Windows Analysis Report Invoice.xlsm

Overview

General Information

Sample Name: Invoice.xlsm
Analysis ID: 532378
MD5: 41b25400c2b31b922dd090e1251b37b8
SHA1: b543cbb86a4e50506fb9be2ac455e4e606948d65
SHA256: 734577b2ffb53ddf37d71db650178c94c017f8749a9f9497d2f76abd876418a6
Infos:

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score: 76
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Multi AV Scanner detection for submitted file
Antivirus detection for URL or domain
Sigma detected: Microsoft Office Product Spawning Windows Shell
Document exploit detected (process start blacklist hit)
Document exploit detected (UrlDownloadToFile)
Found a hidden Excel 4.0 Macro sheet
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication
Yara detected Xls With Macro 4.0
Detected potential crypto function
Excel documents contains an embedded macro which executes code when the document is opened
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)

Classification

AV Detection:

barindex
Multi AV Scanner detection for submitted file
Source: Invoice.xlsm Virustotal: Detection: 28% Perma Link
Source: Invoice.xlsm ReversingLabs: Detection: 20%
Antivirus detection for URL or domain
Source: http://crackedshop.org/9/q080U0ARYYL/ Avira URL Cloud: Label: malware
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File opened: C:\Windows\SysWOW64\MSVCR100.dll Jump to behavior

Software Vulnerabilities:

barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process created: C:\Windows\SysWOW64\rundll32.exe
Document exploit detected (UrlDownloadToFile)
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Section loaded: unknown origin: URLDownloadToFileA Jump to behavior
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.3:49741 -> 67.207.81.73:443
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: ascarya.digital
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.3:49741 -> 67.207.81.73:443

Networking:

