE00BC6AEB696B410A3DCEEE	5AAB4C605B9B31312F317672DA960D4E1CADE04C	2E7A61627DEE2B425849E0682E244E6E85F8E44C056FF3F6073DF86C189BCFA6
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/cs.strings	Unicode text, UTF-16, little-endian text, with no line terminators	586346536BCA4E3DDD3C38A9C1F17DC0	093794E09D9B3BE6FB85FA9EE01BED3AEEDA7875	65BAAA09B58FCE46EB14351A8393DF64EFC090F495D01F35B3FF0D13EB5D0169
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/da.strings	Unicode text, UTF-16, little-endian text, with no line terminators	CF843AE5C1B90B1B55283AF897B542D3	B3BF056D596C71B7748E54506095759939D9B4B4	B6D0DAEB079285256C87445E5AAB178D4E62FED927344C08CC2CBEABF809E451
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/de.strings	Unicode text, UTF-16, little-endian text, with no line terminators	FAC73D0043DAC6F75608769E9F61ED19	2BC5131486F2D11C046C5F8F318EF0304BD9D83D	ECD6E22F111F573A0DE236CAD9A47F03B40CFEE8487778E140CB2CE032E6509D
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/el.strings	Unicode text, UTF-16, little-endian text, with no line terminators	F4D2E086599074426AC6A837DB387511	6C45111E53BC020B1CB3C212F54B0FBB6D09DDE2	D8FF17F32E934DAB1C8316027821AE5038E40930D6FBCFD742A5DF3B1C7DC056
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/en.strings	Unicode text, UTF-16, little-endian text, with no line terminators	33710D103D50C71EAF39988FB87D38E4	7D3CA7064D7B04833810468367B856B99FD800B3	CA4EBED01FEDD706C103D024A3B07B387D970386FA06EDF69B80C138091FE04C
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/es.strings	Unicode text, UTF-16, little-endian text, with no line terminators	7F7EB49E58EDD8EF1A733E81D9B3BF89	AE6E8541E61D7EEB80111F3CA865DDE5543E1E14	045C0D75E98636B8BFEA50A73ACE6A1ABFB58AFAEF095CFA17FB3496E651E561
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/fi.strings	Unicode text, UTF-16, little-endian text, with no line terminators	EAAA665A7EC2260626D5A6F81FBFD2D5	318A5BC91DB8C5A1DF234AC230A6E189428C7CDA	72C062C61C574212A40F01F192B4FB139A7BFE660EAE27F449EC4F3D316B6F57
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/fr.strings	Unicode text, UTF-16, little-endian text, with no line terminators	94D951325E7CAD48A4EF7AFC1E8C84AB	B64D44502252F8489EF3A8AB5769B3B626768C1F	D5193640F18E4B4C810E1260B1D7DAD83865A4747C24B6052604D67968AB4936
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/he.strings	Unicode text, UTF-16, little-endian text, with no line terminators	DABCD4CC05E8583AD885AB3AF975C56F	F2ACFABCC2604B25B4970BA0803A27EDDA8D1E9B	50188525648F74467732C32701BBBF3A5CFB9BA8F57872C550B3F95768C335F1
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/hu.strings	Unicode text, UTF-16, little-endian text, with no line terminators	2133A797E4A7634E9EC97C7428AF3C22	7695F54E21462CAE42E5DE87121C3BD7CC604FEF	BCB4A4868E6E463F0D96BF2833432C615EDE7A5EE9BFD25CAA3AEA671F2B0255
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/id.strings	Unicode text, UTF-16, little-endian text, with no line terminators	41FF3F9EE6BA77DFA346D568AAFF38D0	81CEEF719DCC9E32D3E0A879C4E8629DE02F32E5	4B5096C36C4500677C01D2F23AB9429DF9F51F8BF1DCA8039283ABC939281C15
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/it.strings	Unicode text, UTF-16, little-endian text, with no line terminators	5BDBDA0D0D7B502F463363BAE5D3ECEE	01A8FF8F4437820AB135A252AF486D5F865866C1	A337EAA4E641DA88B9A089AC343D0B5F545AF2F847A419747FA0253D91F256BA
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/ja.strings	Unicode text, UTF-16, little-endian text, with no line terminators	DF7C9EEBC6BB4E445EC58AD78D2936E3	6400EF54A15F72B324A380F8568F78F2C77C2D27	2DBD602F439E649DFFAADFF9E60FFF16220B5C706EC2DC4E7053B1DACDAE03BC
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/ko.strings	Unicode text, UTF-16, little-endian text, with no line terminators	8D088E90F5572158094887333B425415	0107D6C2460C36AC8EFD587797709AF3ADFF4101	AD7461D4337C3DA696615DB1E4DFB5D675BAD15C861B003EB1FE2AA1C347618E
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/nl.strings	Unicode text, UTF-16, little-endian text, with no line terminators	F970AB662E0D5EDB33B8041F23EE9A58	31959CE6AF90382C2B3881F439B0D3D890CC5A78	A288EFF6B89359C87D609195A1B47D2F2C42A83A24B104DB1463CF2B129196ED
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/no.strings	Unicode text, UTF-16, little-endian text, with no line terminators	24688CC64A3232577FB669D5847627B1	C808CBD9D557ECE65F1564B49E679CEBC4DEB274	6F238BBE013D855C7C834D32D1C7D108137FBB2835234F68CAEE0BCCA37ECA9A
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/pl.strings	Unicode text, UTF-16, little-endian text, with no line terminators	B439AD1AEDEAA9BD4296C772FD48E3B4	61731198375551623B254122B402F70ABEDD24F3	D6A65D7D6EAB2B75204E4474A5A75EC012317AB828D42C36F1E998D26F75BCB0
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/pt.strings	Unicode text, UTF-16, little-endian text, with no line terminators	27009EE68674F9397E53699A4D251B0E	8E7A79D6B5470E63095B636FB17457F56905EA0F	7DAB4E34E50E7A7CF0ED44E7D82829825AE954AD57E615A7FB43EF3E7A096DBE
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/pt_PT.strings	Unicode text, UTF-16, little-endian text, with no line terminators	EB7E26313860F756306FAE9447235174	39CDC7571936BCF089976F83EEA7B6594B2BACCF	D43C25DCE728723725B552D331DC4166C88594E27B285864FBCC7F9609475ED9
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/ru.strings	Unicode text, UTF-16, little-endian text, with no line terminators	9FD7D227240F44B123D930CF82A28ECA	46B89E11FFE358B7229F8E3211119E4F2C234714	75F4B16099AA3CD1CE766AF2E169D7E37CE3F4C66796258F7CBA5163EECA7987
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/sk.strings	Unicode text, UTF-16, little-endian text, with no line terminators	C554AF8796DEC9C0FB07B171AF92587E	7FCDEE38E1C526E1CDD9FD872AADDB1B356EE86E	FBD30B5C7508E7C053A0325E93E08CAC03EEADB62242BDDE31115EAD8B3F94B9
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/sv.strings	Unicode text, UTF-16, little-endian text, with no line terminators	202A6016EBEDA4C0F007446F1D74740D	FC3BB0DCE97AEDC946D7CD000D297DA0E7360B5F	8A073E4FF39595EE3409FD59375B20D838C00E1B477BC7147B54D54126D84409
