Windows Analysis Report SCAN_7295943480515097.xlsm

Overview

General Information

Sample Name: SCAN_7295943480515097.xlsm
Analysis ID: 532474
MD5: 1ab11dce30326f39f6186f9aa05d5777
SHA1: 397dd88ca9d78a16ab549a8d22a711ddbea80c05
SHA256: 8f8e07b2eaca8af62e86cebd2372f1b85d420091801ec472796387a44a98bbcd
Infos:

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score: 68
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Multi AV Scanner detection for submitted file
Sigma detected: Microsoft Office Product Spawning Windows Shell
Document exploit detected (process start blacklist hit)
Document exploit detected (UrlDownloadToFile)
Found a hidden Excel 4.0 Macro sheet
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication
Yara detected Xls With Macro 4.0
JA3 SSL client fingerprint seen in connection with other malware
Excel documents contains an embedded macro which executes code when the document is opened
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Document misses a certain OLE stream usually present in this Microsoft Office document type

Classification

AV Detection:

barindex
Multi AV Scanner detection for submitted file
Source: SCAN_7295943480515097.xlsm Virustotal: Detection: 21% Perma Link
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File opened: C:\Windows\SysWOW64\MSVCR100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 107.180.46.229:443 -> 192.168.2.3:49807 version: TLS 1.2

Software Vulnerabilities:

barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process created: C:\Windows\SysWOW64\rundll32.exe
Document exploit detected (UrlDownloadToFile)
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Section loaded: unknown origin: URLDownloadToFileA Jump to behavior
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.3:49740 -> 162.240.9.126:80
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: standoutglobal.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.3:49807 -> 107.180.46.229:443

Networking:

barindex
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: vendes.marketing
Source: global traffic HTTP traffic detected: GET /2/MWpqeVgZ/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: standoutglobal.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /2/MWpqeVgZ/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: standoutglobal.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /2/MWpqeVgZ/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: standoutglobal.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /2/MWpqeVgZ/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: standoutglobal.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /2/MWpqeVgZ/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: standoutglobal.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /2/MWpqeVgZ/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: standoutglobal.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /2/MWpqeVgZ/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: standoutglobal.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /2/MWpqeVgZ/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: standoutglobal.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /transmigrant/Wplzr/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: vendes.marketingConnection: Keep-Alive
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: unknown Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49807
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: src="https://www.facebook.com/tr?id=408176514230511&ev=PageView&noscript=1" equals www.facebook.com (Facebook)
Source: EXCEL.EXE, 00000000.00000003.755751851.000000000F8E2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576682242.000000000F8E2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.504342762.000000000F8E2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.765651167.000000000F8E2000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glidesv
Source: EXCEL.EXE, 00000000.00000002.762957049.000000000DB3D000.00000004.00000001.sdmp String found in binary or memory: http://purl.oclc.org/ooxml/drawingml/diagram
Source: EXCEL.EXE, 00000000.00000002.762957049.000000000DB3D000.00000004.00000001.sdmp String found in binary or memory: http://purl.oclc.org/ooxml/drawingml/table
Source: EXCEL.EXE, 00000000.00000003.614273226.0000000015E8F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.614245583.0000000015E5F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619402149.00000000135C2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619328077.0000000015E7F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.614226439.0000000015E2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619289255.0000000015E1F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619305847.0000000015E4F000.00000004.00000001.sdmp String found in binary or memory: http://schemas.open
Source: EXCEL.EXE, 00000000.00000003.614226439.0000000015E2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619289255.0000000015E1F000.00000004.00000001.sdmp String found in binary or memory: http://schemas.openformatrg/drawml/2006/spreadsheetD
Source: EXCEL.EXE, 00000000.00000003.619402149.00000000135C2000.00000004.00000001.sdmp String found in binary or memory: http://schemas.openformatrg/package/2006/content-t
Source: EXCEL.EXE, 00000000.00000003.614273226.0000000015E8F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.614245583.0000000015E5F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619328077.0000000015E7F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619305847.0000000015E4F000.00000004.00000001.sdmp String found in binary or memory: http://schemas.openformatrg/package/2006/r
Source: EXCEL.EXE, 00000000.00000002.768447111.0000000015B70000.00000004.00000001.sdmp String found in binary or memory: http://standoutglobal.c
Source: EXCEL.EXE, 00000000.00000002.768447111.0000000015B70000.00000004.00000001.sdmp String found in binary or memory: http://standoutglobal.co
Source: EXCEL.EXE, 00000000.00000002.768447111.0000000015B70000.00000004.00000001.sdmp String found in binary or memory: http://standoutglobal.com%http://standoutglobal.com/2/MWpqeVgZ/
Source: EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: http://standoutglobal.com/
Source: EXCEL.EXE, 00000000.00000002.766494588.0000000013308000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756540939.0000000013308000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496724357.00000000132DA000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679166159.0000000013307000.00000004.00000001.sdmp String found in binary or memory: http://standoutglobal.com/2/MWpqeVgZ/
Source: EXCEL.EXE, 00000000.00000003.496278619.000000001368F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497337079.000000001368F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.504935052.000000001368F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.503708711.000000001368F000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: http://vendes.marketing/
Source: EXCEL.EXE, 00000000.00000003.495992652.00000000135CC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.577118654.00000000135CC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.642811620.00000000135C2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.640771984.00000000135C2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619409024.00000000135C9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579556608.00000000135CC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.503248323.00000000135CD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.754618432.00000000135BD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756257287.00000000135C8000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.644442503.00000000135C2000.00000004.00000001.sdmp String found in binary or memory: http://vendes.marketing/transmigrant/Wplzr/
Source: EXCEL.EXE, 00000000.00000003.495992652.00000000135CC000.00000004.00000001.sdmp String found in binary or memory: http://vendes.marketing/transmigrant/Wplzr/B
Source: EXCEL.EXE, 00000000.00000003.495992652.00000000135CC000.00000004.00000001.sdmp String found in binary or memory: http://vendes.marketing/transmigrant/Wplzr/N
Source: EXCEL.EXE, 00000000.00000003.575598844.00000000135C9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.767205497.00000000135C9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.616428887.00000000135B7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.495992652.00000000135CC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.577118654.00000000135CC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.642811620.00000000135C2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.640771984.00000000135C2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619409024.00000000135C9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579556608.00000000135CC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.503248323.00000000135CD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.754618432.00000000135BD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756257287.00000000135C8000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.644442503.00000000135C2000.00000004.00000001.sdmp String found in binary or memory: http://vendes.marketing/transmigrant/Wplzr/b
Source: EXCEL.EXE, 00000000.00000003.504647326.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581482859.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579110952.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.577081581.0000000015CD6000.00000004.00000001.sdmp String found in binary or memory: http://vendes.marketinng/
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://addinsinstallation.store.office.com/app/downloadAppInfoQuery15https://api.addins.omex.office
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: EXCEL.EXE, 00000000.00000003.503943037.000000000F805000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.765237836.000000000F805000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.757836026.000000000F805000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576411439.000000000F805000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.755273769.000000000F805000.00000004.00000001.sdmp String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled2
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticatedBearer
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://addinslicensing.store.office.com/commerce/queryDeepLinkingServicehttps://api.addins.store.of
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/removeBearer
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/removeT
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/queryBearer
Source: EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301259993.0000000013319000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechBearer
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechb
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://api.aadrm.com
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://api.aadrm.com/
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://api.addins.store.office.com/app/query
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://api.addins.store.office.com/app/queryAppStateQuery15https://api.addins.omex.office.net/appst
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://api.addins.store.office.com/app/queryM
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://api.cortana.ai
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://api.cortana.aiBearer
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://api.cortana.aihttps://login.windows.net/common/oauth2/authorize
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://api.diagnostics.office.com
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://api.diagnostics.office.comBearer
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://api.diagnostics.office.comUrlW
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://api.diagnostics.office.comhttps://login.windows.net/common/oauth2/authorize
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://api.diagnostics.office.comomM
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://api.diagnostics.office.coms
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://api.microsoftstream.com/api/
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://api.microsoftstream.com/api/StreamVideoBasehttps://web.microsoftstream.com/video/PPTQuickSta
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://api.microsoftstream.com/api/nt
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://api.office.net
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://api.office.netK6
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://api.office.netM
Source: EXCEL.EXE, 00000000.00000003.580863661.0000000013430000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639135024.0000000013430000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637217342.0000000013430000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497003045.0000000013430000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766786019.0000000013430000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.620260825.0000000013430000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576113847.0000000013430000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301457811.0000000013434000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301379414.0000000013430000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505076437.0000000013430000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497369175.0000000013432000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579184069.0000000013430000.00000004.00000001.sdmp String found in binary or memory: https://api.office.netW
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://api.office.net_
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp String found in binary or memory: https://api.office.netz
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://api.onedrive.com
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets.
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groupsBearer
Source: EXCEL.EXE, 00000000.00000003.496187028.0000000013641000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.768882304.0000000015CDE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497598992.000000001353C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.504647326.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.620387042.0000000015CC9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.677945944.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581482859.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678673663.0000000015CDD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497249883.0000000013641000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579110952.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505338190.000000001353C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.641789083.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.677925063.0000000015CC9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.768840672.0000000015CC6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.620403646.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637473162.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756202435.0000000015CC4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.617281899.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.577081581.0000000015CD6000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://api.w.org/
