macOS Analysis Report
Presentation.pptx

Overview

General Information

Sample name:	Presentation.pptx
Analysis ID:	1523864
MD5:	d6fe5c7469058b496c0eb7882bd99934
SHA1:	051f36a8d8b3134e163981f4ae4a0548853e7fe8
SHA256:	0441d5351a8829f35050985ebd60d7bd113eedd4747889b904588b84909148eb
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false

Signatures

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

Reads hardware related sysctl values

Reads the systems OS release and/or type

Reads the systems hostname

Classification

Signatures

Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49352 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.253.13.134:443 -> 192.168.11.12:49353 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.253.13.134:443 -> 192.168.11.12:49354 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.253.13.134:443 -> 192.168.11.12:49355 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.253.13.134:443 -> 192.168.11.12:49356 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.253.13.134:443 -> 192.168.11.12:49360 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.253.13.134:443 -> 192.168.11.12:49362 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.253.13.134:443 -> 192.168.11.12:49361 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.8:443 -> 192.168.11.12:49364 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.8:443 -> 192.168.11.12:49365 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.8:443 -> 192.168.11.12:49366 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49489 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49490 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49491 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49492 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49493 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49494 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49498 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49501 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49502 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49503 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49504 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.201.67
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.201.67
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.201.67
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.201.67
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.201.67
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.201.67
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134

Source: global traffic	HTTP traffic detected: GET /assets/macos/com_apple_MobileAsset_KextDenyList/com_apple_MobileAsset_KextDenyList.xml HTTP/1.1Host: mesu.apple.comAccept: /If-Modified-Since: Tue, 06 Apr 2021 18:14:44 GMTUser-Agent: MobileAsset/1.1Accept-Language: en-usAccept-Encoding: br, gzip, deflateConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /assets/macos/com_apple_MobileAsset_Font5/com_apple_MobileAsset_Font5.xml HTTP/1.1Host: mesu.apple.comAccept: /If-Modified-Since: Tue, 24 Mar 2020 18:25:48 GMTUser-Agent: MobileAsset/1.1Accept-Language: en-usAccept-Encoding: br, gzip, deflateConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /assets/macos/com_apple_MobileAsset_PKITrustSupplementals/com_apple_MobileAsset_PKITrustSupplementals.xml HTTP/1.1Host: mesu.apple.comAccept: /If-Modified-Since: Tue, 09 Apr 2019 19:09:54 GMTUser-Agent: MobileAsset/1.1Accept-Language: en-usAccept-Encoding: br, gzip, deflateConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /assets/macos/com_apple_MobileAsset_routined_defaults/com_apple_MobileAsset_routined_defaults.xml HTTP/1.1Host: mesu.apple.comAccept: /If-Modified-Since: Tue, 25 Jun 2019 19:58:17 GMTUser-Agent: MobileAsset/1.1Accept-Language: en-usAccept-Encoding: br, gzip, deflateConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /2021/mobileassets/041-40471/B96AF6E1-5FF6-4786-9956-944A1AFE086A/com_apple_MobileAsset_KextDenyList/404087a7302927411b6ea0e05114d2c68355185e.zip HTTP/1.1Host: updates.cdn-apple.comAccept: /Accept-Language: en-usConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: mobileassetd (unknown version) CFNetwork/976 Darwin/18.2.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /2024/patches/052-54451/D609556E-69B1-482E-9C33-B2E3510A1311/com_apple_MobileAsset_TimeZoneUpdate/c5a4d0df08e8faecf4faebbbadc4d96a07d9d990.zip HTTP/1.1Host: updates.cdn-apple.comAccept: /Accept-Language: en-usConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: mobileassetd (unknown version) CFNetwork/976 Darwin/18.2.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /2024/patches/062-08173/234EE7F7-CC33-4CD3-85FC-60590A103560/com_apple_MobileAsset_CoreSuggestions/84f6102e2a09dd10dd694d795792a7771b6014fc.zip HTTP/1.1Host: updates.cdn-apple.comAccept: /Accept-Language: en-usConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: mobileassetd (unknown version) CFNetwork/976 Darwin/18.2.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /assets/macos/com_apple_MobileAsset_KextDenyList/com_apple_MobileAsset_KextDenyList.xml HTTP/1.1Host: mesu.apple.comAccept: /If-Modified-Since: Tue, 06 Apr 2021 18:14:44 GMTUser-Agent: MobileAsset/1.1Accept-Language: en-usAccept-Encoding: br, gzip, deflateConnection: keep-alive

Source: global traffic

DNS traffic detected: DNS query: h3.apis.apple.map.fastly.net

Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	Reads from socket in process: data			Jump to behavior
Source: /Applications/Microsoft PowerPoint.app/Contents/SharedSupport/Office365ServiceV2.app/Contents/MacOS/Office365ServiceV2 (PID: 632)	Reads from socket in process: data			Jump to behavior

Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: login.keychain-db.sb-07d82885-3EdlEq.277.dr, com.microsoft.Powerpoint.securebookmarks.plist.264.dr, login.keychain-db.sb-07d82885-4RT1zY.264.dr	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.aadrm.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.aadrm.com/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.cortana.ai
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.microsoftstream.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.office.net
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.onedrive.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.scheduler.
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://app.powerbi.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://augloop.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://augloop.office.com/v2
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://canary.designerapp.
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/fonts
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-assets
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-dynamic-strings
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-home-screen
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://cdn.entity.
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://clients.config.office.net
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://clients.config.office.net/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://cortana.ai
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://cortana.ai/api
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://cr.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://d.docs.live.net
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://designerapp.azurewebsites.net
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://dev.cortana.ai
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://devnull.onenote.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://directory.services.
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://ecs.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://edge.skype.com/registrar/prod
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://edge.skype.com/rps
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://graph.windows.net
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://graph.windows.net/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://ic3.teams.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://invites.office.com/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://lifecycle.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://login.microsoftonline.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://login.microsoftonline.com/organizations
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://login.windows.local
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://make.powerautomate.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://management.azure.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://management.azure.com/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://messaging.action.office.com/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://messaging.office.com/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://mss.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://ncus.contentsync.
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://officeapps.live.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://officepyservice.office.net/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://officepyservice.office.net/service.functionality
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://onedrive.live.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://otelrules.svc.static.microsoft
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://outlook.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://outlook.office.com/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://outlook.office365.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://outlook.office365.com/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://outlook.office365.com/connectors
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://powerlift.acompli.net
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://pushchannel.1drv.ms
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://res.cdn.office.net
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.40
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://res.cdn.office.net/polymer/models
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://service.powerapps.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://settings.outlook.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://staging.cortana.ai
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://substrate.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://tasks.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://templatesmetadata.office.net/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://webshell.suite.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://wus2.contentsync.
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://www.yammer.com

Source: unknown	Network traffic detected: HTTP traffic on port 49351 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49502
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49347
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49501
Source: unknown	Network traffic detected: HTTP traffic on port 49370 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49355 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49361 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49493 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49365 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49494
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49493
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49492
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49370
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49491
Source: unknown	Network traffic detected: HTTP traffic on port 49354 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49490
Source: unknown	Network traffic detected: HTTP traffic on port 49503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49490 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49360 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49347 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49498 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49364 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49489
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49366
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49365
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49364
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49362
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49361
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49360
Source: unknown	Network traffic detected: HTTP traffic on port 49353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49489 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49491 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49356
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49355
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49354
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49353
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49352
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49351
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49350
Source: unknown	Network traffic detected: HTTP traffic on port 49501 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49356 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49504 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49492 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49366 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49504
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49503

Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	Writes from socket in process: data			Jump to behavior
Source: /Applications/Microsoft PowerPoint.app/Contents/SharedSupport/Office365ServiceV2.app/Contents/MacOS/Office365ServiceV2 (PID: 632)	Writes from socket in process: data			Jump to behavior

Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49352 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.253.13.134:443 -> 192.168.11.12:49353 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.253.13.134:443 -> 192.168.11.12:49354 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.253.13.134:443 -> 192.168.11.12:49355 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.253.13.134:443 -> 192.168.11.12:49356 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.253.13.134:443 -> 192.168.11.12:49360 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.253.13.134:443 -> 192.168.11.12:49362 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.253.13.134:443 -> 192.168.11.12:49361 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.8:443 -> 192.168.11.12:49364 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.8:443 -> 192.168.11.12:49365 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.8:443 -> 192.168.11.12:49366 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49489 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49490 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49491 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49492 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49493 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49494 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49498 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49501 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49502 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49503 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49504 version: TLS 1.2

Document contains embedded VBA macros

Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	OLE indicator, VBA macros: true
Source: CatalogCacheMetaData.xml.264.dr	OLE indicator, VBA macros: true
Source: microsoft powerpoint_Rules.xml.264.dr	OLE indicator, VBA macros: true

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: CatalogCacheMetaData.xml.264.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: microsoft powerpoint_Rules.xml.264.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: classification engine

Classification label: clean2.macPPTX@0/56@1/0

Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	Random device file read: /dev/urandom	Jump to behavior
Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	Random device file read: /dev/urandom	Jump to behavior
Source: /Applications/Microsoft PowerPoint.app/Contents/SharedSupport/Office365ServiceV2.app/Contents/MacOS/Office365ServiceV2 (PID: 632)	Random device file read: /dev/urandom	Jump to behavior
Source: /usr/libexec/firmwarecheckers/eficheck/eficheck (PID: 661)	Random device file read: /dev/random	Jump to behavior

Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist			Jump to behavior
Source: /Applications/Microsoft PowerPoint.app/Contents/SharedSupport/Office365ServiceV2.app/Contents/MacOS/Office365ServiceV2 (PID: 632)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist			Jump to behavior

Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	Log file created: /Users/bernard/Library/Containers/com.microsoft.Powerpoint/Data/Library/Caches/Microsoft/uls/com.microsoft.Powerpoint/logs/apple-device-log-20241001-2303.log			Jump to dropped file
Source: /Applications/Microsoft PowerPoint.app/Contents/SharedSupport/Office365ServiceV2.app/Contents/MacOS/Office365ServiceV2 (PID: 632)	Log file created: /Users/bernard/Library/Containers/com.microsoft.Office365ServiceV2/Data/Library/Caches/Microsoft/uls/com.microsoft.Office365ServiceV2/logs/apple-device-log-20241001-2303.log			Jump to dropped file

Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Powerpoint/TemporaryItems/(A Document Being Saved By PowerPoint)/ci.plist	Jump to dropped file
Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	XML plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Powerpoint/TemporaryItems/(A Document Being Saved By PowerPoint)/com.microsoft.Powerpoint.securebookmarks.plist	Jump to dropped file
Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	Binary plist file created: /Users/bernard/Library/Containers/com.microsoft.Powerpoint/Data/Library/Caches/com.microsoft.ctrlstrcaches/com.microsoft.Powerpoint.ctrlstrcache.en.plist	Jump to dropped file
Source: /Applications/Microsoft PowerPoint.app/Contents/SharedSupport/Office365ServiceV2.app/Contents/MacOS/Office365ServiceV2 (PID: 632)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Office365ServiceV2/TemporaryItems/(A Document Being Saved By Office365ServiceV2)/ci.plist	Jump to dropped file

Reads hardware related sysctl values

Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	Sysctl read request: hw.availcpu (6.25)	Jump to behavior
Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	Sysctl read request: hw.ncpu (6.3)	Jump to behavior
Source: /Applications/Microsoft PowerPoint.app/Contents/SharedSupport/Office365ServiceV2.app/Contents/MacOS/Office365ServiceV2 (PID: 632)	Sysctl read request: hw.availcpu (6.25)	Jump to behavior