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/th.strings	Unicode text, UTF-16, little-endian text, with no line terminators	07F749180EDD607107E7FE5BEFCD2B80	D5E16FF9085F3A2B948FAA3ACE755ABFC1750414	C8B9EE7470AF0699A66E7C3266327D175F479343447F646EC72EA4F042EE009E
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/tr.strings	Unicode text, UTF-16, little-endian text, with no line terminators	5BF4A82EAF85BA5AAB07403969D1E379	7DC8A1241C5230A03C009FC5A02FFBD5832685C8	D8BEB30B0B00B7988294091A34E6971FE279F54364AC0BD568A92885952B0A23
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/zh_CN.strings	Unicode text, UTF-16, little-endian text, with no line terminators	7C5F09EEF6C3BA4DE766EE9543698C1F	54BBE49811B5BD941CC926BAC101E8B03BBE3EAB	771161AF6389886C05A9C5B64878A9B9348A83FFDBF84DA23E2ACED033E2CB80
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/zh_TW.strings	Unicode text, UTF-16, little-endian text, with no line terminators	7B02B52E6E18AE4A18CAE3CA7B42D2C0	87C06B55A63E2C3216E58ECE9DBED2CB9339BC50	25228F342B3C20D7C1E017704538A68B3B55F937D5A9C91D80BAAE339D029AAC
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/~$stom Dictionary	data	A03DFBB091088A47322124DB004064C1	D4E6D5BF39BB601CA87746A8646E78456BFB4D6F	B8423742DB04F3D64520A226087A2F679DEC3689FCE0A24D7B4E2E024378BF50
/Users/bernard/Library/Keychains/login.keychain-db.sb-07d82885-p2be2j	DIY-Thermocam raw data (Lepton 3.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 963362762505407623593984.000000, slope 303834226087943251262072422400.000000	4AB9BAD0342E05E4AFCDBB8FB8AB0D25	3567835475AD6D86D353E99DA316B8FF04B228A6	67AFB0FDEECC9CE643854D1142EDA614FD185BD0575DBC0C1636F02863BDFE9E
/dev/null	ASCII text, with very long lines (347)	244F2CF834848AEC7EDB60C074BBD035	9E132DB4225C6174BB54A1149FDAFA27D6FB0F8C	90871440A32427561C6E2AC68C90B1516F82DE915A8D76D130E7FE3897F913D4
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.microsoft.Word/mds/mdsDirectory.db_	Mac OS X Keychain File	A4C012BBB09B0B19F4A3234F4400E4A9	944771D35DB56488D63544C09418C4235B44E3B2	EAC36EE71C5AE4B6D2024C333C2EB7B6C0415FBFCFC264A5B19C4F10BB0126B8
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.microsoft.Word/mds/mdsObject.db_	Mac OS X Keychain File	636C97726FA8460EAB35E0996589DB4C	D1BE760E43173671B670A20DED636CD93BCEE7C3	1136941331967FDA088BB15807F23F25EF27E7BFEE1FCCFE1322965857CF23F7
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/10B0228C.png	TIFF image data, big-endian, direntries=16, height=54, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=45	BBF3B677BD2C6233B352A7EEF2F818CB	70374F8D422C780E56210EAC7BA3F3B717E81A2F	C5E4E2FB7CC1981FF2BCF1995A73EFFE9C3FD09D2D5A92772C6271D9C3466144
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/10EDDAE8.png	TIFF image data, big-endian, direntries=16, height=79, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=115	B62EB2046461029622591BB73726AB5D	0FFEF10C9D29FFBB6573CD6FDC3624F34211FD85	26D2E8A80ABB9AA4AAC5716B10FA4D79FBE37701FDB0BA18EF5E3EA9F15D0B6F
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/11841C1E.png	PNG image data, 100 x 220, 8-bit colormap, non-interlaced	FA130205760E9BD5CAD30C6A96B9F9C9	335486AE6EA7FADBA550911908578A33FFC5B20D	5ED44EE5D9B0A0C3C4E357C40EDBBBB2AE39018CEF0E1B5BA8F7839CA0192064
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/16131B96.png	TIFF image data, big-endian, direntries=16, height=49, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=46	7298D6A60FE5A4A75CAFA1CB3E69319F	3FCA21988D2466B0A528F017FC660B0B6CFB1C47	A91D73658CBF849B887890670607813C5C6B6437974D985DF99EC9CEF2673376
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/174AAD05.png	TIFF image data, big-endian, direntries=16, height=90, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=104	CF8E8E52A0FC0413F3EF62E8FC70D6B6	B2D098F2DF1F32569F35DB3E490F7E0320ED26C0	127CE3325DE09366E48BD6ACD55128F8624D850CBA6DF7B59BBB41CF339C3A41
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/1AF758DA.png	TIFF image data, big-endian, direntries=16, height=47, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=38	462D6097395D35CCB906E35F1BEE937E	BD26074E6D02B292E44DD57F1A7C4C5A25F64ADA	704BDCC8B4DC9F99F1EE3F640F0977F8C5BD4550A8CDD878F0018FCA2EAF1E1E
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/1F48DC9.png	TIFF image data, big-endian, direntries=16, height=87, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=68	0EF7BDFDB8540B5E2854B7ABFD10BD03	5122FE2E4BDE384DDC21FA5585C963AF883559AC	4C6F066F57011E2EC54D1AB15F1877A203BE0A20FE0AD1D24CE2631B12D9E8B8
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/2B23EC66.png	TIFF image data, big-endian, direntries=16, height=54, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=45	BBF3B677BD2C6233B352A7EEF2F818CB	70374F8D422C780E56210EAC7BA3F3B717E81A2F	C5E4E2FB7CC1981FF2BCF1995A73EFFE9C3FD09D2D5A92772C6271D9C3466144
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/31B18231.png	TIFF image data, big-endian, direntries=16, height=78, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=71	209FAFBEB7189C78B1C243AAE04B3469	037ECEB63FAAC1E113136E49345BDF27B2B116C2	698520D9AC2840AACB2426E842C7D7E60EFC61B6E0048D0841DF5AF58958D527
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/3D1B5633.png	TIFF image data, big-endian, direntries=16, height=81, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=80	B5046E16048A8E50D0F70F3BFFDC83DE	97852FB08976E3920C845AA8B747AA2D9B8BCA11	DB21A0E30A8D3A93A31DEDAD74A29497DBB1E180C505130E7CFE5FD31CD828EB
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/3FFBCC4A.png	TIFF image data, big-endian, direntries=16, height=79, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=115	B62EB2046461029622591BB73726AB5D	0FFEF10C9D29FFBB6573CD6FDC3624F34211FD85	26D2E8A80ABB9AA4AAC5716B10FA4D79FBE37701FDB0BA18EF5E3EA9F15D0B6F