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://apis.live.net/v5.0/
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://apis.live.net/v5.0/rlq
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/?
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/OneNoteBulletinshttps://
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://augloop.office.com
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://augloop.office.com/v2
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://augloop.office.com/v2Bearer
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://augloop.office.com/v2U
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://augloop.office.com/v2https://login.windows.net/common/oauth2/authorize
Source: EXCEL.EXE, 00000000.00000002.762957049.000000000DB3D000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://augloop.office.comLinkRequestApiPageTitleRetrievalhttps://uci.
Source: EXCEL.EXE, 00000000.00000003.755751851.000000000F8E2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576682242.000000000F8E2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.504342762.000000000F8E2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.765651167.000000000F8E2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301259993.0000000013319000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://autodiscover-s.outlook.com/
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://cdn.entity.
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell3
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://clients.config.office.net/
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://clients.config.office.net/4
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://cloudfiles.onenote.com/upload.aspxOneNoteCloudFilesConsumerEmbedhttps://onedrive.live.com/em
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://config.edge.skype.com
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://config.edge.skype.com-
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://connect.facebook.net/en_US/fbevents.js
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496650266.0000000015D98000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496638408.0000000015D97000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://connect.facebook.net/es_LA/sdk/xfbml.customerchat.js
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://cortana.ai
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://cortana.ai/api
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://cortana.ai/apiBearer
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://cortana.ai/apihttps://login.windows.net/common/oauth2/authorize
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://cortana.aiet-
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://cr.office.com
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://dataservice.o365filtering.com
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://dataservice.o365filtering.com/
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.com/#
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.com/-
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFileBearer
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFileed
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.com/https://login.windows.net/common/oauth2/authorize
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.com=
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.comv
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFileBearer
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPoliciesBearer
Source: EXCEL.EXE, 00000000.00000003.756085438.000000000F935000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576719662.000000000F935000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.504427495.000000000F935000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPoliciesoD
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://dev.cortana.ai
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://dev.cortana.aiBearer
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://dev.cortana.aihttps://login.windows.net/common/oauth2/authorize
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://dev.cortana.ai~
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://devnull.onenote.com
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://devnull.onenote.comBearer
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://devnull.onenote.comMBI_SSL_SHORT
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://devnull.onenote.comV
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://devnull.onenote.comt
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://directory.services.
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://enrichment.osi.office.net/
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/$
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1AuthorizationBearer
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1n
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1EnrichmentWACUrlhttps://enrichment.osi.
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/EnrichmentMetadataUrlhttps://enrichm
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.jsonD
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtmlEnrichmentDisambiguat
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtmlm
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/https://login.windows.net/common/oauth2/authorizeMBI_SSLhttps://os
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/om
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/y
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://entitlement.diagnostics.office.com
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://entity.osi.office.net/t
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech#
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechBearer
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechwingK
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.504997162.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.765835607.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.620203784.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637145469.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496692070.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.578892329.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.305119965.000000000F971000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576335404.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301230323.000000000F971000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.616873186.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.755525188.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580420279.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.303145837.000000000F971000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-androidUserVoiceOf
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://fonts.googleapis.com/css2?family=Josefin
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://fonts.googleapis.com/css2?family=Roboto:ital
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://graph.ppe.windows.net
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://graph.ppe.windows.net/
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://graph.ppe.windows.net/https://graph.ppe.windows.net
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://graph.ppe.windows.net/u
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://graph.windows.net
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://graph.windows.net/
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://graph.windows.net/https://graph.windows.net
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://graph.windows.net/t
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://graph.windows.netpoint
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp String found in binary or memory: https://hubble.officeapps.live.com
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: EXCEL.EXE, 00000000.00000003.503943037.000000000F805000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.765237836.000000000F805000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.757836026.000000000F805000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576411439.000000000F805000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.755273769.000000000F805000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: EXCEL.EXE String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: EXCEL.EXE, 00000000.00000003.504997162.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.765835607.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.620203784.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637145469.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496692070.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.578892329.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.305119965.000000000F971000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576335404.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301230323.000000000F971000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.616873186.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.755525188.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580420279.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.303145837.000000000F971000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1=
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: EXCEL.EXE, 00000000.00000003.679220709.0000000013341000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496781565.0000000013341000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756599523.0000000013341000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301274679.0000000013341000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576000870.0000000013341000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=10
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: EXCEL.EXE, 00000000.00000003.679220709.0000000013341000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496781565.0000000013341000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756599523.0000000013341000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301274679.0000000013341000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576000870.0000000013341000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=14
Source: EXCEL.EXE, 00000000.00000003.301268195.0000000013334000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.575991417.0000000013333000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496771693.0000000013333000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756579142.0000000013333000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679200853.0000000013333000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://incidents.diagnostics.office.com
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://incidents.diagnostics.office.comce
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://incidents.diagnosticssdf.office.como
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.504997162.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.765835607.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.620203784.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637145469.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496692070.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.578892329.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.305119965.000000000F971000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576335404.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301230323.000000000F971000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.616873186.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.755525188.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580420279.000000000F970000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.303145837.000000000F971000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=ImmersiveApp
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: EXCEL.EXE, 00000000.00000002.766449411.00000000132B0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496724357.00000000132DA000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: EXCEL.EXE, 00000000.00000003.756085438.000000000F935000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576719662.000000000F935000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.504427495.000000000F935000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: EXCEL.EXE, 00000000.00000003.756085438.000000000F935000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576719662.000000000F935000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.504427495.000000000F935000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: EXCEL.EXE, 00000000.00000003.756085438.000000000F935000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576719662.000000000F935000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.504427495.000000000F935000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeechBearer
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://lifecycle.office.com
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://lifecycle.office.comMBI_SSL_SHORThttps://lifecycle.office.com