barindex
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /9/q080U0ARYYL/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: crackedshop.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: crackedshop.orgConnection: Keep-Alive
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49811
Source: EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: http://crackedshop.org/9/q080U0ARYYL/
Source: EXCEL.EXE, 00000000.00000003.884335848.0000000012AB7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892547749.0000000012AB7000.00000004.00000001.sdmp String found in binary or memory: http://crackedshop.org/cgi-sys/suspendedpage.cgi
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.281578576.0000000012725000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glideso
Source: EXCEL.EXE, 00000000.00000002.890344949.000000000EEB0000.00000004.00000001.sdmp String found in binary or memory: http://purl.oclc.org/ooxml/drawingml/diagrama
Source: EXCEL.EXE, 00000000.00000002.889287628.000000000D242000.00000004.00000001.sdmp String found in binary or memory: http://purl.oclc.org/ooxml/drawingml/tablekH
Source: EXCEL.EXE, 00000000.00000003.884135611.00000000152B9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285255868.00000000152B9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.893156950.00000000152B9000.00000004.00000001.sdmp String found in binary or memory: http://schemas.o
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: EXCEL.EXE, 00000000.00000002.891911589.0000000012821000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionloggingr
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: EXCEL.EXE, 00000000.00000003.885584011.0000000012957000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892185265.0000000012957000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285031885.0000000012957000.00000004.00000001.sdmp String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalledD
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://addinslicensing.store.o
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://addinslicensing.store.office.com/commerc
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.885275014.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891911589.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.885275014.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891911589.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/removeV/I#H
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885712225.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884722531.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892258476.000000001299A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887073698.0000000012999000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886458219.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886938116.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/queryBearer
Source: EXCEL.EXE, 00000000.00000003.885275014.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891911589.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885712225.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884722531.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892258476.000000001299A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887073698.0000000012999000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886458219.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886938116.0000000012988000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.885275014.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891911589.0000000012821000.00000004.00000001.sdmp String found in binary or memory: https://apc.learnin#
Source: EXCEL.EXE, 00000000.00000003.885275014.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891911589.0000000012821000.00000004.00000001.sdmp String found in binary or memory: https://apc.learnin#o
Source: EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://api.aadrm.com
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://api.aadrm.com/
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://api.addins.store.office.com/addinstemplate9
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.885275014.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891911589.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://api.addins.store.office.com/app/query
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://api.addins.store.office.com/app/queryAppStateQuery15http
Source: EXCEL.EXE, 00000000.00000003.885712225.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884722531.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892258476.000000001299A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887073698.0000000012999000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886458219.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886938116.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://api.addins.store.officef
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://api.cortana.ai
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://api.diagnostics.office.com
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://api.diagnostics.office.com_U
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://api.diagnosticssdf.office.com
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://api.diagnosticssdf.office.comxU
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://api.microsoftstream.com/api/
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://api.microsoftstream.com/api/Gh
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://api.office.net
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://api.office.netbV
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://api.office.netlV
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://api.onedrive.com
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://api.powerbi.com/beta/myorg/imports~D
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets6
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://apis.live.net/v5.0/
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: EXCEL.EXE, 00000000.00000002.892898226.0000000015187000.00000004.00000001.sdmp String found in binary or memory: https://ascarya.dig
Source: EXCEL.EXE, 00000000.00000002.892898226.0000000015187000.00000004.00000001.sdmp String found in binary or memory: https://ascarya.digit
Source: EXCEL.EXE, 00000000.00000002.892898226.0000000015187000.00000004.00000001.sdmp String found in binary or memory: https://ascarya.digital
Source: EXCEL.EXE, 00000000.00000003.884167113.00000000152DD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.893221910.00000000152DD000.00000004.00000001.sdmp String found in binary or memory: https://ascarya.digital/
Source: EXCEL.EXE, 00000000.00000002.892898226.0000000015187000.00000004.00000001.sdmp String found in binary or memory: https://ascarya.digital/w
Source: EXCEL.EXE, 00000000.00000002.892898226.0000000015187000.00000004.00000001.sdmp String found in binary or memory: https://ascarya.digital/wp-c
Source: EXCEL.EXE, 00000000.00000002.892898226.0000000015187000.00000004.00000001.sdmp String found in binary or memory: https://ascarya.digital/wp-con
Source: EXCEL.EXE, 00000000.00000002.892898226.0000000015187000.00000004.00000001.sdmp String found in binary or memory: https://ascarya.digital/wp-conte
Source: EXCEL.EXE, 00000000.00000002.892898226.0000000015187000.00000004.00000001.sdmp String found in binary or memory: https://ascarya.digital/wp-content%https://ascarya.digital/wp-content/ZH&https://ascarya.digital/wp-
Source: EXCEL.EXE, 00000000.00000002.892898226.0000000015187000.00000004.00000001.sdmp String found in binary or memory: https://ascarya.digital/wp-content/ZH
Source: EXCEL.EXE, 00000000.00000002.892835370.0000000015161000.00000004.00000001.sdmp String found in binary or memory: https://ascarya.digital/wp-content/ZH4rirU/
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: EXCEL.EXE, 00000000.00000003.885275014.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891911589.0000000012821000.00000004.00000001.sdmp String found in binary or memory: https://augloop.dod.online.of
Source: EXCEL.EXE, 00000000.00000003.885275014.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891911589.0000000012821000.00000004.00000001.sdmp String found in binary or memory: https://augloop.gov.onlin
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://augloop.office.com
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://augloop.office.com/v2
Source: EXCEL.EXE, 00000000.00000003.885584011.0000000012957000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892185265.0000000012957000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285031885.0000000012957000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://augloop.office.comxG
Source: EXCEL.EXE String found in binary or memory: https://autodiscover-s.o
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.885275014.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891911589.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885884780.0000000012845000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.890478896.000000000EF42000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: EXCEL.EXE, 00000000.00000003.885584011.0000000012957000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892185265.0000000012957000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285031885.0000000012957000.00000004.00000001.sdmp String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xmlS
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://cdn.entity.
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: EXCEL.EXE, 00000000.00000003.885584011.0000000012957000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892185265.0000000012957000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285031885.0000000012957000.00000004.00000001.sdmp String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.pngb
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://clients.config.office.net/
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policiesPA
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://clients.config.office.net/user/v1.0/ios$
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: EXCEL.EXE, 00000000.00000003.885584011.0000000012957000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892185265.0000000012957000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285031885.0000000012957000.00000004.00000001.sdmp String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkeyY
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://cloudfiles.onenot
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://cloudfiles.onenote.com/upload.aspxxcel