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/40773BBF.png	TIFF image data, big-endian, direntries=16, height=87, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=68	0EF7BDFDB8540B5E2854B7ABFD10BD03	5122FE2E4BDE384DDC21FA5585C963AF883559AC	4C6F066F57011E2EC54D1AB15F1877A203BE0A20FE0AD1D24CE2631B12D9E8B8
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/42DA7FF5.png	TIFF image data, big-endian, direntries=16, height=46, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=47	9A57CD353021D8B70200EEBE72690FDD	328DD9479A777AE33634698DD95A8AA1FD848DB7	1262145A42D0E0D315A78BAA1025D6EDD9635E8FC158B82EEE3FFA9DE8109F8C
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/44151D64.png	TIFF image data, big-endian, direntries=16, height=80, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=92	611D104F77E494CECBECC5F2B0AA4ED9	A4DA8B342F9FBA56CABA11CB0D01E9FAF6C4B32D	305F7718244324064E303A6C0FFB3A5C8ED384E0B9B8C52EC182570F74F220E3
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/44D5CC0F.png	TIFF image data, big-endian, direntries=16, height=92, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=97	4A667717657F7A506482840980F3EC66	188EF7201AEF6782BA9C4C55FE1D2C650EB36D34	D6DEB44CF5BDC423149290A0D6A1EC24A6295D42C04A6AE0A5A7D2E074DADCD4
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/45D76187.png	TIFF image data, big-endian, direntries=16, height=54, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=45	BBF3B677BD2C6233B352A7EEF2F818CB	70374F8D422C780E56210EAC7BA3F3B717E81A2F	C5E4E2FB7CC1981FF2BCF1995A73EFFE9C3FD09D2D5A92772C6271D9C3466144
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/4845C5EB.png	TIFF image data, big-endian, direntries=16, height=49, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=46	87B7FC2C2A79EA2FA4705FD564ACAC99	D378C98204F92880C7C85D8A2DDF18FBB6F1DFC8	EF705B4FB9C9E9FE138EC9586AC1C2FF6BA0BA16F634635D7B4C6EBDBE5C53FD
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/4E635021.png	TIFF image data, big-endian, direntries=16, height=46, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=43	8E47B779CAAF0F86CA75FF8BC805E825	75B1B97EE6029F990B25C9C2B935DC2E7178DBE5	8F85A2EA0FE519421D9AF307C19C6D8DAA46BAA0427708A8C378BAECBFF29394
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/51F7A8A0.png	TIFF image data, big-endian, direntries=16, height=88, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=93	801078C32E96657FE526A8C79775C459	9C08035215F919195ADB2DBE4DA83D9A8C2EB01C	80153F69AD0AD779AACE95B9BF734F03D3580D73782E2E2491C265640893EDBD
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/5AC8C20D.png	TIFF image data, big-endian, direntries=16, height=78, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=71	209FAFBEB7189C78B1C243AAE04B3469	037ECEB63FAAC1E113136E49345BDF27B2B116C2	698520D9AC2840AACB2426E842C7D7E60EFC61B6E0048D0841DF5AF58958D527
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/603137AE.png	TIFF image data, big-endian, direntries=16, height=88, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=93	801078C32E96657FE526A8C79775C459	9C08035215F919195ADB2DBE4DA83D9A8C2EB01C	80153F69AD0AD779AACE95B9BF734F03D3580D73782E2E2491C265640893EDBD
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/628A4936.png	TIFF image data, big-endian, direntries=16, height=46, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=52	ED765D01DC1544089E38D40EDF22ED89	94473A41C25BE712C76CE9742B6E9EF23F95BF84	16C914449858AD211401EBFDCAFB46AD1FB9AF5172E0110921D4FE572FB00343
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/6661891D.png	TIFF image data, big-endian, direntries=16, height=81, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=80	B5046E16048A8E50D0F70F3BFFDC83DE	97852FB08976E3920C845AA8B747AA2D9B8BCA11	DB21A0E30A8D3A93A31DEDAD74A29497DBB1E180C505130E7CFE5FD31CD828EB
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/69B6B298.png	TIFF image data, big-endian, direntries=16, height=54, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=45	BBF3B677BD2C6233B352A7EEF2F818CB	70374F8D422C780E56210EAC7BA3F3B717E81A2F	C5E4E2FB7CC1981FF2BCF1995A73EFFE9C3FD09D2D5A92772C6271D9C3466144
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/6D9C2A9F.png	TIFF image data, big-endian, direntries=16, height=79, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=84	7B9476543E40EFB49D9150506A113AD3	98DF67C064D5852C4AF2549A7F0599C23967D6CB	19B0B89E7EA126BBBA9CAED79760380A8D65DA685C190AB2987A247FFA00BAC5
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/736A847A.png	TIFF image data, big-endian, direntries=16, height=54, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=45	BBF3B677BD2C6233B352A7EEF2F818CB	70374F8D422C780E56210EAC7BA3F3B717E81A2F	C5E4E2FB7CC1981FF2BCF1995A73EFFE9C3FD09D2D5A92772C6271D9C3466144
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/7AC9F467.png	TIFF image data, big-endian, direntries=16, height=78, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=71	209FAFBEB7189C78B1C243AAE04B3469	037ECEB63FAAC1E113136E49345BDF27B2B116C2	698520D9AC2840AACB2426E842C7D7E60EFC61B6E0048D0841DF5AF58958D527
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/815ACE50.png	TIFF image data, big-endian, direntries=16, height=79, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=115	B62EB2046461029622591BB73726AB5D	0FFEF10C9D29FFBB6573CD6FDC3624F34211FD85	26D2E8A80ABB9AA4AAC5716B10FA4D79FBE37701FDB0BA18EF5E3EA9F15D0B6F
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/82AB6A5B.png	TIFF image data, big-endian, direntries=16, height=45, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=45	9901EA0EBE9D17E8AF60F3CC8651A109	46C575FD93692DBAD4D61B5FEDE476104A67449B	AC5E4CA87302EBDAD5FA08645131A8474A74CD46AF067CD1D4C5FE13CEEA5831
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/838BF041.png	TIFF image data, big-endian, direntries=16, height=52, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=46	E68A6E8021004D8193F4FAE718D2D29C	95FB534DA4D795B54C9682BE06A9DDC183256FAA	5E41F201E22245954263B31AFFE4D7A59C10F58D6D79553311F7228C038EBAE3