Source: EXCEL.EXE, 00000000.00000003.617145033.00000000135F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619542500.00000000135F2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.755210221.0000000013610000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.767543595.0000000013612000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496136288.00000000135F2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.616539559.00000000135F2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.504670710.0000000013610000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.575689852.00000000135F2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579715376.00000000135F2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.577206896.00000000135F2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.620082088.00000000135F7000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.503378347.00000000135F2000.00000004.00000001.sdmp String found in binary or memory: https://login.live.com
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://login.microsoftonline.com/
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.microsoftonline.com/i
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize-
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorizei
Source: EXCEL.EXE, 00000000.00000003.301259993.0000000013319000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://login.windows.local
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.localtesp
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorizeX
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize&
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize.
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize/
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize0
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize1
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize3
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize6
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize=
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize?
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeA
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeAk7
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeB
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeC
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeF
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeFj8A
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeH
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeL
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeM
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeMBI_SSL_SHORT
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeN
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeO
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeQ
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeQj
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeR
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeS
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize_
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizec
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizecom
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizee
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizei
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeize
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizel
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizem
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizen
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeo
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizer
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizesj
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizet
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeu
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizex
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizey
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizez
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize~
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/#
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1MBI_SSL_SHORT
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://management.azure.com
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://management.azure.com/
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://management.azure.com/BingGeospatialEndpointServiceUrlhttps://dev.virtualearth.net/REST/V1/Ge
Source: EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://messaging.office.com/
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicyBearer
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechBearer
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://ncus.contentsync.
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://ncus.pagecontentsync.
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.760341609.0000000002B90000.00000004.00000020.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com
Source: EXCEL.EXE, 00000000.00000003.301409768.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/
Source: EXCEL.EXE, 00000000.00000003.301409768.000000001343E000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/)(
Source: EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/0
Source: EXCEL.EXE, 00000000.00000003.497379607.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576787267.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576127019.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505090656.000000001343E000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/D
Source: EXCEL.EXE, 00000000.00000003.301409768.000000001343E000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/b
Source: EXCEL.EXE, 00000000.00000003.301409768.000000001343E000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/m
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.620271659.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301409768.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497379607.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576787267.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576127019.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505090656.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/nexus/
Source: EXCEL.EXE, 00000000.00000003.301409768.000000001343E000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/nexus/N
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/nexus/rules
Source: EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639091590.00000000133F4000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/nexus/rules?Application=excel.exe&Version=16.0.4954.1000&ClientId=
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecordhttps://login.windows.net/co
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://o365auditrealtimeingestion.manage.office.comBearer
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://o365auditrealtimeingestion.manage.office.comP
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.netR
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://ocos-office365-s2s.msedge.net/abu
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://officeapps.live.com
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com$7
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com.7
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com27
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com46
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comB6
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comF7
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comH7
Source: EXCEL.EXE, 00000000.00000002.766449411.00000000132B0000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comN
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comV6
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comX6
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comj7
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.coml6
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comn0
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comp6
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.coms.dll
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.coms.dll0
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comz6
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com~7
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: EXCEL.EXE, 00000000.00000003.503943037.000000000F805000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.765237836.000000000F805000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.757836026.000000000F805000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576411439.000000000F805000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.755273769.000000000F805000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: EXCEL.EXE, 00000000.00000003.503943037.000000000F805000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.765237836.000000000F805000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.757836026.000000000F805000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576411439.000000000F805000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.755273769.000000000F805000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: EXCEL.EXE, 00000000.00000003.503943037.000000000F805000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.765237836.000000000F805000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.757836026.000000000F805000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576411439.000000000F805000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.755273769.000000000F805000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://onedrive.live.com
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://onedrive.live.com/embed?
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://onedrive.live.com/embed?ia
Source: EXCEL.EXE, 00000000.00000002.765033511.000000000F7B0000.00000004.00000001.sdmp String found in binary or memory: https://onedrive.live.com8
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://osi.office.net
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://osi.office.netK
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://osi.office.netst
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://otelrules.azureedge.net
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://otelrules.azureedge.netZ
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301259993.0000000013319000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://outlook.office.com
Source: EXCEL.EXE, 00000000.00000003.755751851.000000000F8E2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576682242.000000000F8E2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.504342762.000000000F8E2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.765651167.000000000F8E2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301259993.0000000013319000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://outlook.office.com/
Source: EXCEL.EXE, 00000000.00000003.756085438.000000000F935000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576719662.000000000F935000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.504427495.000000000F935000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301259993.0000000013319000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office.comB
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office.comiUrl
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office.comon
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301259993.0000000013319000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://outlook.office365.com
Source: EXCEL.EXE, 00000000.00000003.755751851.000000000F8E2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576682242.000000000F8E2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.504342762.000000000F8E2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.765651167.000000000F8E2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301259993.0000000013319000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://outlook.office365.com/
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities2
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office365.com/api/v1.0/me/ActivitiesMBI_SSL
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.jsonSubstrateOfficeIntelligenceServicehttps:
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=OutlookMBI_SSL_SHORT
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlookn
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://pages.store.office.com/review/query
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://pages.store.office.com/review/query0
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://pages.store.office.com/review/queryTemplateStarthttps://
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx$
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspxAwsCgQueryhttps://
Source: EXCEL.EXE, 00000000.00000003.756085438.000000000F935000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576719662.000000000F935000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.504427495.000000000F935000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.jsons
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13IdentityServicehttps://identity.
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://powerlift-frontdesk.acompli.netPowerLiftGymBaseUrlhttps://powerlift.acompli.netSubstrateOffi
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://powerlift.acompli.net
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://powerlift.acompli.netI
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: EXCEL.EXE, 00000000.00000003.301259993.0000000013319000.00000004.00000001.sdmp String found in binary or memory: https://r.st