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://config.edge.skype.com
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://cortana.ai
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://cortana.ai/api
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://cortana.ai/api6R
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://cortana.ai/apimP
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://cortana.aietl
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://cr.office.com
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885712225.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884722531.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892258476.000000001299A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887073698.0000000012999000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886458219.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886938116.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885712225.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884722531.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892258476.000000001299A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887073698.0000000012999000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886458219.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886938116.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filteri
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filterin
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://dataservice.o365filtering.com
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://dataservice.o365filtering.com/
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.com/01w#r
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.comZ6
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.coms
Source: EXCEL.EXE, 00000000.00000002.890876333.000000000F04A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.883987348.000000000F04A000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.comsF
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.comv1
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: EXCEL.EXE, 00000000.00000003.886777614.0000000012920000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892135449.0000000012920000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285010208.0000000012920000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPoliciesz
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://dev.cortana.ai
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: EXCEL.EXE, 00000000.00000003.885275014.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891911589.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://devnull.onenote.com
Source: EXCEL.EXE, 00000000.00000003.885712225.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884722531.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892258476.000000001299A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887073698.0000000012999000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886458219.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886938116.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://devnull.onenote.comMBI_SSL_S
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://devnull.onenote.comMBI_SSL_SHORT
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://devnull.onenote.comt
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://directory.services.
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://enrichment.osi.office.net/
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/Jj
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1_
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: EXCEL.EXE, 00000000.00000003.885584011.0000000012957000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892185265.0000000012957000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285031885.0000000012957000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: EXCEL.EXE, 00000000.00000003.885584011.0000000012957000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892185265.0000000012957000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285031885.0000000012957000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml&
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/Ok
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/Tk
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://entitlement.diagnostics.office.com
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://entitlement.diagnostics.office.comr
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://entity.osi.office.net/t
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885712225.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884722531.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892258476.000000001299A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887073698.0000000012999000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886458219.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886938116.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://eur.learningtools.onenote.com/learn
Source: EXCEL.EXE, 00000000.00000003.885275014.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891911589.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.885275014.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891911589.0000000012821000.00000004.00000001.sdmp String found in binary or memory: https://europe-api.-
Source: EXCEL.EXE, 00000000.00000003.885275014.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891911589.0000000012821000.00000004.00000001.sdmp String found in binary or memory: https://europe-api.-w
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885712225.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884722531.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892258476.000000001299A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887073698.0000000012999000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886458219.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886938116.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://europe-api.fp.wd.mi
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://excel.2
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: EXCEL.EXE, 00000000.00000002.891599493.00000000126FA000.00000004.00000001.sdmp String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-androidI
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://graph.ppe.windows.net
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://graph.ppe.windows.net/
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://graph.ppe.windows.net/yE
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://graph.windows.net
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://graph.windows.net/
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://graph.windows.net/erE
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://graph.windows.netKD
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://hubble.officeapps.live.com
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://hubble.officeapps.live.coma
Source: EXCEL.EXE, 00000000.00000003.884372546.000000001272E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891634618.000000001272F000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: EXCEL.EXE, 00000000.00000003.284941605.00000000128BF000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?MBI_SSL_SHORTssl.
Source: EXCEL.EXE, 00000000.00000003.885584011.0000000012957000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892185265.0000000012957000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285031885.0000000012957000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: EXCEL.EXE, 00000000.00000002.891872749.0000000012805000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885251853.0000000012805000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3dMBI_SSL_SHORTofficeapps.live.com
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: EXCEL.EXE, 00000000.00000002.891599493.00000000126FA000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=16da
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1A
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: EXCEL.EXE, 00000000.00000003.284941605.00000000128BF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: EXCEL.EXE, 00000000.00000002.890687010.000000000EFB6000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: EXCEL.EXE, 00000000.00000003.284941605.00000000128BF000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?OfficeOnlineContentM365Iconshttps://hu
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://incidents.diagnostics.office.com
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://incidents.diagnostics.office.coma
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://incidents.diagnosticssdf.office.comW
Source: EXCEL.EXE, 00000000.00000003.885275014.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891911589.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885712225.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884722531.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892258476.000000001299A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887073698.0000000012999000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886458219.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886938116.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://inclient.store.office.com/gyro/clientstoreAddInsInClient
Source: EXCEL.EXE, 00000000.00000002.891872749.0000000012805000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885251853.0000000012805000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891599493.00000000126FA000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=ImmersiveApp
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: EXCEL.EXE, 00000000.00000002.891599493.00000000126FA000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: EXCEL.EXE, 00000000.00000003.886777614.0000000012920000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892135449.0000000012920000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285010208.0000000012920000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: EXCEL.EXE, 00000000.00000003.284941605.00000000128BF000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArtOfficeOnlineContentF
Source: EXCEL.EXE, 00000000.00000003.886777614.0000000012920000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892135449.0000000012920000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285010208.0000000012920000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: EXCEL.EXE, 00000000.00000002.891599493.00000000126FA000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: EXCEL.EXE, 00000000.00000003.284941605.00000000128BF000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=FlickrMBI_SSL_SHORTssl.