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/8668DBC3.png	TIFF image data, big-endian, direntries=16, height=47, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=43	7D76513972A1FF97DE60886E5FD65837	793E7737040CD32C032CD2D1D248F3DE07B9DE08	BB023E74B608D2D401C22B44F1AFE9F6277B9810796464B2EA020257E53A0778
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/868F71A9.png	TIFF image data, big-endian, direntries=16, height=79, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=84	7B9476543E40EFB49D9150506A113AD3	98DF67C064D5852C4AF2549A7F0599C23967D6CB	19B0B89E7EA126BBBA9CAED79760380A8D65DA685C190AB2987A247FFA00BAC5
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/870A5CF7.png	TIFF image data, big-endian, direntries=16, height=81, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=80	B5046E16048A8E50D0F70F3BFFDC83DE	97852FB08976E3920C845AA8B747AA2D9B8BCA11	DB21A0E30A8D3A93A31DEDAD74A29497DBB1E180C505130E7CFE5FD31CD828EB
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/8CC808AA.png	TIFF image data, big-endian, direntries=16, height=46, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=50	EC31F196DD95980DB145C3E26344CD6E	A4E42FF3CAC7ED15E7CD8C59C2DEF20724761110	0C79A888EBF38A910B0ECD5A40DA6F85154607672DD8418E9579206139354568
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/91B1733C.png	TIFF image data, big-endian, direntries=16, height=46, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=50	EC31F196DD95980DB145C3E26344CD6E	A4E42FF3CAC7ED15E7CD8C59C2DEF20724761110	0C79A888EBF38A910B0ECD5A40DA6F85154607672DD8418E9579206139354568
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/96F9A52F.png	TIFF image data, big-endian, direntries=16, height=85, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=88	F1E6D2BEF2309384CBA04830C9D714C7	FD0080E196CF0E0500C72787E7F77A2A41CB421A	4D46636B7FD9DFCB345E0F985399C31791D7A1FC3D7FE1F9CAC6F925ECB6189C
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/99405F13.png	TIFF image data, big-endian, direntries=16, height=92, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=97	4A667717657F7A506482840980F3EC66	188EF7201AEF6782BA9C4C55FE1D2C650EB36D34	D6DEB44CF5BDC423149290A0D6A1EC24A6295D42C04A6AE0A5A7D2E074DADCD4
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/9A47A1B9.png	TIFF image data, big-endian, direntries=16, height=85, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=88	F1E6D2BEF2309384CBA04830C9D714C7	FD0080E196CF0E0500C72787E7F77A2A41CB421A	4D46636B7FD9DFCB345E0F985399C31791D7A1FC3D7FE1F9CAC6F925ECB6189C
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/9BA056C4.png	TIFF image data, big-endian, direntries=16, height=79, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=115	B62EB2046461029622591BB73726AB5D	0FFEF10C9D29FFBB6573CD6FDC3624F34211FD85	26D2E8A80ABB9AA4AAC5716B10FA4D79FBE37701FDB0BA18EF5E3EA9F15D0B6F
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/9D8322B4.png	TIFF image data, big-endian, direntries=16, height=46, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=52	ED765D01DC1544089E38D40EDF22ED89	94473A41C25BE712C76CE9742B6E9EF23F95BF84	16C914449858AD211401EBFDCAFB46AD1FB9AF5172E0110921D4FE572FB00343
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/A3107B25.png	TIFF image data, big-endian, direntries=16, height=87, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=68	0EF7BDFDB8540B5E2854B7ABFD10BD03	5122FE2E4BDE384DDC21FA5585C963AF883559AC	4C6F066F57011E2EC54D1AB15F1877A203BE0A20FE0AD1D24CE2631B12D9E8B8
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/A8EBEACB.png	TIFF image data, big-endian, direntries=16, height=48, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=41	19B2A2548B83F926E7EEB747B2E3D017	DFEBC979E9F1ACE17F95A822593AAA720F385ACB	82A098E9C26958DA49AE805EED8D53293D13894A503647FFE7C2CCB818B521FF
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/A9AFEC.png	TIFF image data, big-endian, direntries=16, height=86, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=88	A8B90A117627CA72B0BA0A77F06A4715	3204F908E5E1F82545C22DB57B8809BA3A6F2F3D	1B066ECD26C4F87936ECE08C9C41D7F329E32341ED30F762E3C7DBF1F91E613C
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/B2362CA3.png	TIFF image data, big-endian, direntries=16, height=79, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=84	7B9476543E40EFB49D9150506A113AD3	98DF67C064D5852C4AF2549A7F0599C23967D6CB	19B0B89E7EA126BBBA9CAED79760380A8D65DA685C190AB2987A247FFA00BAC5
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/B70165F8.png	TIFF image data, big-endian, direntries=16, height=47, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=44	E2FEBC6708CCE698CF0F1603785E70A1	5F63A68E8E85A9AB33F058392C3BED87B09904F4	3569E5828F036223136DFCEA9EA14AE51DC7F5EB992B37D20C80F59853F93F3F
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/BD8C5615.png	TIFF image data, big-endian, direntries=16, height=49, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=46	87B7FC2C2A79EA2FA4705FD564ACAC99	D378C98204F92880C7C85D8A2DDF18FBB6F1DFC8	EF705B4FB9C9E9FE138EC9586AC1C2FF6BA0BA16F634635D7B4C6EBDBE5C53FD
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/CC59AEF0.png	TIFF image data, big-endian, direntries=16, height=80, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=92	611D104F77E494CECBECC5F2B0AA4ED9	A4DA8B342F9FBA56CABA11CB0D01E9FAF6C4B32D	305F7718244324064E303A6C0FFB3A5C8ED384E0B9B8C52EC182570F74F220E3
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/CEEAFD99.png	TIFF image data, big-endian, direntries=16, height=92, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=97	4A667717657F7A506482840980F3EC66	188EF7201AEF6782BA9C4C55FE1D2C650EB36D34	D6DEB44CF5BDC423149290A0D6A1EC24A6295D42C04A6AE0A5A7D2E074DADCD4
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/D2C1F6FD.png	TIFF image data, big-endian, direntries=16, height=86, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=88	A8B90A117627CA72B0BA0A77F06A4715	3204F908E5E1F82545C22DB57B8809BA3A6F2F3D	1B066ECD26C4F87936ECE08C9C41D7F329E32341ED30F762E3C7DBF1F91E613C
