Windows Analysis Report CU-6431 report.xlsm

Overview

General Information

Sample Name: CU-6431 report.xlsm
Analysis ID: 532531
MD5: 0630d6c04e8365531eff7998a7fc40c6
SHA1: e4c59420e2024e4f5f5a14e0cd366023d9d0e636
SHA256: bd2212ffe0d388a61a3041f146a70b242fa69eace0c7a5f5fe991126a679eec4
Infos:

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score: 68
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Multi AV Scanner detection for submitted file
Sigma detected: Microsoft Office Product Spawning Windows Shell
Document exploit detected (process start blacklist hit)
Document exploit detected (UrlDownloadToFile)
Found a hidden Excel 4.0 Macro sheet
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication
Yara detected Xls With Macro 4.0
Contains functionality to detect virtual machines (SLDT)
JA3 SSL client fingerprint seen in connection with other malware
Excel documents contains an embedded macro which executes code when the document is opened
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Document misses a certain OLE stream usually present in this Microsoft Office document type

Classification

AV Detection:

barindex
Multi AV Scanner detection for submitted file
Source: CU-6431 report.xlsm Virustotal: Detection: 30% Perma Link
Source: CU-6431 report.xlsm ReversingLabs: Detection: 20%
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File opened: C:\Windows\SysWOW64\MSVCR100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 162.240.9.126:443 -> 192.168.2.3:49745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.180.46.229:443 -> 192.168.2.3:49747 version: TLS 1.2

Software Vulnerabilities:

barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process created: C:\Windows\SysWOW64\rundll32.exe
Document exploit detected (UrlDownloadToFile)
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Section loaded: unknown origin: URLDownloadToFileA Jump to behavior
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.3:49744 -> 162.240.9.126:80
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: standoutglobal.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.3:49745 -> 162.240.9.126:443

Networking:

barindex
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /2/MWpqeVgZ/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: standoutglobal.com
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: vendes.marketing
Source: global traffic HTTP traffic detected: GET /2/MWpqeVgZ/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: standoutglobal.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /transmigrant/Wplzr/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: vendes.marketingConnection: Keep-Alive
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: src="https://www.facebook.com/tr?id=408176514230511&ev=PageView&noscript=1" equals www.facebook.com (Facebook)
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 02 Dec 2021 10:35:21 GMTServer: ApacheVary: Accept-Encoding,CookieExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://standoutglobal.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: EXCEL.EXE, 00000001.00000002.579598601.0000000012DDA000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glideso-
Source: EXCEL.EXE, 00000001.00000002.577222365.000000000D970000.00000004.00000001.sdmp String found in binary or memory: http://purl.oclc.org/ooxml/drawingml/diagram
Source: EXCEL.EXE, 00000001.00000002.577171036.000000000D950000.00000004.00000001.sdmp String found in binary or memory: http://purl.oclc.org/ooxml/drawingml/tablet
Source: EXCEL.EXE, 00000001.00000003.280878153.0000000013072000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.280700035.0000000013072000.00000004.00000001.sdmp String found in binary or memory: http://schemas.micro
Source: EXCEL.EXE, 00000001.00000003.280878153.0000000013072000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.280700035.0000000013072000.00000004.00000001.sdmp String found in binary or memory: http://schemas.microso
Source: EXCEL.EXE, 00000001.00000003.280878153.0000000013072000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.280700035.0000000013072000.00000004.00000001.sdmp String found in binary or memory: http://schemas.microsoft.c
Source: EXCEL.EXE, 00000001.00000003.280878153.0000000013072000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.280700035.0000000013072000.00000004.00000001.sdmp String found in binary or memory: http://schemas.o
Source: EXCEL.EXE, 00000001.00000003.494651295.0000000015B3B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.436061013.0000000015C69000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420404785.0000000015C4A000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420387500.0000000015C1A000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.436036008.0000000015C39000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.436010972.0000000015C09000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420365504.0000000015BEA000.00000004.00000001.sdmp String found in binary or memory: http://schemas.open
Source: EXCEL.EXE, 00000001.00000003.436010972.0000000015C09000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420365504.0000000015BEA000.00000004.00000001.sdmp String found in binary or memory: http://schemas.openformatrg/drawml/2006/spreadsheetD
Source: EXCEL.EXE, 00000001.00000003.494651295.0000000015B3B000.00000004.00000001.sdmp String found in binary or memory: http://schemas.openformatrg/package/2006/content-t
Source: EXCEL.EXE, 00000001.00000003.436061013.0000000015C69000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420404785.0000000015C4A000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420387500.0000000015C1A000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.436036008.0000000015C39000.00000004.00000001.sdmp String found in binary or memory: http://schemas.openformatrg/package/2006/r
Source: EXCEL.EXE, 00000001.00000002.580925419.0000000013069000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456588846.0000000013069000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.435267331.0000000013069000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.384287323.0000000013069000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461618662.0000000013069000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439326803.0000000013069000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.282330406.0000000013069000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421093734.0000000013069000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491592848.0000000013069000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.280878153.0000000013072000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.280700035.0000000013072000.00000004.00000001.sdmp String found in binary or memory: http://schemas.openxmlf
Source: EXCEL.EXE, 00000001.00000003.280878153.0000000013072000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.280700035.0000000013072000.00000004.00000001.sdmp String found in binary or memory: http://schemas.opyFp
Source: EXCEL.EXE, 00000001.00000002.581690608.00000000159CB000.00000004.00000001.sdmp String found in binary or memory: http://standoutglobal.c
Source: EXCEL.EXE, 00000001.00000002.581690608.00000000159CB000.00000004.00000001.sdmp String found in binary or memory: http://standoutglobal.co
Source: EXCEL.EXE, 00000001.00000002.581690608.00000000159CB000.00000004.00000001.sdmp String found in binary or memory: http://standoutglobal.com%http://standoutglobal.com/2/MWpqeVgZ/
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: http://standoutglobal.com/2/MWpqeVgZ/
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: http://vendes.marketing/
Source: EXCEL.EXE, 00000001.00000003.382563366.000000001308B000.00000004.00000001.sdmp String found in binary or memory: http://vendes.marketing/transmig
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp String found in binary or memory: http://vendes.marketing/transmigrant/Wplzr/
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp String found in binary or memory: http://vendes.marketing/transmigrant/Wplzr/;
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionloggingPR
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://addinsinstallation.store.office.com/app/downloadAppInfoQuery15https://api.addins.omex.office
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://addinslicensing.store.office.com/commerce/queryDeepLinkingServicehttps://api.addins.store.of
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://addinslicensing.store.office.com/commerce/queryg
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/queryBearer
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query~Rw
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382579863.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461680797.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421133082.00000000130A6000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: EXCEL.EXE, 00000001.00000002.581635779.0000000015990000.00000004.00000001.sdmp String found in binary or memory: https://analysis.windows.net/powerbi/apiMruMaxLocalItemCount100EnableXL2PBIFullFidelityfalseEnableXL
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechBearer
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://api.aadrm.com
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://api.aadrm.com/
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://api.addins.store.office.com/addinstemplateS
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://api.addins.store.office.com/app/query
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://api.addins.store.office.com/app/queryAppStateQuery15https://api.addins.omex.office.net/appst
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://api.cortana.ai
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://api.diagnostics.office.com
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://api.diagnostics.office.comW
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://api.diagnosticssdf.office.com
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://api.diagnosticssdf.office.comp
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://api.microsoftstream.com/api/
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp String found in binary or memory: https://api.microsoftstream.com/api/m
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://api.office.net
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://api.office.net.
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://api.office.net5
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://api.office.net5O
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://api.office.netF
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://api.office.net_
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://api.onedrive.com
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://api.onedrive.comcent
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://api.powerbi.com/beta/myorg/importsV
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: EXCEL.EXE, 00000001.00000003.433785669.000000000F6E3000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456171717.0000000013079000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439337436.0000000013079000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580947514.0000000013079000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://api.w.org/
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://apis.live.net/v5.0/
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://apis.live.net/v5.0/ne.
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://arc.msn.com/v4/api/selectionM
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/OneNoteBulletinshttps://
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/z
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://augloop.office.com
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://augloop.office.com/v2
Source: EXCEL.EXE, 00000001.00000003.422011923.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.435352332.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456373840.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.282488457.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581020691.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439375212.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494762665.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382579863.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461680797.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421133082.00000000130A6000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://augloop.office.comH
Source: EXCEL.EXE, 00000001.00000003.420487030.000000000F668000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581635779.0000000015990000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.577929196.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382801866.000000000F668000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.433675805.000000000F668000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://autodiscover-s.outlook.com/
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://cdn.entity.
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.pngx
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsellr-j
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://clients.config.office.net/
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp String found in binary or memory: https://clients.config.office.net/H
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://clients.config.office.net/user/v1.0/iosy
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkeyures
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://cloudfiles.onenote.com/upload.aspxOneNoteCloudFilesConsumerEmbedhttps://onedrive.live.com/em
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://config.edge.skype.com
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://connect.facebook.net/en_US/fbevents.js
Source: EXCEL.EXE, 00000001.00000003.382012892.0000000015A33000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://connect.facebook.net/es_LA/sdk/xfbml.customerchat.js