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.jsono
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptioneventsMBI_SSLhttps://rpsticket.partnerservices.getmicr
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://roaming.edog.
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496650266.0000000015D98000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496638408.0000000015D97000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://s.w.org/images/core/emoji/13.1.0/svg/1f609.svg
Source: EXCEL.EXE, 00000000.00000003.620387042.0000000015CC9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496136288.00000000135F2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.677925063.0000000015CC9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.768840672.0000000015CC6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756202435.0000000015CC4000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://schema.org
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://settings.outlook.com
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://settings.outlook.comH
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://shell.suite.office.com:1443
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://shell.suite.office.com:14430
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://skyapi.live.net/Activity/
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/workPowerBIGetDatasetsApihttps://api.pow
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/workhttps://login.windows.net/common/oau
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://staging.cortana.ai
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://staging.cortana.aiBearer
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://staging.cortana.aihttps://login.windows.net/common/oauth2/authorize
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://staging.cortana.airl
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation0
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://store.office.cn/addinstemplate
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://store.office.cn/addinstemplate7
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://store.office.de/addinstemplate
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com&
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com/Todo-Internal.ReadWrite
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory(
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistoryMBI_SSL
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com/search/api/v2/initMBI_SSL
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.comP
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.comS
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.comw
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFileBearer
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://tasks.office.com
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://tellmeservice.osi.office.netst
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/7/
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.htmlInsightsImmersivehttps
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: EXCEL.EXE, 00000000.00000003.756085438.000000000F935000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576719662.000000000F935000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.504427495.000000000F935000.00000004.00000001.sdmp String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html0
Source: P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/
Source: EXCEL.EXE, 00000000.00000003.504647326.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581482859.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579110952.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.577081581.0000000015CD6000.00000004.00000001.sdmp String found in binary or memory: https://vendes.marketing/RRC:
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496650266.0000000015D98000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496638408.0000000015D97000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital-en-cdmx/
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496650266.0000000015D98000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496638408.0000000015D97000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital-en-guadalajara/
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496650266.0000000015D98000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496638408.0000000015D97000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital-en-monterrey/
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/auditorias-y-optimizacion-de-camp
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/consultoria-en-marketing-basado-e
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/consultoria-para-adsense/
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/consultoria-para-youtube/
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/digital-partner-incubadora-de-neg
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/marketing-para-el-sector-salud/
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/marketing-para-inmobiliarias-cons
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/marketing-para-startups/
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/transformacion-de-empresas/
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/amazon-seo/
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/conversion-rate-optimizati
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/crm/
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/emailing/
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/google-merchant-center/
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/pagos-online/
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/tienda-online-con-magento/
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/tienda-online-con-shopify/
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/tienda-online-con-wordpres
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/tiendas-en-facebook-e-inst
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/amazon-seo/
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/conversion-rate-optimization/
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/crm/
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/emailing/
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/google-merchant-center/
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/pagos-online/
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/tienda-online-con-magento/
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/tienda-online-con-shopify/
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/tienda-online-con-wordpress-woocomme
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/tiendas-en-facebook-e-instagram/
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-creativos/
Source: P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-creativos/branding/
Source: P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-creativos/diseno-editorial/
Source: P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-creativos/diseno-grafico/
Source: P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-creativos/diseno-web-ux/
Source: P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-creativos/fotografia-y-edicion/
Source: P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-creativos/produccion-audiovisual/
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-desarrollo-web/
Source: P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-desarrollo-web/automatizacion-de-
Source: P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-desarrollo-web/desarrollo-de-apli
Source: P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-desarrollo-web/desarrollo-de-mega
Source: P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-desarrollo-web/desarrollo-de-pagi
Source: P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-desarrollo-web/desarrollo-de-tien
Source: P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/
Source: P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/creacion-de-con
Source: P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/estrategias-en-
Source: P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/facebook-ads/
Source: P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/google-ads-adwo
Source: P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/inbound-marketi
Source: P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/inteligencia-de
Source: P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/publicidad-digi
Source: P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/seo-posicionami
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/blog/
Source: EXCEL.EXE, 00000000.00000003.496136288.00000000135F2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497239487.0000000013635000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/comments/feed/
Source: EXCEL.EXE, 00000000.00000003.496136288.00000000135F2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497239487.0000000013635000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/feed/
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor-pro/assets/css/frontend.min.css?ver=3.0.2
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496650266.0000000015D98000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496638408.0000000015D97000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.0.2
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496650266.0000000015D98000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496638408.0000000015D97000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor-pro/assets/lib/lottie/lottie.min.js?ver=5.6.6
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496650266.0000000015D98000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496638408.0000000015D97000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor-pro/assets/lib/smartmenus/jquery.smartmenus.mi
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496650266.0000000015D98000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496638408.0000000015D97000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor-pro/assets/lib/sticky/jquery.sticky.min.js?ver
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=3.4.8
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496650266.0000000015D98000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496638408.0000000015D97000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.4.8
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496650266.0000000015D98000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496638408.0000000015D97000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.4.8
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496650266.0000000015D98000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496638408.0000000015D97000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/js/preloaded-modules.min.js?ver=3.4.8
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496650266.0000000015D98000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496638408.0000000015D97000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.4.8
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496650266.0000000015D98000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496638408.0000000015D97000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/animations/animations.min.css?ver=3
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496650266.0000000015D98000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496638408.0000000015D97000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/dialog/dialog.min.js?ver=4.8.1
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.eot?5.10.0);src
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.svg?5.10.0#eico
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.ttf?5.10.0)
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff2?5.10.0)
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff?5.10.0)
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/font-awesome/css/all.min.css?ver=4.
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/font-awesome/css/brands.min.css?ver
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/font-awesome/css/font-awesome.min.c
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.min.cs
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/font-awesome/css/solid.min.css?ver=
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/font-awesome/css/v4-shims.min.css?v
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/font-awesome/js/v4-shims.min.js?ver
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496650266.0000000015D98000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496638408.0000000015D97000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js?ver=3.
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496650266.0000000015D98000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496638408.0000000015D97000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/swiper/swiper.min.js?ver=5.3.6
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496650266.0000000015D98000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496638408.0000000015D97000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.0.
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/happy-elementor-addons/assets/fonts/style.min.css?ver=3.