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/D45E140.png	TIFF image data, big-endian, direntries=16, height=82, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=82	90161BAAB30123E600C565E849E8312D	B68EFBC3AD384D13E5FB95D37CD3B035C73F5016	B2E7C8900813379FFCD3DE2F33D7001FFF463C139B37AC20AEB076AFC30F291E
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/D537C742.png	TIFF image data, big-endian, direntries=16, height=45, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=45	9901EA0EBE9D17E8AF60F3CC8651A109	46C575FD93692DBAD4D61B5FEDE476104A67449B	AC5E4CA87302EBDAD5FA08645131A8474A74CD46AF067CD1D4C5FE13CEEA5831
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/D553FD7B.png	TIFF image data, big-endian, direntries=16, height=52, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=46	E68A6E8021004D8193F4FAE718D2D29C	95FB534DA4D795B54C9682BE06A9DDC183256FAA	5E41F201E22245954263B31AFFE4D7A59C10F58D6D79553311F7228C038EBAE3
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/DF83FEE2.png	TIFF image data, big-endian, direntries=16, height=82, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=82	90161BAAB30123E600C565E849E8312D	B68EFBC3AD384D13E5FB95D37CD3B035C73F5016	B2E7C8900813379FFCD3DE2F33D7001FFF463C139B37AC20AEB076AFC30F291E
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/E2FABDDC.png	TIFF image data, big-endian, direntries=16, height=90, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=104	CF8E8E52A0FC0413F3EF62E8FC70D6B6	B2D098F2DF1F32569F35DB3E490F7E0320ED26C0	127CE3325DE09366E48BD6ACD55128F8624D850CBA6DF7B59BBB41CF339C3A41
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/E5A05A11.png	TIFF image data, big-endian, direntries=16, height=87, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=68	0EF7BDFDB8540B5E2854B7ABFD10BD03	5122FE2E4BDE384DDC21FA5585C963AF883559AC	4C6F066F57011E2EC54D1AB15F1877A203BE0A20FE0AD1D24CE2631B12D9E8B8
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/E62E194E.png	TIFF image data, big-endian, direntries=16, height=82, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=82	90161BAAB30123E600C565E849E8312D	B68EFBC3AD384D13E5FB95D37CD3B035C73F5016	B2E7C8900813379FFCD3DE2F33D7001FFF463C139B37AC20AEB076AFC30F291E
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/E6EAD6C6.png	TIFF image data, big-endian, direntries=16, height=45, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=49	C37D14F55C88E71555D2D924BE4A6FCC	CF79AF85E74A8FF74BC2CF922673CD3CEE5A3063	202293E488528CB314C0700E0D7295AEFD8EE0EFF0E9BB12B57DDCB474D1A00D
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/EEAD27D7.png	TIFF image data, big-endian, direntries=16, height=45, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=40	56684D3BA1B172618BE353C9599D0F90	8325B380E6E9FB02167BCDF0F87235FBC817BAD3	DB2E94B48BCA46C4766AE42B5DBA276FCBF233AE3B924C9906DA996354B244DA
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/F279BD12.png	TIFF image data, big-endian, direntries=16, height=80, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=92	611D104F77E494CECBECC5F2B0AA4ED9	A4DA8B342F9FBA56CABA11CB0D01E9FAF6C4B32D	305F7718244324064E303A6C0FFB3A5C8ED384E0B9B8C52EC182570F74F220E3
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/F3011D72.png	TIFF image data, big-endian, direntries=16, height=79, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=115	B62EB2046461029622591BB73726AB5D	0FFEF10C9D29FFBB6573CD6FDC3624F34211FD85	26D2E8A80ABB9AA4AAC5716B10FA4D79FBE37701FDB0BA18EF5E3EA9F15D0B6F
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/F3708414.png	TIFF image data, big-endian, direntries=16, height=45, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=45	9901EA0EBE9D17E8AF60F3CC8651A109	46C575FD93692DBAD4D61B5FEDE476104A67449B	AC5E4CA87302EBDAD5FA08645131A8474A74CD46AF067CD1D4C5FE13CEEA5831
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/F6AC227E.png	TIFF image data, big-endian, direntries=16, height=49, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=46	87B7FC2C2A79EA2FA4705FD564ACAC99	D378C98204F92880C7C85D8A2DDF18FBB6F1DFC8	EF705B4FB9C9E9FE138EC9586AC1C2FF6BA0BA16F634635D7B4C6EBDBE5C53FD
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/F8DD4C2D.png	TIFF image data, big-endian, direntries=16, height=48, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=41	19B2A2548B83F926E7EEB747B2E3D017	DFEBC979E9F1ACE17F95A822593AAA720F385ACB	82A098E9C26958DA49AE805EED8D53293D13894A503647FFE7C2CCB818B521FF
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/Content.MSO/FE743648.png	TIFF image data, big-endian, direntries=16, height=46, bps=0, compression=none, PhotometricIntepretation=RGB, orientation=upper-left, width=46	89A947D32137A2156E82D0A35D8F9E3A	CC2C6CE0DDD564BA3DA956813E97DE98861627F3	A67B440C16949E733E6E81A4C84237E849FCFC39BBC5B3584683EB2F7CCE2082
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/TemporaryItems/(A Document Being Saved By Word)/ProofingPrefs.plist	XML 1.0 document, ASCII text	A2F4E97D989E07C76DDB850426653D74	42D1C11B97E2E5CAE9E93D8034ADDBA706A80818	2852065E24B14768CAA66E929FB42AFCB42223BCF26076B6B68C72907EEEA7A9
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/TemporaryItems/(A Document Being Saved By Word)/ci.plist	Apple binary property list	4A6EAEF73E956D194C0A6097E25F2408	CF2A5A98CD62A9DB99E2BC45894CD6B80D31386A	868970D5EF70AB113AFE61286EB79584016FC06C040FD7E88760CB8F90B47EDC
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/TemporaryItems/(A Document Being Saved By Word)/com.microsoft.Word.securebookmarks.plist	XML 1.0 document, ASCII text	6372BECFAE880E906A07BF92B893307F	90EDFF82EE4BE503B39B6CB7D548DF0557A10C30	B08EFAE23383C089A224C9A5315FAB60E8B32BED45DDE72A298E6DBFFAAD2EA9
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/mso00025981	GIF image data, version 89a, 15 x 15	ED3C1C40B68BA4F40DB15529D5443DEC	831AF99BB64A04617E0A42EA898756F9E0E0BCCA	039FE79B74E6D3D561E32D4AF570E6CA70DB6BB3718395BE2BF278B9E601279A
/private/var/log/wifi.log.0.bz2	bzip2 compressed data, block size = 900k	DEB65EDE226057700999067267651227	E6ADCC280D85021F170FCB32D8A038D6CCAD475C	D8935C08E78F54D26044017DD851647CEBF2144544E9FD3A1BA2E07D89379BAB

Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49347 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.248.207.68:443 -> 192.168.11.12:49348 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49349 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49352 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49482 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49486 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49488 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49490 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.8:443 -> 192.168.11.12:49503 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.8:443 -> 192.168.11.12:49504 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.8:443 -> 192.168.11.12:49506 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49513 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49514 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49515 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49516 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49517 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49518 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49522 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.207.69
Source: unknown	TCP traffic detected without corresponding DNS query: 184.51.216.242
Source: unknown	TCP traffic detected without corresponding DNS query: 184.51.216.242
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /2024/patches/052-54451/D609556E-69B1-482E-9C33-B2E3510A1311/com_apple_MobileAsset_TimeZoneUpdate/c5a4d0df08e8faecf4faebbbadc4d96a07d9d990.zip HTTP/1.1Host: updates.cdn-apple.comAccept: /Accept-Language: en-usConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: mobileassetd (unknown version) CFNetwork/976 Darwin/18.2.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /2024/patches/062-08173/234EE7F7-CC33-4CD3-85FC-60590A103560/com_apple_MobileAsset_CoreSuggestions/84f6102e2a09dd10dd694d795792a7771b6014fc.zip HTTP/1.1Host: updates.cdn-apple.comAccept: /Accept-Language: en-usConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: mobileassetd (unknown version) CFNetwork/976 Darwin/18.2.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /2021/mobileassets/041-40471/B96AF6E1-5FF6-4786-9956-944A1AFE086A/com_apple_MobileAsset_KextDenyList/404087a7302927411b6ea0e05114d2c68355185e.zip HTTP/1.1Host: updates.cdn-apple.comAccept: /Accept-Language: en-usConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: mobileassetd (unknown version) CFNetwork/976 Darwin/18.2.0 (x86_64)