Source: EXCEL.EXE, 00000000.00000003.886777614.0000000012920000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892135449.0000000012920000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285010208.0000000012920000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: EXCEL.EXE, 00000000.00000003.284941605.00000000128BF000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDriveMBI_SSL_SHORTssl.
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeechBearer
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://lifecycle.office.com
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://lifecycle.office.comMBI_SSL_SHORThttps://lifecycle.office.com
Source: EXCEL.EXE, 00000000.00000002.893311531.000000001536A000.00000004.00000001.sdmp String found in binary or memory: https://login.live.com
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://login.microsoftonline.com/
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.microsoftonline.com/RU
Source: EXCEL.EXE, 00000000.00000003.884722531.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884962144.00000000129CE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892295205.00000000129D1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows-ppe.net/common/oauth2/auth
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorizeR
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorizeW
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://login.windows.local
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.localtes
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: EXCEL.EXE, 00000000.00000003.885275014.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891911589.0000000012821000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oaut
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize#
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize(
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize)
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize-
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize.
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize0
Source: EXCEL.EXE, 00000000.00000002.891599493.00000000126FA000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize018
Source: EXCEL.EXE, 00000000.00000002.891599493.00000000126FA000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize018Xi$
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize2
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize3
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize4
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize6
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize8
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize9
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize;
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize=
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize?
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeA
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeD
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeF
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeI
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeJ
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeK
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeN
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeO
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeP
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeQ
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeT
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeU
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeW
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeY
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeZ
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize_
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeb
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizec
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorized
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizef
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeg
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeh
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizei
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeize
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizej
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeo
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizep
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizes
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizet
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizete
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeu
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizev
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizew
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizex
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizey
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize~
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://loki.d
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1MBI_SSL_SHORT
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://management.azure.com
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://management.azure.com/
Source: EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://messaging.office.com/
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: EXCEL.EXE, 00000000.00000003.885584011.0000000012957000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892185265.0000000012957000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285031885.0000000012957000.00000004.00000001.sdmp String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy2
Source: EXCEL.EXE, 00000000.00000003.885712225.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884722531.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892258476.000000001299A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887073698.0000000012999000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886458219.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886938116.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://nam.learn
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://nam.learningtools.o
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechT
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://ncus.contentsync.
Source: EXCEL.EXE, 00000000.00000003.886777614.0000000012920000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892135449.0000000012920000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285010208.0000000012920000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://ncus.pagecontentsync.
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885712225.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884722531.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892258476.000000001299A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887073698.0000000012999000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886458219.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886938116.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/nexus/W-
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/nexus/rules.
Source: EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.890478896.000000000EF42000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/nexus/rules?Application=excel.exe&Version=16.0.4954.1000&ClientId=
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.885275014.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891911589.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://ocos-office365-s2s.msedge.net/abce
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://officeapps.live.com
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com$
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com&
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com.dllt
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com0D
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com2
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com8
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com:
Source: EXCEL.EXE, 00000000.00000003.884722531.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884962144.00000000129CE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892295205.00000000129D1000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comAugmentationLoopServicePriorityhttps://augloop.office.com;https://augloop
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comF
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comH/
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comJ
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comL
Source: EXCEL.EXE, 00000000.00000003.883987348.000000000F04A000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comN
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comP
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comR
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comX
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comZ
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comb
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comd
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comh
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comr
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.coms.dll
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comv
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comx
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: EXCEL.EXE, 00000000.00000002.890687010.000000000EFB6000.00000004.00000001.sdmp String found in binary or memory: https://officeclient.micr
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://officesetup.getmicrosoftkey.com:U
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: EXCEL.EXE, 00000000.00000003.885584011.0000000012957000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892185265.0000000012957000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285031885.0000000012957000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: EXCEL.EXE, 00000000.00000003.885584011.0000000012957000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892185265.0000000012957000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285031885.0000000012957000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: EXCEL.EXE, 00000000.00000003.885584011.0000000012957000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892185265.0000000012957000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285031885.0000000012957000.00000004.00000001.sdmp String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated~
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://onedrive.live.com
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=falsetO