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496650266.0000000015D98000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496638408.0000000015D97000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/happy-elementor-addons/assets/js/happy-addons.min.js?ver
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/themes/twentytwentyone/assets/css/ie.css?ver=1.4
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/themes/twentytwentyone/assets/css/print.css?ver=1.4
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496650266.0000000015D98000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496638408.0000000015D97000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/themes/twentytwentyone/assets/js/polyfills.js?ver=1.4
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496650266.0000000015D98000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496638408.0000000015D97000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/themes/twentytwentyone/assets/js/primary-navigation.js?ver=1.4
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496650266.0000000015D98000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496638408.0000000015D97000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/themes/twentytwentyone/assets/js/responsive-embeds.js?ver=1.4
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/AE.svg
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/anuncios-300x270.png
Source: P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/anuncios.png
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/apple_android.svg
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/elementor.svg
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/figma.svg
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/framer.svg
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/marketing-digital-con-facebook.png
Source: P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/marketing-digital-con-google-adwords.png
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/marketing-digital-con-instagram.png
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/marketing-digital-con-youtube.png
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/microsoft.svg
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/visual-Studio.svg
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/webflow.svg
Source: P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/11/logo-VNDSmkt-final-1024x348.png
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/11/logo-VNDSmkt-final-1536x522.png
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/11/logo-VNDSmkt-final-1568x533.png
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/11/logo-VNDSmkt-final-2048x696.png
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/11/logo-VNDSmkt-final-300x102.png
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/11/logo-VNDSmkt-final-768x261.png
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/elementor/css/global.css?ver=1637592552
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/elementor/css/post-1522.css?ver=1638212153
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/elementor/css/post-2017.css?ver=1638212282
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/elementor/css/post-2157.css?ver=1638212282
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/elementor/css/post-5.css?ver=1637592550
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/images/caso-exito1.png
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/images/comentario1.jpg
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/images/comentario5-m.jpg
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/images/comentario6.jpg
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-includes/css/dist/block-library/style.min.css?ver=5.8.2
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496650266.0000000015D98000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496638408.0000000015D97000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-includes/js/imagesloaded.min.js?ver=4.1.4
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496650266.0000000015D98000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496638408.0000000015D97000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-includes/js/jquery/ui/core.min.js?ver=1.12.1
Source: EXCEL.EXE, 00000000.00000003.496597476.0000000015D73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496513135.0000000015D63000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496650266.0000000015D98000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496638408.0000000015D97000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-includes/js/wp-embed.min.js?ver=5.8.2
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-includes/wlwmanifest.xml
Source: EXCEL.EXE, 00000000.00000003.496187028.0000000013641000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.768882304.0000000015CDE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497598992.000000001353C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.504647326.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.620387042.0000000015CC9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.677945944.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581482859.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678673663.0000000015CDD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497249883.0000000013641000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579110952.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505338190.000000001353C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.641789083.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.677925063.0000000015CC9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.768840672.0000000015CC6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.620403646.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637473162.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756202435.0000000015CC4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.617281899.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.577081581.0000000015CD6000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-json/
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fvendes.marketing%2F
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fvendes.marketing%2F&format=
Source: EXCEL.EXE, 00000000.00000003.496187028.0000000013641000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.768882304.0000000015CDE000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497598992.000000001353C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.504647326.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.620387042.0000000015CC9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.677945944.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581482859.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678673663.0000000015CDD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497249883.0000000013641000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579110952.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505338190.000000001353C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.641789083.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.677925063.0000000015CC9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.768840672.0000000015CC6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.620403646.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637473162.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756202435.0000000015CC4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.617281899.0000000015CD6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.577081581.0000000015CD6000.00000004.00000001.sdmp, besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/wp-json/wp/v2/pages/1522
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://vendes.marketing/xmlrpc.php?rsd
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devicesF)
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://web.microsoftstream.com/video/
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp String found in binary or memory: https://web.microsoftstream.com/video/4
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: EXCEL.EXE, 00000000.00000003.756417957.0000000013449000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301431299.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619881271.0000000013464000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639155238.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497053318.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637228311.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576149956.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.579209762.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.580928076.000000001343E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505119246.0000000013468000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301501898.000000001348B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766838985.000000001344A000.00000004.00000001.sdmp String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/.
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/ExchangeAutoDiscoverhttps:/
Source: EXCEL.EXE, 00000000.00000003.496815318.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.679242228.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576012897.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301289449.000000001335A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766565007.0000000013359000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756617656.0000000013359000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://webshell.suite.office.com
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios&
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://wus2.contentsync.
Source: EXCEL.EXE, 00000000.00000003.756085438.000000000F935000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576719662.000000000F935000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.504427495.000000000F935000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://wus2.pagecontentsync.
Source: EXCEL.EXE, 00000000.00000003.679220709.0000000013341000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.496781565.0000000013341000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.756599523.0000000013341000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301274679.0000000013341000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576000870.0000000013341000.00000004.00000001.sdmp, 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: EXCEL.EXE, 00000000.00000003.301167821.0000000013497000.00000004.00000001.sdmp String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2Azur
Source: 7A7D450E-0610-43BD-BE93-0BD5327AEEE8.0.dr String found in binary or memory: https://www.odwebp.svc.ms
Source: EXCEL.EXE, 00000000.00000003.579371357.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.497487929.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576896463.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.678241442.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.505229587.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.766929348.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.581187863.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.637299838.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.639236949.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.619931841.00000000134C1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.301191786.00000000134CF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576218623.00000000134C1000.00000004.00000001.sdmp String found in binary or memory: https://www.odwebp.svc.msom
Source: besta.ocx.0.dr, P0UY3TPH.htm.0.dr String found in binary or memory: https://www.thinkwithgoogle.com/intl/es-419/futuro-del-marketing/transformacion-digital/tiendas-omni
Source: P0UY3TPH.htm.0.dr String found in binary or memory: https://www.thinkwithgoogle.com/intl/es-419/insights/tendencias-de-consumo/6-certezas-sobre-el-nuevo
Source: unknown DNS traffic detected: queries for: standoutglobal.com
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: vendes.marketing
Source: global traffic HTTP traffic detected: GET /2/MWpqeVgZ/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: standoutglobal.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /2/MWpqeVgZ/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: standoutglobal.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /2/MWpqeVgZ/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: standoutglobal.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /2/MWpqeVgZ/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: standoutglobal.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /2/MWpqeVgZ/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: standoutglobal.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /2/MWpqeVgZ/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: standoutglobal.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /2/MWpqeVgZ/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: standoutglobal.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /2/MWpqeVgZ/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: standoutglobal.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /transmigrant/Wplzr/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: vendes.marketingConnection: Keep-Alive
Source: unknown HTTPS traffic detected: 107.180.46.229:443 -> 192.168.2.3:49807 version: TLS 1.2