Source: global traffic	DNS traffic detected: DNS query: updates.cdn-apple.com
Source: global traffic	DNS traffic detected: DNS query: h3.apis.apple.map.fastly.net

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)

Reads from socket in process: data

Jump to behavior

Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: ProofingPrefs.plist.260.dr, com.microsoft.Word.securebookmarks.plist.260.dr, MeContact.plist.260.dr, login.keychain-db.sb-07d82885-p2be2j.260.dr	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.aadrm.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.aadrm.com/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.cortana.ai
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.microsoftstream.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.office.net
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.onedrive.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://api.scheduler.
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://app.powerbi.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://augloop.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://augloop.office.com/v2
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://cdn.entity.
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://clients.config.office.net
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://clients.config.office.net/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://config.edge.skype.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://cortana.ai
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://cortana.ai/api
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://cr.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://d.docs.live.net
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://designerapp.officeapps.live.com/designerapp
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://dev.cortana.ai
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://devnull.onenote.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://directory.services.
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://ecs.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://edge.skype.com/registrar/prod
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://edge.skype.com/rps
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://graph.windows.net
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://graph.windows.net/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://ic3.teams.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://invites.office.com/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://lifecycle.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://login.microsoftonline.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://login.microsoftonline.com/organizations
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://login.windows.local
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://make.powerautomate.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://management.azure.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://management.azure.com/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://messaging.action.office.com/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://messaging.office.com/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://ncus.contentsync.
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://officeapps.live.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://officepyservice.office.net/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://officepyservice.office.net/service.functionality
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://onedrive.live.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://otelrules.svc.static.microsoft
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://outlook.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://outlook.office.com/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://outlook.office365.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://outlook.office365.com/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://outlook.office365.com/connectors
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://powerlift.acompli.net
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://pushchannel.1drv.ms
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://res.cdn.office.net
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.40
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://res.cdn.office.net/polymer/models
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://service.powerapps.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://settings.outlook.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://staging.cortana.ai
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://substrate.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://tasks.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://templatesmetadata.office.net/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://webshell.suite.office.com
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://wus2.contentsync.
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	String found in binary or memory: https://www.yammer.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49348
Source: unknown	Network traffic detected: HTTP traffic on port 49517 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49347
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49522
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49488
Source: unknown	Network traffic detected: HTTP traffic on port 49515 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49486
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49482
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49518
Source: unknown	Network traffic detected: HTTP traffic on port 49514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49517
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49516
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49515
Source: unknown	Network traffic detected: HTTP traffic on port 49348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49514
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49513
Source: unknown	Network traffic detected: HTTP traffic on port 49352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49327 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49518 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49482 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49516 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49352
Source: unknown	Network traffic detected: HTTP traffic on port 49522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49490
Source: unknown	Network traffic detected: HTTP traffic on port 49503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49504 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49506 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49513 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49490 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49347 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49506
Source: unknown	Network traffic detected: HTTP traffic on port 49349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49504
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49349
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49327
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49503