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://onedrive.live.com/embed?
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://onedrive.live.com/embed?iEurM6
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886649798.00000000128D8000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.284984687.00000000128ED000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884623877.00000000128D8000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885402923.00000000128D8000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892081913.00000000128D8000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://osi.office.net
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://osi.office.net#R
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://osi.office.netR
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://osi.office.netst
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://otelrules.azureedge.net
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://outlook.office.com
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office.com%F
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.885275014.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891911589.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885884780.0000000012845000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.890478896.000000000EF42000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://outlook.office.com/
Source: EXCEL.EXE, 00000000.00000003.886777614.0000000012920000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892135449.0000000012920000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285010208.0000000012920000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office.comSharepointFilesHostFormat
Source: EXCEL.EXE, 00000000.00000003.885275014.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891911589.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://outlook.office365.com
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.885275014.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891911589.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885884780.0000000012845000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.890478896.000000000EF42000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://outlook.office365.com/
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885712225.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884722531.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892258476.000000001299A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887073698.0000000012999000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886458219.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886938116.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office365.com/api/v1.0/me/ActivitiesMBI_SSL
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885712225.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884722531.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892258476.000000001299A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887073698.0000000012999000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886458219.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886938116.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.jsonSubstrateOfficeIntelligenceServicehttps:
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.jsonv
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office365.com/dllH
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885712225.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884722531.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892258476.000000001299A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887073698.0000000012999000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886458219.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886938116.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=OutlookMBI_SSL_SHORT
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://pages.store.office.com/review/quer
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://pages.store.office.com/review/query
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.885275014.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891911589.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: EXCEL.EXE, 00000000.00000003.886777614.0000000012920000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892135449.0000000012920000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285010208.0000000012920000.00000004.00000001.sdmp String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions$B
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: EXCEL.EXE, 00000000.00000003.885584011.0000000012957000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892185265.0000000012957000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285031885.0000000012957000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://powerlift.acompli.net
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: EXCEL.EXE, 00000000.00000003.885584011.0000000012957000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892185265.0000000012957000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285031885.0000000012957000.00000004.00000001.sdmp String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json8
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptioneventse
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891872749.0000000012805000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885251853.0000000012805000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://roaming.edog.
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://settings.outlook.com
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://shell.suite.office.com:1443
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://shell.suite.office.com:1443fU
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://skyapi.live.net/Activity/
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work=3
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://staging.cortana.ai
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://store.office.cn/addinstemplate
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://store.office.de/addinstemplate
Source: EXCEL.EXE, 00000000.00000003.885712225.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884722531.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892258476.000000001299A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887073698.0000000012999000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886458219.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886938116.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://store.office.de/addinstemplateDeepLinkingServiceChinahttps://store.offi.
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://store.office.de/addinstemplateDeepLinkingServiceChinahttps://store.office.cn/addinstemplateD
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://store.office.de/addinstemplateH1
Source: EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com/Todo-Internal.ReadWriteJ
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com7A
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com;F
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.comP
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.comqG
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://tasks.office.com
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://tellmeservice.osi.office.netst
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/Y
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: EXCEL.EXE, 00000000.00000003.886777614.0000000012920000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892135449.0000000012920000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285010208.0000000012920000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: EXCEL.EXE, 00000000.00000003.885275014.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891911589.0000000012821000.00000004.00000001.sdmp String found in binary or memory: https://unitedkingdom-api.fp.wd.
Source: EXCEL.EXE, 00000000.00000003.885275014.0000000012821000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891911589.0000000012821000.00000004.00000001.sdmp String found in binary or memory: https://unitedstates-api.fp.wd.microso
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices&
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devicesUserVoiceWordIOShttps://word.uservoice.com
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://web.microsoftstream.com/video/
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/pA~
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://webshell.suite.office.com
Source: EXCEL.EXE, 00000000.00000003.885712225.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884722531.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892258476.000000001299A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887073698.0000000012999000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886458219.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886938116.0000000012988000.00000004.00000001.sdmp String found in binary or memory: https://word.uservoice.com/forums/304948-word#
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://wus2.contentsync.
Source: EXCEL.EXE, 00000000.00000003.886777614.0000000012920000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892135449.0000000012920000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.285010208.0000000012920000.00000004.00000001.sdmp, 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://wus2.pagecontentsync.
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: EXCEL.EXE, 00000000.00000003.884392576.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885121120.000000001274F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.891675623.000000001274F000.00000004.00000001.sdmp String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2k
Source: 40484C98-D3A3-480D-91A7-412F4910F605.0.dr String found in binary or memory: https://www.odwebp.svc.ms
Source: EXCEL.EXE, 00000000.00000003.285059746.0000000012988000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884785145.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.884975520.00000000129DB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.892309496.00000000129DB000.00000004.00000001.sdmp String found in binary or memory: https://www.odwebp.svc.msmhC
Source: unknown DNS traffic detected: queries for: ascarya.digital
Source: global traffic HTTP traffic detected: GET /9/q080U0ARYYL/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: crackedshop.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: crackedshop.orgConnection: Keep-Alive