System Summary:

barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: ENABLE EDITING" FROM YELLOW BAR ABOVE 5 Once you have enabled editing, please click "Enable Conte
Source: Screenshot number: 4 Screenshot OCR: protected documents. r 3 4 CLICK "ENABLE EDITING" FROM YELLOW BAR ABOVE 5 Once you have enabl
Source: Screenshot number: 4 Screenshot OCR: Enable Content" button 6 * "=, 7 m = : I 8 9 RunDLL X 10 11 12 I): 13_ There was a probl
Source: Screenshot number: 12 Screenshot OCR: ENABLE EDITING" FROM YELLOW BAR ABOVE 5 Once you have enabled editing, please click "Enable Content
Source: Screenshot number: 12 Screenshot OCR: protected documents. 4 CLICK "ENABLE EDITING" FROM YELLOW BAR ABOVE 5 Once you have enabled editin
Source: Screenshot number: 12 Screenshot OCR: Enable Content" button 6 , Gb ) 14 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30
Source: Document image extraction number: 0 Screenshot OCR: ENABLE EDITING" FROM YELLOW BAR ABOVE Once you have enabled editing, please click "Enable Content"
Source: Document image extraction number: 0 Screenshot OCR: protected documents. CLICK "ENABLE EDITING" FROM YELLOW BAR ABOVE Once you have enabled editing, p
Source: Document image extraction number: 0 Screenshot OCR: Enable Content" button
Source: Document image extraction number: 1 Screenshot OCR: ENABLE EDITING" FROM YELLOW BAR ABOVE Once you have enabled editing, please click "Enable Content'
Source: Document image extraction number: 1 Screenshot OCR: protected documents. CLICK "ENABLE EDITING" FROM YELLOW BAR ABOVE Once you have enabled editing, p
Source: Document image extraction number: 1 Screenshot OCR: Enable Content' button
Found a hidden Excel 4.0 Macro sheet
Source: SCAN_7295943480515097.xlsm Macro extractor: Sheet name: Buk2
Source: SCAN_7295943480515097.xlsm Macro extractor: Sheet name: Buk5
Source: SCAN_7295943480515097.xlsm Macro extractor: Sheet name: Buk1
Source: SCAN_7295943480515097.xlsm Macro extractor: Sheet name: Buk7
Source: SCAN_7295943480515097.xlsm Macro extractor: Sheet name: EFEWF
Source: SCAN_7295943480515097.xlsm Macro extractor: Sheet name: Buk3
Source: SCAN_7295943480515097.xlsm Macro extractor: Sheet name: Buk4
Source: SCAN_7295943480515097.xlsm Macro extractor: Sheet name: Buk6
Excel documents contains an embedded macro which executes code when the document is opened
Source: workbook.xml Binary string: \Desktop\Fil\1d\Cir\" xmlns:x15ac="http://schemas.microsoft.com/office/spreadsheetml/2010/11/ac"/></mc:Choice></mc:AlternateContent><xr:revisionPtr revIDLastSave="0" documentId="13_ncr:1_{8197EE46-A436-4D64-BA91-0FA619A1F240}" xr6:coauthVersionLast="45" xr6:coauthVersionMax="45" xr10:uidLastSave="{00000000-0000-0000-0000-000000000000}"/><bookViews><workbookView xWindow="-120" yWindow="-120" windowWidth="20730" windowHeight="11160" xr2:uid="{00000000-000D-0000-FFFF-FFFF00000000}"/></bookViews><sheets><sheet name="Sheet" sheetId="1" r:id="rId1"/><sheet name="Ss1" sheetId="2" state="hidden" r:id="rId2"/><sheet name="Ss1br2" sheetId="3" state="hidden" r:id="rId3"/><sheet name="Ssbr3" sheetId="4" state="hidden" r:id="rId4"/><sheet name="EFEWF" sheetId="5" state="hidden" r:id="rId5"/><sheet name="Buk1" sheetId="6" state="hidden" r:id="rId6"/><sheet name="Buk2" sheetId="7" state="hidden" r:id="rId7"/><sheet name="Buk3" sheetId="8" state="hidden" r:id="rId8"/><sheet name="Buk4" sheetId="9" state="hidden" r:id="rId9"/><sheet name="Buk5" sheetId="10" state="hidden" r:id="rId10"/><sheet name="Buk6" sheetId="11" state="hidden" r:id="rId11"/><sheet name="Buk7" sheetId="12" state="hidden" r:id="rId12"/></sheets><definedNames><definedName name="LKLW">EFEWF!$D$3</definedName><definedName name="SASA">EFEWF!$D$17</definedName><definedName name="SASA1">EFEWF!$D$19</definedName><definedName name="SASA2">EFEWF!$D$21</definedName><definedName name="_xlnm.Auto_Open">EFEWF!$D$1</definedName></definedNames><calcPr calcId="191029"/><extLst><ext uri="{B58B0392-4F1F-4190-BB64-5DF3571DCE5F}" xmlns:xcalcf="http://schemas.microsoft.com/office/spreadsheetml/2018/calcfeatures"><xcalcf:calcFeatures><xcalcf:feature name="microsoft.com:RD"/><xcalcf:feature name="microsoft.com:FV"/></xcalcf:calcFeatures></ext></extLst></workbook>
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: 33AE098B.tmp.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: SCAN_7295943480515097.xlsm Virustotal: Detection: 21%
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWow64\rundll32.exe ..\besta.ocx,44532.4348061343
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWow64\rundll32.exe ..\besta.ocx,44532.4348061343
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWow64\rundll32.exe ..\besta.ocx,44532.4348061343 Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\{F9890484-3185-4E88-AF21-6A7ED6A45B11} - OProcSessId.dat Jump to behavior
Source: classification engine Classification label: mal68.expl.winXLSM@3/7@2/2
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: SCAN_7295943480515097.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet4.xml
Source: SCAN_7295943480515097.xlsm Initial sample: OLE zip file path = xl/media/image1.png
Source: SCAN_7295943480515097.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: SCAN_7295943480515097.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet3.xml.rels
Source: SCAN_7295943480515097.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: SCAN_7295943480515097.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings3.bin
Source: SCAN_7295943480515097.xlsm Initial sample: OLE zip file path = xl/calcChain.xml
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File opened: C:\Windows\SysWOW64\MSVCR100.dll Jump to behavior
Source: 33AE098B.tmp.0.dr Initial sample: OLE indicators vbamacros = False
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: EXCEL.EXE, 00000000.00000003.576450267.000000000F843000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.765337977.000000000F843000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.757995308.000000000F843000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.762801502.000000000DAD2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.755312472.000000000F843000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.504042632.000000000F843000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW
Source: EXCEL.EXE, 00000000.00000003.616931093.0000000015D81000.00000004.00000001.sdmp Binary or memory string: hJ2oKAy8cULD4mZTt5Qocx2uhequnX4mNxDjUY8j64ciLpywHhTZibYsGPurHLpKlTSPvMNetW9Z
Source: EXCEL.EXE, 00000000.00000003.755251041.000000000F7D1000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.765112970.000000000F7D8000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.576386896.000000000F7D9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.503855280.000000000F7DA000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.757746553.000000000F7D3000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW.microsoft.com
Source: EXCEL.EXE, 00000000.00000003.755273769.000000000F805000.00000004.00000001.sdmp Binary or memory string: &Vn_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Vol