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)

Writes from socket in process: data

Jump to behavior

Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49347 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.248.207.68:443 -> 192.168.11.12:49348 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49349 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49352 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49482 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49486 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49488 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49490 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.8:443 -> 192.168.11.12:49503 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.8:443 -> 192.168.11.12:49504 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.8:443 -> 192.168.11.12:49506 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49513 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49514 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49515 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49516 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49517 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49518 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49522 version: TLS 1.2

Document contains embedded VBA macros

Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	OLE indicator, VBA macros: true
Source: CatalogCacheMetaData.xml.260.dr	OLE indicator, VBA macros: true
Source: microsoft word_Rules.xml.260.dr	OLE indicator, VBA macros: true

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: BBF98802-4CD4-CD4C-9154-911C4F032D58.260.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: CatalogCacheMetaData.xml.260.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: microsoft word_Rules.xml.260.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: classification engine

Classification label: clean2.macDOCX@0/122@2/0

Source: 9A - Khensu - (Pachons) 2025.docx

OLE indicator, Word Document stream: true

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)	Random device file read: /dev/urandom	Jump to behavior
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)	Random device file read: /dev/urandom	Jump to behavior
Source: /usr/libexec/firmwarecheckers/eficheck/eficheck (PID: 669)	Random device file read: /dev/random	Jump to behavior

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)

AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist

Jump to behavior

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)

Log file created: /Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Caches/Microsoft/uls/com.microsoft.Word/logs/apple-device-log-20240703-0049.log

Jump to dropped file

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/TemporaryItems/(A Document Being Saved By Word)/ci.plist	Jump to dropped file
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)	XML plist file created: /Users/bernard/Library/Group Containers/UBF8T346G9.Office/MeContact.plist	Jump to dropped file
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)	XML plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/TemporaryItems/(A Document Being Saved By Word)/com.microsoft.Word.securebookmarks.plist	Jump to dropped file
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)	XML plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Word/TemporaryItems/(A Document Being Saved By Word)/ProofingPrefs.plist	Jump to dropped file
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)	Binary plist file created: /Users/bernard/Library/Containers/com.microsoft.Word/Data/Library/Caches/com.microsoft.ctrlstrcaches/com.microsoft.Word.ctrlstrcache.en.plist	Jump to dropped file

Reads hardware related sysctl values

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)	Sysctl read request: hw.availcpu (6.25)			Jump to behavior
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)	Sysctl read request: hw.ncpu (6.3)			Jump to behavior

Reads the systems OS release and/or type

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)	Sysctl requested: kern.ostype (1.1)			Jump to behavior
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)	Sysctl requested: kern.osrelease (1.2)			Jump to behavior

Reads the systems hostname

Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)

Sysctl requested: kern.hostname (1.10)

Jump to behavior

Source: /usr/bin/open (PID: 620)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word (PID: 621)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior

ID:	1466596
Product:	CloudBasic
Start time:	07:48:05
Start date:	03.07.2024
Sample:	9A - Khensu - (Pachons) 2025.docx
Cookbook:	defaultmacfilecookbook.jbs
System description:	Virtual Machine, Mojave (Office 16 16.27, Java 11.0.2+9, Adobe Reader 2019.010.20099)
Architecture:	MAC
MD5:	8d96b29acbca3c42bbd0bbe36bcab29b
SHA1:	a9e917aef1a262b2fa6d31c8c5599edb351b71af
SHA256:	d41d7d88064912873737e9f9d1f9cd5c93c34f0c88628ca1e76e5db30b7cc832
Filetype:	Word Microsoft Office Open XML Format document (49504/1) 58.23%

macOS Analysis Report
9A - Khensu - (Pachons) 2025.docx

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Persistence and Installation Behavior

Language, Device and Operating System Detection

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

macOS Analysis Report 9A - Khensu - (Pachons) 2025.docx

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Persistence and Installation Behavior

Language, Device and Operating System Detection

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

macOS Analysis Report
9A - Khensu - (Pachons) 2025.docx