Reads the systems OS release and/or type

Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	Sysctl requested: kern.ostype (1.1)			Jump to behavior
Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	Sysctl requested: kern.osrelease (1.2)			Jump to behavior

Reads the systems hostname

Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)

Sysctl requested: kern.hostname (1.10)

Jump to behavior

Source: /usr/bin/open (PID: 625)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /Applications/Microsoft PowerPoint.app/Contents/SharedSupport/Office365ServiceV2.app/Contents/MacOS/Office365ServiceV2 (PID: 632)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /Applications/Microsoft PowerPoint.app/Contents/SharedSupport/Office365ServiceV2.app/Contents/MacOS/Office365ServiceV2 (PID: 632)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
151.101.3.8	appledownload.map.fastly.net	United States	54113	FASTLYUS	false
23.213.224.212	unknown	United States	5432	PROXIMUS-ISP-ASBE	false
151.101.131.6	unknown	United States	54113	FASTLYUS	false
151.101.195.6	h3.apis.apple.map.fastly.net	United States	54113	FASTLYUS	false

Contacted Domains

Name	IP	Active
appledownload.map.fastly.net	151.101.3.8	true
h3.apis.apple.map.fastly.net	151.101.195.6	true

Name	Type	MD5	SHA1	SHA256
/Users/bernard/Desktop/~$Presentation.pptx	data	ADE111F47BD4B3DBE23C62618723CF48	C9D1D88EE24C00193621A1A7319AA0A1D50E25A3	E5D9F4F74D6FE2DB47DA505A6B20D5209F925F13FDD35D06E4F7CF7FC3EDD600
/Users/bernard/Library/Containers/com.microsoft.Office365ServiceV2/Data/Library/Caches/Microsoft/uls/com.microsoft.Office365ServiceV2/logs/apple-device-log-20241001-2303.log	ASCII text, with very long lines (10444), with CRLF line terminators	6B7897793569B90975981D4A1351E7C0	25798E59252452417E62ED3765A39CAB86866EE7	3B12B8BB3B489FF69DAFCC87CC7F40E9CE0BFB1B5A9A8A6E33A828B77898AD0C
/Users/bernard/Library/Containers/com.microsoft.Powerpoint/Data/Library/Application Support/Microsoft/FontCache/systemfontmetadata.json	JSON data	C001A613A117D3CD9536B257280C7274	4DDBDFCA63E5A98D45E6DF0F577352F189BF27E1	00391D628C8EE3A28FF853B3107E01C352131B23F814EA73BC0218015B481F58
/Users/bernard/Library/Containers/com.microsoft.Powerpoint/Data/Library/Application Support/Microsoft/GraphicsCache/1/CatalogCacheMetaData.xml	XML 1.0 document, ASCII text, with very long lines (13120), with no line terminators	4516DDD02410825E263C6C19B561797C	1AD477A6767F0BF407C2ED25FEF4BAC773888661	4028D470F67E4D83040123E58B81ABF1675BF26E262515F2DB28066EB67D9F6D
/Users/bernard/Library/Containers/com.microsoft.Powerpoint/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectbronze_apple.jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 405x405, components 3	D8570FC799DD7D35BFED4D3098AB3E9D	7A1F0C7021BA61AEBD29E241AADCEDFB85C3642A	881266FF8DF6E91E4101F9C6F8E01B2241FFCAA680A1B26292165AFD0F14E5FC
/Users/bernard/Library/Containers/com.microsoft.Powerpoint/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectgalaxy_apple.jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 405x405, components 3	F2D3F4899AA489D5EC478DC7C3CBB5FB	6E3DAE737EBE40F38917D7C07B28CAFCF5555CD9	269197FEC12A677913CF6C9BB2F9B2A8B74EA4F5C52E578E89E1D9D2732229C5
/Users/bernard/Library/Containers/com.microsoft.Powerpoint/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectgold_apple.jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 405x405, components 3	0C4305204BE8030648DEEF0A6B772B85	00CFC8282A6DFCD01353A4A1636483B3FA59D850	D5BDD3A022CB46E5810D32264052D038B9E3FE7FE6B4D1D5A315E1379D568399
/Users/bernard/Library/Containers/com.microsoft.Powerpoint/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectlava_apple.jpg	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 405x405, components 3	C7115E54CE318F1A9F243008FE422AB1	D3BF56888DA8112AA15189ED66BEDAE83AE8433C	F831E10750920FE6B3B05E3B0F91A31FF87F4C84DC4A3210AA47ECC9C75455C1
/Users/bernard/Library/Containers/com.microsoft.Powerpoint/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectocean_apple.jpg	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 405x405, components 3	1291BC2D361ADFECECE17FC4BA39955B	A0D8349ECC1C87EA15E653E7DA0BB9D7F6A41888	73B734D4F546848D1ABDC4D5B97AF096B8503A4BF3ADC476B7F87E123C87377F
/Users/bernard/Library/Containers/com.microsoft.Powerpoint/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectrainbowglitter_apple.jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 405x405, components 3	1D6620FEF62D8E0D2429F0875C3BD004	8A1B52DE18DBF5F401B6D2E9BFA195870F9AED1B	38373A0F2AE2B95162802E45582602AA99CCF76595D1BC27DA32A95FB594F983
/Users/bernard/Library/Containers/com.microsoft.Powerpoint/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectrosegold_apple.jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 405x405, components 3	FD87DBA2227C56D76B7BF324A34C271E	B1F283D5614B416802E132B9789FE9B983688D6E	289FB85EC85BC9EBBC01F858F8E0ACA2A38BE697FF5217F96CBF0652CBC6AF1E
/Users/bernard/Library/Containers/com.microsoft.Powerpoint/Data/Library/Application Support/Microsoft/GraphicsCache/1/CloudGraphicsResources/Graphics/inkeffectsilver_apple.jpg	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 405x405, components 3	72EDB703DA3FFA41A82650CC167CFA64	BD5357D5A8434DAC612038A1CA409C44B926E4A6	E56DBDF74A0D097769378CDBD44E3C967BAE4B83E932784A909575149E64E24D
/Users/bernard/Library/Containers/com.microsoft.Powerpoint/Data/Library/Application Support/Microsoft/GraphicsCache/1/oart.json	JSON data	53D49444EAF92E0CF5D2985CCAEDE42B	DA2D6C55752243AA5E638750F038DADF3C9FE6CC	722A39658D2F3D5E333874F23485CEA9DA2B79EDA454FA7F5A9FEFBFDB9B2AD8
/Users/bernard/Library/Containers/com.microsoft.Powerpoint/Data/Library/Application Support/Microsoft/Office/16.0/Floodgate/PowerPoint.CampaignStates.json	JSON data	99E8312CFB1B70567C15197379D3048B	F15D182C42D355F843E7E68DC63330BE741B502D	F366E7F6E7A7E3FCDF7696A168DF462011D401CAC60FB3416E9E25203F98FE47