HIPS / PFW / Operating System Protection Evasion:

barindex
Yara detected Xls With Macro 4.0
Source: Yara match File source: app.xml, type: SAMPLE
Source: EXCEL.EXE, 00000000.00000002.761265331.0000000003170000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: EXCEL.EXE, 00000000.00000002.761265331.0000000003170000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: EXCEL.EXE, 00000000.00000002.761265331.0000000003170000.00000002.00020000.sdmp Binary or memory string: Progman
Source: EXCEL.EXE, 00000000.00000002.761265331.0000000003170000.00000002.00020000.sdmp Binary or memory string: Progmanlock
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 532474 Sample: SCAN_7295943480515097.xlsm Startdate: 02/12/2021 Architecture: WINDOWS Score: 68 19 Multi AV Scanner detection for submitted file 2->19 21 Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros) 2->21 23 Sigma detected: Microsoft Office Product Spawning Windows Shell 2->23 25 Document exploit detected (process start blacklist hit) 2->25 6 EXCEL.EXE 27 37 2->6         started        process3 dnsIp4 15 standoutglobal.com 162.240.9.126, 49740, 80 UNIFIEDLAYER-AS-1US United States 6->15 17 vendes.marketing 107.180.46.229, 443, 49806, 49807 AS-26496-GO-DADDY-COM-LLCUS United States 6->17 13 C:\Users\...\~$SCAN_7295943480515097.xlsm, data 6->13 dropped 27 Document exploit detected (UrlDownloadToFile) 6->27 11 rundll32.exe 6->11         started        file5 signatures6 process7
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
162.240.9.126
 standoutglobal.com United States
46606 UNIFIEDLAYER-AS-1US false
107.180.46.229
 vendes.marketing United States
26496 AS-26496-GO-DADDY-COM-LLCUS false

Contacted Domains

Name IP Active
standoutglobal.com 162.240.9.126 true
vendes.marketing 107.180.46.229 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://vendes.marketing/transmigrant/Wplzr/ false
  • Avira URL Cloud: safe
 unknown