System Summary:

barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 8 Screenshot OCR: ENABLE EDITING" FROM YELLOW BAR ABOVE 5 Once you have enabled editing, please click "Enable Conte
Source: Screenshot number: 8 Screenshot OCR: protected documents. r 3 .0 4 CLICK "ENABLE EDITING" FROM YELLOW BAR ABOVE 5 Once you have ena
Source: Screenshot number: 8 Screenshot OCR: Enable Content" button 6 * mm 7 I 8 9 " 10 11 12 13_ _ Q ;;tosort office can t find your li
Found a hidden Excel 4.0 Macro sheet
Source: Invoice.xlsm Macro extractor: Sheet name: Buk2
Source: Invoice.xlsm Macro extractor: Sheet name: Buk5
Source: Invoice.xlsm Macro extractor: Sheet name: Buk1
Source: Invoice.xlsm Macro extractor: Sheet name: Buk7
Source: Invoice.xlsm Macro extractor: Sheet name: EFEWF
Source: Invoice.xlsm Macro extractor: Sheet name: Buk3
Source: Invoice.xlsm Macro extractor: Sheet name: Buk4
Source: Invoice.xlsm Macro extractor: Sheet name: Buk6
Detected potential crypto function
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Code function: 0_3_1282970F 0_3_1282970F
Excel documents contains an embedded macro which executes code when the document is opened
Source: workbook.xml Binary string: \Desktop\Fil\1d\Cir\" xmlns:x15ac="http://schemas.microsoft.com/office/spreadsheetml/2010/11/ac"/></mc:Choice></mc:AlternateContent><xr:revisionPtr revIDLastSave="0" documentId="13_ncr:1_{1D31CE62-AFF1-46C8-8AB3-51A0A09BC8BF}" xr6:coauthVersionLast="45" xr6:coauthVersionMax="45" xr10:uidLastSave="{00000000-0000-0000-0000-000000000000}"/><bookViews><workbookView xWindow="-120" yWindow="-120" windowWidth="20730" windowHeight="11160" xr2:uid="{00000000-000D-0000-FFFF-FFFF00000000}"/></bookViews><sheets><sheet name="Sheet" sheetId="1" r:id="rId1"/><sheet name="Ss1" sheetId="2" state="hidden" r:id="rId2"/><sheet name="Ss1br2" sheetId="3" state="hidden" r:id="rId3"/><sheet name="Ssbr3" sheetId="4" state="hidden" r:id="rId4"/><sheet name="EFEWF" sheetId="5" state="hidden" r:id="rId5"/><sheet name="Buk1" sheetId="6" state="hidden" r:id="rId6"/><sheet name="Buk2" sheetId="7" state="hidden" r:id="rId7"/><sheet name="Buk3" sheetId="8" state="hidden" r:id="rId8"/><sheet name="Buk4" sheetId="9" state="hidden" r:id="rId9"/><sheet name="Buk5" sheetId="10" state="hidden" r:id="rId10"/><sheet name="Buk6" sheetId="11" state="hidden" r:id="rId11"/><sheet name="Buk7" sheetId="12" state="hidden" r:id="rId12"/></sheets><definedNames><definedName name="LKLW">EFEWF!$D$3</definedName><definedName name="SASA">EFEWF!$D$17</definedName><definedName name="SASA1">EFEWF!$D$19</definedName><definedName name="SASA2">EFEWF!$D$21</definedName><definedName name="_xlnm.Auto_Open">EFEWF!$D$1</definedName></definedNames><calcPr calcId="191029"/><extLst><ext uri="{B58B0392-4F1F-4190-BB64-5DF3571DCE5F}" xmlns:xcalcf="http://schemas.microsoft.com/office/spreadsheetml/2018/calcfeatures"><xcalcf:calcFeatures><xcalcf:feature name="microsoft.com:RD"/><xcalcf:feature name="microsoft.com:FV"/></xcalcf:calcFeatures></ext></extLst></workbook>
Source: Invoice.xlsm Virustotal: Detection: 28%
Source: Invoice.xlsm ReversingLabs: Detection: 20%
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWow64\rundll32.exe ..\besta.ocx,44532.2997003472
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWow64\rundll32.exe ..\besta.ocx,44532.2997003472
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWow64\rundll32.exe ..\besta.ocx,44532.2997003472 Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\{D6239669-CD33-4FE0-8FA1-A794E7A44C05} - OProcSessId.dat Jump to behavior
Source: EXCEL.EXE String found in binary or memory: " o:authentication="2"> <o:url>https://addinslicensing.store.office.com/entitlement/query</o:url> <o:ticket o:policy="MBI_SSL_SHORT" o:i/
Source: EXCEL.EXE String found in binary or memory: </o:service> <o:service o:name="CommerceQuery15"> <o:url>https://addinslicensing.store.office.com/commerce/query</o:url> </o:servic.
Source: EXCEL.EXE String found in binary or memory: </o:service> <o:service o:name="AppAcquisitionLogging"> <o:url>https://addinsinstallation.store.office.com/app/acquisitionlogging</o:;
Source: classification engine Classification label: mal76.expl.winXLSM@3/5@2/2
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe Automated click: OK
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Invoice.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet4.xml
Source: Invoice.xlsm Initial sample: OLE zip file path = xl/media/image1.png
Source: Invoice.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: Invoice.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet3.xml.rels
Source: Invoice.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: Invoice.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings3.bin
Source: Invoice.xlsm Initial sample: OLE zip file path = xl/calcChain.xml
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File opened: C:\Windows\SysWOW64\MSVCR100.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: EXCEL.EXE, 00000000.00000002.889143323.000000000D1D5000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAWX
Source: EXCEL.EXE, 00000000.00000003.285010208.0000000012920000.00000004.00000001.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\m
Source: EXCEL.EXE, 00000000.00000002.890397061.000000000EEE0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.890478896.000000000EF42000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW

HIPS / PFW / Operating System Protection Evasion:

barindex
Yara detected Xls With Macro 4.0
Source: Yara match File source: app.xml, type: SAMPLE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 532378 Sample: Invoice.xlsm Startdate: 02/12/2021 Architecture: WINDOWS Score: 76 19 Antivirus detection for URL or domain 2->19 21 Multi AV Scanner detection for submitted file 2->21 23 Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros) 2->23 25 2 other signatures 2->25 6 EXCEL.EXE 26 32 2->6         started        process3 dnsIp4 15 crackedshop.org 94.102.59.39, 49813, 80 INT-NETWORKSC Netherlands 6->15 17 ascarya.digital 67.207.81.73, 443, 49741, 49811 DIGITALOCEAN-ASNUS United States 6->17 13 C:\Users\user\Desktop\~$Invoice.xlsm, data 6->13 dropped 27 Document exploit detected (UrlDownloadToFile) 6->27 11 rundll32.exe 6->11         started        file5 signatures6 process7
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
94.102.59.39
 crackedshop.org Netherlands
202425 INT-NETWORKSC false
67.207.81.73
 ascarya.digital United States
14061 DIGITALOCEAN-ASNUS false

Contacted Domains

Name IP Active
crackedshop.org 94.102.59.39 true
ascarya.digital 67.207.81.73 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://crackedshop.org/9/q080U0ARYYL/ true
  • Avira URL Cloud: malware
 unknown