/Users/bernard/Library/Containers/com.microsoft.Powerpoint/Data/Library/Application Support/Microsoft/Office/16.0/WebServiceCache/AllUsers/officeclient.microsoft.com/C0A390DF-1012-B84C-AA3B-629416397471	XML 1.0 document, ASCII text, with CRLF line terminators	22751DB9A795C6DF6260B686059598C0	D436A8428316B07C989B38859503F45512CAE2B2	9009AC5184E43F433ECEDB7BFC4C022C8B7C0E418AFE84578D8425EC72B997A5
/Users/bernard/Library/Containers/com.microsoft.Powerpoint/Data/Library/Application Support/Microsoft/Office/16.0/microsoft powerpoint_Rules.xml	XML 1.0 document, ASCII text, with very long lines (65536), with no line terminators	13E9B372FB7C2891E8DDD1616180DFE8	87860EAA33E636D31B1F97F3658B9D792393B64B	FB38B658FF115E1D588D415E8BD2469AA3F693CC1E2313200FB3A8BC68B5B353
/Users/bernard/Library/Containers/com.microsoft.Powerpoint/Data/Library/Caches/Microsoft/uls/com.microsoft.Powerpoint/logs/apple-device-log-20241001-2303.log	ASCII text, with very long lines (804), with CRLF line terminators	523E50DB7E3C57844F00BA64ACB946BE	E36D7C90B09D98677D7C7C5CF547291CC19D0C45	BB7226EC843A4A87189FBFEB4E9FCC972501369BA1C59B374A8CFCE31922B3D2
/Users/bernard/Library/Containers/com.microsoft.Powerpoint/Data/Library/Caches/com.microsoft.ctrlstrcaches/com.microsoft.Powerpoint.ctrlstrcache.en.plist	Apple binary property list	BB062D78B7F7381BE159328BCABD3D84	4674A61046600CD621CB4F78CA9E7E600D370404	B6700DB9120635C84F1968F3A9620EF1F5AABF4A622BA79A0E1758648B84CD1F
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/ar.strings	Unicode text, UTF-16, little-endian text, with no line terminators	4776CB70FE00BC6AEB696B410A3DCEEE	5AAB4C605B9B31312F317672DA960D4E1CADE04C	2E7A61627DEE2B425849E0682E244E6E85F8E44C056FF3F6073DF86C189BCFA6
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/cs.strings	Unicode text, UTF-16, little-endian text, with no line terminators	586346536BCA4E3DDD3C38A9C1F17DC0	093794E09D9B3BE6FB85FA9EE01BED3AEEDA7875	65BAAA09B58FCE46EB14351A8393DF64EFC090F495D01F35B3FF0D13EB5D0169
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/da.strings	Unicode text, UTF-16, little-endian text, with no line terminators	CF843AE5C1B90B1B55283AF897B542D3	B3BF056D596C71B7748E54506095759939D9B4B4	B6D0DAEB079285256C87445E5AAB178D4E62FED927344C08CC2CBEABF809E451
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/de.strings	Unicode text, UTF-16, little-endian text, with no line terminators	FAC73D0043DAC6F75608769E9F61ED19	2BC5131486F2D11C046C5F8F318EF0304BD9D83D	ECD6E22F111F573A0DE236CAD9A47F03B40CFEE8487778E140CB2CE032E6509D
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/el.strings	Unicode text, UTF-16, little-endian text, with no line terminators	F4D2E086599074426AC6A837DB387511	6C45111E53BC020B1CB3C212F54B0FBB6D09DDE2	D8FF17F32E934DAB1C8316027821AE5038E40930D6FBCFD742A5DF3B1C7DC056
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/en.strings	Unicode text, UTF-16, little-endian text, with no line terminators	33710D103D50C71EAF39988FB87D38E4	7D3CA7064D7B04833810468367B856B99FD800B3	CA4EBED01FEDD706C103D024A3B07B387D970386FA06EDF69B80C138091FE04C
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/es.strings	Unicode text, UTF-16, little-endian text, with no line terminators	7F7EB49E58EDD8EF1A733E81D9B3BF89	AE6E8541E61D7EEB80111F3CA865DDE5543E1E14	045C0D75E98636B8BFEA50A73ACE6A1ABFB58AFAEF095CFA17FB3496E651E561
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/fi.strings	Unicode text, UTF-16, little-endian text, with no line terminators	EAAA665A7EC2260626D5A6F81FBFD2D5	318A5BC91DB8C5A1DF234AC230A6E189428C7CDA	72C062C61C574212A40F01F192B4FB139A7BFE660EAE27F449EC4F3D316B6F57
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/fr.strings	Unicode text, UTF-16, little-endian text, with no line terminators	94D951325E7CAD48A4EF7AFC1E8C84AB	B64D44502252F8489EF3A8AB5769B3B626768C1F	D5193640F18E4B4C810E1260B1D7DAD83865A4747C24B6052604D67968AB4936
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/he.strings	Unicode text, UTF-16, little-endian text, with no line terminators	DABCD4CC05E8583AD885AB3AF975C56F	F2ACFABCC2604B25B4970BA0803A27EDDA8D1E9B	50188525648F74467732C32701BBBF3A5CFB9BA8F57872C550B3F95768C335F1
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/hu.strings	Unicode text, UTF-16, little-endian text, with no line terminators	2133A797E4A7634E9EC97C7428AF3C22	7695F54E21462CAE42E5DE87121C3BD7CC604FEF	BCB4A4868E6E463F0D96BF2833432C615EDE7A5EE9BFD25CAA3AEA671F2B0255
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/id.strings	Unicode text, UTF-16, little-endian text, with no line terminators	41FF3F9EE6BA77DFA346D568AAFF38D0	81CEEF719DCC9E32D3E0A879C4E8629DE02F32E5	4B5096C36C4500677C01D2F23AB9429DF9F51F8BF1DCA8039283ABC939281C15
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/it.strings	Unicode text, UTF-16, little-endian text, with no line terminators	5BDBDA0D0D7B502F463363BAE5D3ECEE	01A8FF8F4437820AB135A252AF486D5F865866C1	A337EAA4E641DA88B9A089AC343D0B5F545AF2F847A419747FA0253D91F256BA
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/ja.strings	Unicode text, UTF-16, little-endian text, with no line terminators	DF7C9EEBC6BB4E445EC58AD78D2936E3	6400EF54A15F72B324A380F8568F78F2C77C2D27	2DBD602F439E649DFFAADFF9E60FFF16220B5C706EC2DC4E7053B1DACDAE03BC
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/ko.strings	Unicode text, UTF-16, little-endian text, with no line terminators	8D088E90F5572158094887333B425415	0107D6C2460C36AC8EFD587797709AF3ADFF4101	AD7461D4337C3DA696615DB1E4DFB5D675BAD15C861B003EB1FE2AA1C347618E
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/nl.strings	Unicode text, UTF-16, little-endian text, with no line terminators	F970AB662E0D5EDB33B8041F23EE9A58	31959CE6AF90382C2B3881F439B0D3D890CC5A78	A288EFF6B89359C87D609195A1B47D2F2C42A83A24B104DB1463CF2B129196ED
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/no.strings	Unicode text, UTF-16, little-endian text, with no line terminators	24688CC64A3232577FB669D5847627B1	C808CBD9D557ECE65F1564B49E679CEBC4DEB274	6F238BBE013D855C7C834D32D1C7D108137FBB2835234F68CAEE0BCCA37ECA9A
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/pl.strings	Unicode text, UTF-16, little-endian text, with no line terminators	B439AD1AEDEAA9BD4296C772FD48E3B4	61731198375551623B254122B402F70ABEDD24F3	D6A65D7D6EAB2B75204E4474A5A75EC012317AB828D42C36F1E998D26F75BCB0
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/pt.strings	Unicode text, UTF-16, little-endian text, with no line terminators	27009EE68674F9397E53699A4D251B0E	8E7A79D6B5470E63095B636FB17457F56905EA0F	7DAB4E34E50E7A7CF0ED44E7D82829825AE954AD57E615A7FB43EF3E7A096DBE
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/pt_PT.strings	Unicode text, UTF-16, little-endian text, with no line terminators	EB7E26313860F756306FAE9447235174	39CDC7571936BCF089976F83EEA7B6594B2BACCF	D43C25DCE728723725B552D331DC4166C88594E27B285864FBCC7F9609475ED9
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/ru.strings	Unicode text, UTF-16, little-endian text, with no line terminators	9FD7D227240F44B123D930CF82A28ECA	46B89E11FFE358B7229F8E3211119E4F2C234714	75F4B16099AA3CD1CE766AF2E169D7E37CE3F4C66796258F7CBA5163EECA7987
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/sk.strings	Unicode text, UTF-16, little-endian text, with no line terminators	C554AF8796DEC9C0FB07B171AF92587E	7FCDEE38E1C526E1CDD9FD872AADDB1B356EE86E	FBD30B5C7508E7C053A0325E93E08CAC03EEADB62242BDDE31115EAD8B3F94B9
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/sv.strings	Unicode text, UTF-16, little-endian text, with no line terminators	202A6016EBEDA4C0F007446F1D74740D	FC3BB0DCE97AEDC946D7CD000D297DA0E7360B5F	8A073E4FF39595EE3409FD59375B20D838C00E1B477BC7147B54D54126D84409
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/th.strings	Unicode text, UTF-16, little-endian text, with no line terminators	07F749180EDD607107E7FE5BEFCD2B80	D5E16FF9085F3A2B948FAA3ACE755ABFC1750414	C8B9EE7470AF0699A66E7C3266327D175F479343447F646EC72EA4F042EE009E
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/tr.strings	Unicode text, UTF-16, little-endian text, with no line terminators	5BF4A82EAF85BA5AAB07403969D1E379	7DC8A1241C5230A03C009FC5A02FFBD5832685C8	D8BEB30B0B00B7988294091A34E6971FE279F54364AC0BD568A92885952B0A23
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/zh_CN.strings	Unicode text, UTF-16, little-endian text, with no line terminators	7C5F09EEF6C3BA4DE766EE9543698C1F	54BBE49811B5BD941CC926BAC101E8B03BBE3EAB	771161AF6389886C05A9C5B64878A9B9348A83FFDBF84DA23E2ACED033E2CB80
/Users/bernard/Library/Group Containers/UBF8T346G9.Office/User Content.localized/Proofing Tools.localized/.localized/zh_TW.strings	Unicode text, UTF-16, little-endian text, with no line terminators	7B02B52E6E18AE4A18CAE3CA7B42D2C0	87C06B55A63E2C3216E58ECE9DBED2CB9339BC50	25228F342B3C20D7C1E017704538A68B3B55F937D5A9C91D80BAAE339D029AAC
/Users/bernard/Library/Keychains/login.keychain-db.sb-07d82885-3EdlEq	DIY-Thermocam raw data (Lepton 3.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 963362762505407623593984.000000, slope 303834226087943251262072422400.000000	B1DA7C06A13441AD7AA1B33C7D1952F9	17A96891A3A00762EFF6CD14021045D653D3AF8C	496B6DE2FB1C959D0F7327C29F5DFFDD1C0D241A81071C76F8FBD3ABEBC4146C
/Users/bernard/Library/Keychains/login.keychain-db.sb-07d82885-4RT1zY	DIY-Thermocam raw data (Lepton 3.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 963362762505407623593984.000000, slope 303834226087943251262072422400.000000	3F7E80B94364CF6D54AF53A85D0DF3C7	0B6C9F681357EC5EE023884DF79ECF69867D32D7	BE349E11A506BF7924055A4D44FFE04C883E8159309A91114E4ADC3289224C0F
/dev/null	ASCII text	3CE29A3CCD0CFCC976CE3AD67145652B	D181BAFA69D1A8D23DB9FCBA0BEED7286B0F2913	40135ADCCD75C915328C513C5E33215F203A1C7DE7F6BCC9756CE9E136DF5D12
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.microsoft.Office365ServiceV2/mds/mdsDirectory.db_	Mac OS X Keychain File	0E4A0D1CEB2AF6F0F8D0167CE77BE2D3	414BA4C1DC5FC8BF53D550E296FD6F5AD669918C	CCA093BCFC65E25DD77C849866E110DF72526DFFBE29D76E11E29C7D888A4030
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.microsoft.Office365ServiceV2/mds/mdsObject.db_	Mac OS X Keychain File	D3A1859E6EC593505CC882E6DEF48FC8	F8E6728E3E9DE477A75706FAA95CEAD9CE13CB32	3EBAFA97782204A4A1D75CFEC22E15FCDEAB45B65BAB3B3E65508707E034A16C
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.microsoft.Powerpoint/mds/mdsDirectory.db_	Mac OS X Keychain File	A4C012BBB09B0B19F4A3234F4400E4A9	944771D35DB56488D63544C09418C4235B44E3B2	EAC36EE71C5AE4B6D2024C333C2EB7B6C0415FBFCFC264A5B19C4F10BB0126B8
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.microsoft.Powerpoint/mds/mdsObject.db_	Mac OS X Keychain File	636C97726FA8460EAB35E0996589DB4C	D1BE760E43173671B670A20DED636CD93BCEE7C3	1136941331967FDA088BB15807F23F25EF27E7BFEE1FCCFE1322965857CF23F7
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Office365ServiceV2/TemporaryItems/(A Document Being Saved By Office365ServiceV2)/ci.plist	Apple binary property list	4A6EAEF73E956D194C0A6097E25F2408	CF2A5A98CD62A9DB99E2BC45894CD6B80D31386A	868970D5EF70AB113AFE61286EB79584016FC06C040FD7E88760CB8F90B47EDC
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Powerpoint/TemporaryItems/(A Document Being Saved By PowerPoint)/ci.plist	Apple binary property list	4A6EAEF73E956D194C0A6097E25F2408	CF2A5A98CD62A9DB99E2BC45894CD6B80D31386A	868970D5EF70AB113AFE61286EB79584016FC06C040FD7E88760CB8F90B47EDC
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Powerpoint/TemporaryItems/(A Document Being Saved By PowerPoint)/com.microsoft.Powerpoint.securebookmarks.plist	XML 1.0 document, ASCII text	E22865569DBBCCD26868463EC504AE24	B3374F93E43FAE39C394B501A6CBD1C5EE676FCB	A04062D33D7915D7A9A6429D3C620C0414A6B58869249A481891ED54EBC4C71D

Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49352 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.253.13.134:443 -> 192.168.11.12:49353 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.253.13.134:443 -> 192.168.11.12:49354 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.253.13.134:443 -> 192.168.11.12:49355 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.253.13.134:443 -> 192.168.11.12:49356 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.253.13.134:443 -> 192.168.11.12:49360 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.253.13.134:443 -> 192.168.11.12:49362 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.253.13.134:443 -> 192.168.11.12:49361 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.8:443 -> 192.168.11.12:49364 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.8:443 -> 192.168.11.12:49365 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.8:443 -> 192.168.11.12:49366 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49489 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49490 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49491 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49492 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49493 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49494 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49498 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49501 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49502 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49503 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49504 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.201.67
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.201.67
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.201.67
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.201.67
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.201.67
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.201.67
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.134

Source: global traffic	HTTP traffic detected: GET /assets/macos/com_apple_MobileAsset_KextDenyList/com_apple_MobileAsset_KextDenyList.xml HTTP/1.1Host: mesu.apple.comAccept: /If-Modified-Since: Tue, 06 Apr 2021 18:14:44 GMTUser-Agent: MobileAsset/1.1Accept-Language: en-usAccept-Encoding: br, gzip, deflateConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /assets/macos/com_apple_MobileAsset_Font5/com_apple_MobileAsset_Font5.xml HTTP/1.1Host: mesu.apple.comAccept: /If-Modified-Since: Tue, 24 Mar 2020 18:25:48 GMTUser-Agent: MobileAsset/1.1Accept-Language: en-usAccept-Encoding: br, gzip, deflateConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /assets/macos/com_apple_MobileAsset_PKITrustSupplementals/com_apple_MobileAsset_PKITrustSupplementals.xml HTTP/1.1Host: mesu.apple.comAccept: /If-Modified-Since: Tue, 09 Apr 2019 19:09:54 GMTUser-Agent: MobileAsset/1.1Accept-Language: en-usAccept-Encoding: br, gzip, deflateConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /assets/macos/com_apple_MobileAsset_routined_defaults/com_apple_MobileAsset_routined_defaults.xml HTTP/1.1Host: mesu.apple.comAccept: /If-Modified-Since: Tue, 25 Jun 2019 19:58:17 GMTUser-Agent: MobileAsset/1.1Accept-Language: en-usAccept-Encoding: br, gzip, deflateConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /2021/mobileassets/041-40471/B96AF6E1-5FF6-4786-9956-944A1AFE086A/com_apple_MobileAsset_KextDenyList/404087a7302927411b6ea0e05114d2c68355185e.zip HTTP/1.1Host: updates.cdn-apple.comAccept: /Accept-Language: en-usConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: mobileassetd (unknown version) CFNetwork/976 Darwin/18.2.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /2024/patches/052-54451/D609556E-69B1-482E-9C33-B2E3510A1311/com_apple_MobileAsset_TimeZoneUpdate/c5a4d0df08e8faecf4faebbbadc4d96a07d9d990.zip HTTP/1.1Host: updates.cdn-apple.comAccept: /Accept-Language: en-usConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: mobileassetd (unknown version) CFNetwork/976 Darwin/18.2.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /2024/patches/062-08173/234EE7F7-CC33-4CD3-85FC-60590A103560/com_apple_MobileAsset_CoreSuggestions/84f6102e2a09dd10dd694d795792a7771b6014fc.zip HTTP/1.1Host: updates.cdn-apple.comAccept: /Accept-Language: en-usConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: mobileassetd (unknown version) CFNetwork/976 Darwin/18.2.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /assets/macos/com_apple_MobileAsset_KextDenyList/com_apple_MobileAsset_KextDenyList.xml HTTP/1.1Host: mesu.apple.comAccept: /If-Modified-Since: Tue, 06 Apr 2021 18:14:44 GMTUser-Agent: MobileAsset/1.1Accept-Language: en-usAccept-Encoding: br, gzip, deflateConnection: keep-alive

Source: global traffic

DNS traffic detected: DNS query: h3.apis.apple.map.fastly.net

Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	Reads from socket in process: data			Jump to behavior
Source: /Applications/Microsoft PowerPoint.app/Contents/SharedSupport/Office365ServiceV2.app/Contents/MacOS/Office365ServiceV2 (PID: 632)	Reads from socket in process: data			Jump to behavior

Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: login.keychain-db.sb-07d82885-3EdlEq.277.dr, com.microsoft.Powerpoint.securebookmarks.plist.264.dr, login.keychain-db.sb-07d82885-4RT1zY.264.dr	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.aadrm.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.aadrm.com/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.cortana.ai
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.microsoftstream.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.office.net
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.onedrive.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://api.scheduler.
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://app.powerbi.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://augloop.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://augloop.office.com/v2
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://canary.designerapp.
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/fonts
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-assets
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-dynamic-strings
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-home-screen
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://cdn.entity.
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://clients.config.office.net
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://clients.config.office.net/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://cortana.ai
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://cortana.ai/api
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://cr.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://d.docs.live.net
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://designerapp.azurewebsites.net
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://dev.cortana.ai
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://devnull.onenote.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://directory.services.
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://ecs.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://edge.skype.com/registrar/prod
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://edge.skype.com/rps
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://graph.windows.net
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://graph.windows.net/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://ic3.teams.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://invites.office.com/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://lifecycle.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://login.microsoftonline.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://login.microsoftonline.com/organizations
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://login.windows.local
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://make.powerautomate.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://management.azure.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://management.azure.com/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://messaging.action.office.com/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://messaging.office.com/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://mss.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://ncus.contentsync.
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://officeapps.live.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://officepyservice.office.net/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://officepyservice.office.net/service.functionality
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://onedrive.live.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://otelrules.svc.static.microsoft
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://outlook.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://outlook.office.com/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://outlook.office365.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://outlook.office365.com/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://outlook.office365.com/connectors
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://powerlift.acompli.net
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://pushchannel.1drv.ms
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://res.cdn.office.net
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.40
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://res.cdn.office.net/polymer/models
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://service.powerapps.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://settings.outlook.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://staging.cortana.ai
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://substrate.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://tasks.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://templatesmetadata.office.net/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://webshell.suite.office.com
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://wus2.contentsync.
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	String found in binary or memory: https://www.yammer.com

Source: unknown	Network traffic detected: HTTP traffic on port 49351 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49502
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49347
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49501
Source: unknown	Network traffic detected: HTTP traffic on port 49370 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49355 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49361 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49493 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49365 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49494
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49493
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49492
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49370
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49491
Source: unknown	Network traffic detected: HTTP traffic on port 49354 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49490
Source: unknown	Network traffic detected: HTTP traffic on port 49503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49490 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49360 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49347 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49498 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49364 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49489
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49366
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49365
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49364
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49362
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49361
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49360
Source: unknown	Network traffic detected: HTTP traffic on port 49353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49489 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49491 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49356
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49355
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49354
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49353
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49352
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49351
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49350
Source: unknown	Network traffic detected: HTTP traffic on port 49501 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49356 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49504 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49492 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49366 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49504
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49503

Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	Writes from socket in process: data			Jump to behavior
Source: /Applications/Microsoft PowerPoint.app/Contents/SharedSupport/Office365ServiceV2.app/Contents/MacOS/Office365ServiceV2 (PID: 632)	Writes from socket in process: data			Jump to behavior

Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49352 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.253.13.134:443 -> 192.168.11.12:49353 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.253.13.134:443 -> 192.168.11.12:49354 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.253.13.134:443 -> 192.168.11.12:49355 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.253.13.134:443 -> 192.168.11.12:49356 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.253.13.134:443 -> 192.168.11.12:49360 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.253.13.134:443 -> 192.168.11.12:49362 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.253.13.134:443 -> 192.168.11.12:49361 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.8:443 -> 192.168.11.12:49364 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.8:443 -> 192.168.11.12:49365 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.8:443 -> 192.168.11.12:49366 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49489 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49490 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49491 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49492 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49493 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49494 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49498 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49501 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49502 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49503 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49504 version: TLS 1.2

Document contains embedded VBA macros

Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	OLE indicator, VBA macros: true
Source: CatalogCacheMetaData.xml.264.dr	OLE indicator, VBA macros: true
Source: microsoft powerpoint_Rules.xml.264.dr	OLE indicator, VBA macros: true

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: C0A390DF-1012-B84C-AA3B-629416397471.264.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: CatalogCacheMetaData.xml.264.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: microsoft powerpoint_Rules.xml.264.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: classification engine

Classification label: clean2.macPPTX@0/56@1/0

Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	Random device file read: /dev/urandom	Jump to behavior
Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	Random device file read: /dev/urandom	Jump to behavior
Source: /Applications/Microsoft PowerPoint.app/Contents/SharedSupport/Office365ServiceV2.app/Contents/MacOS/Office365ServiceV2 (PID: 632)	Random device file read: /dev/urandom	Jump to behavior
Source: /usr/libexec/firmwarecheckers/eficheck/eficheck (PID: 661)	Random device file read: /dev/random	Jump to behavior

Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist			Jump to behavior
Source: /Applications/Microsoft PowerPoint.app/Contents/SharedSupport/Office365ServiceV2.app/Contents/MacOS/Office365ServiceV2 (PID: 632)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist			Jump to behavior

Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	Log file created: /Users/bernard/Library/Containers/com.microsoft.Powerpoint/Data/Library/Caches/Microsoft/uls/com.microsoft.Powerpoint/logs/apple-device-log-20241001-2303.log			Jump to dropped file
Source: /Applications/Microsoft PowerPoint.app/Contents/SharedSupport/Office365ServiceV2.app/Contents/MacOS/Office365ServiceV2 (PID: 632)	Log file created: /Users/bernard/Library/Containers/com.microsoft.Office365ServiceV2/Data/Library/Caches/Microsoft/uls/com.microsoft.Office365ServiceV2/logs/apple-device-log-20241001-2303.log			Jump to dropped file

Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Powerpoint/TemporaryItems/(A Document Being Saved By PowerPoint)/ci.plist	Jump to dropped file
Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	XML plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Powerpoint/TemporaryItems/(A Document Being Saved By PowerPoint)/com.microsoft.Powerpoint.securebookmarks.plist	Jump to dropped file
Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	Binary plist file created: /Users/bernard/Library/Containers/com.microsoft.Powerpoint/Data/Library/Caches/com.microsoft.ctrlstrcaches/com.microsoft.Powerpoint.ctrlstrcache.en.plist	Jump to dropped file
Source: /Applications/Microsoft PowerPoint.app/Contents/SharedSupport/Office365ServiceV2.app/Contents/MacOS/Office365ServiceV2 (PID: 632)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.microsoft.Office365ServiceV2/TemporaryItems/(A Document Being Saved By Office365ServiceV2)/ci.plist	Jump to dropped file

Reads hardware related sysctl values

Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	Sysctl read request: hw.availcpu (6.25)	Jump to behavior
Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	Sysctl read request: hw.ncpu (6.3)	Jump to behavior
Source: /Applications/Microsoft PowerPoint.app/Contents/SharedSupport/Office365ServiceV2.app/Contents/MacOS/Office365ServiceV2 (PID: 632)	Sysctl read request: hw.availcpu (6.25)	Jump to behavior

Reads the systems OS release and/or type

Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	Sysctl requested: kern.ostype (1.1)			Jump to behavior
Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	Sysctl requested: kern.osrelease (1.2)			Jump to behavior

Reads the systems hostname

Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)

Sysctl requested: kern.hostname (1.10)

Jump to behavior

Source: /usr/bin/open (PID: 625)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /Applications/Microsoft PowerPoint.app/Contents/MacOS/Microsoft PowerPoint (PID: 626)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /Applications/Microsoft PowerPoint.app/Contents/SharedSupport/Office365ServiceV2.app/Contents/MacOS/Office365ServiceV2 (PID: 632)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /Applications/Microsoft PowerPoint.app/Contents/SharedSupport/Office365ServiceV2.app/Contents/MacOS/Office365ServiceV2 (PID: 632)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior

ID:	1523864
Product:	CloudBasic
Start time:	06:01:57
Start date:	02.10.2024
Sample:	Presentation.pptx
Cookbook:	defaultmacfilecookbook.jbs
System description:	Virtual Machine, Mojave (Office 16 16.27, Java 11.0.2+9, Adobe Reader 2019.010.20099)
Architecture:	MAC
MD5:	d6fe5c7469058b496c0eb7882bd99934
SHA1:	051f36a8d8b3134e163981f4ae4a0548853e7fe8
SHA256:	0441d5351a8829f35050985ebd60d7bd113eedd4747889b904588b84909148eb
Filetype:	PowerPoint Microsoft Office Open XML Format document (133004/1) 76.66%

macOS Analysis Report
Presentation.pptx

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Persistence and Installation Behavior

Language, Device and Operating System Detection

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

macOS Analysis Report Presentation.pptx

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Persistence and Installation Behavior

Language, Device and Operating System Detection

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

macOS Analysis Report
Presentation.pptx