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://cortana.ai
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://cortana.ai/api
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://cortana.ai/apiI.
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://cortana.aietlF/
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://cr.office.com
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://cr.office.com_/
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://dataservice.o365filtering.com
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://dataservice.o365filtering.com/
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.comE
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.comH
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.comK
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.comn
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.com~
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile~
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPoliciesBearer
Source: EXCEL.EXE, 00000001.00000002.579794121.0000000012E6D000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPoliciesvU
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://dev.cortana.ai
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://devnull.onenote.com
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://devnull.onenote.comBearer
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://devnull.onenote.comMBI_SSL_SHORT
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://devnull.onenote.comt
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://directory.services.
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://enrichment.osi.office.net/
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1B5
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1/
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/u
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtmlP3H
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://entitlement.diagnostics.office.com
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://entitlement.diagnostics.office.com0
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp String found in binary or memory: https://entity.osi.office.net/t
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech2F
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechBearer
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-androidUserVoiceOf
Source: EXCEL.EXE, 00000001.00000002.579029622.0000000012CD0000.00000004.00000001.sdmp String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-androidp
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://fonts.googleapis.com/css2?family=Josefin
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://fonts.googleapis.com/css2?family=Roboto:ital
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://graph.ppe.windows.net
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://graph.ppe.windows.net/
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://graph.ppe.windows.net/-
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://graph.windows.net
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://graph.windows.net/
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://hubble.officeapps.live.com
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://hubble.officeapps.live.com7
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://hubble.officeapps.live.comn
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580437283.0000000012F52000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494575204.0000000012F4C000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: EXCEL.EXE, 00000001.00000003.382505599.0000000013048000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580901025.0000000013048000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetryOfficeOnlineContenthttps://insertmedia.
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3ddI
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&amp;premium=1
Source: EXCEL.EXE, 00000001.00000002.579029622.0000000012CD0000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&amp;premium=1
Source: EXCEL.EXE, 00000001.00000003.382474617.000000001301A000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439243495.000000001301A000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434833888.0000000013019000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421041076.0000000013019000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494384383.000000001301A000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.282412041.000000001301E000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461524519.000000001301A000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580829333.000000001301A000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456076552.000000001301A000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.422155036.0000000013019000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1rev=
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&amp;premium=1
Source: EXCEL.EXE, 00000001.00000003.382474617.000000001301A000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439243495.000000001301A000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434833888.0000000013019000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421041076.0000000013019000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494384383.000000001301A000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.282412041.000000001301E000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461524519.000000001301A000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580829333.000000001301A000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456076552.000000001301A000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.422155036.0000000013019000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580437283.0000000012F52000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494575204.0000000012F4C000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: EXCEL.EXE, 00000001.00000003.382505599.0000000013048000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580901025.0000000013048000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?OfficeOnlineContentM365Iconshttps://hu
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://incidents.diagnostics.office.com
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://incidents.diagnosticssdf.office.comb
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://inclient.store.office.com/gyro/clientstore3
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://inclient.store.office.com/gyro/clientstoret
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://inclient.store.office.com/gyro/clienttx
Source: EXCEL.EXE, 00000001.00000002.579029622.0000000012CD0000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=ImmersiveAppmG
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&amp;adlt=strict&amp;hostType=Immersive
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: EXCEL.EXE, 00000001.00000003.382505599.0000000013048000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580901025.0000000013048000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArtOfficeOnlineContentF
Source: EXCEL.EXE, 00000001.00000002.579794121.0000000012E6D000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArtpB
Source: EXCEL.EXE, 00000001.00000002.579794121.0000000012E6D000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: EXCEL.EXE, 00000001.00000003.382505599.0000000013048000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580901025.0000000013048000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=FlickrMBI_SSL_SHORTssl.
Source: EXCEL.EXE, 00000001.00000002.579794121.0000000012E6D000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: EXCEL.EXE, 00000001.00000003.382505599.0000000013048000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580901025.0000000013048000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDriveMBI_SSL_SHORTssl.
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: EXCEL.EXE, 00000001.00000003.382505599.0000000013048000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580901025.0000000013048000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmediaMBI_SSL_SHORTofficeapps.
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeechBearer
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://lifecycle.office.com
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://lifecycle.office.comMBI_SSL_SHORThttps://lifecycle.office.com
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://lifecycle.office.comP
Source: EXCEL.EXE, 00000001.00000003.457638365.0000000015B63000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.438766538.0000000015B5F000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581995527.0000000015B65000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.433266138.0000000015B66000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455106967.0000000015B5C000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.458142250.0000000015B5C000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421211798.0000000015B66000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.457152596.0000000015B5C000.00000004.00000001.sdmp String found in binary or memory: https://login.live.com3333
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://login.microsoftonline.com/
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize?
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://login.windows.local
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.localtes
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize#
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize$%
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize%
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize&
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize-
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize.
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize0
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize1
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize2
Source: EXCEL.EXE, 00000001.00000003.422011923.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.435352332.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456373840.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.282488457.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581020691.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439375212.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494762665.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382579863.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461680797.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421133082.00000000130A6000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize3
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize6
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize=
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize?
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeC
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeD
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeE
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeF
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeG
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeO
Source: EXCEL.EXE, 00000001.00000003.422011923.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.435352332.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456373840.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.282488457.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581020691.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439375212.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494762665.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382579863.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461680797.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421133082.00000000130A6000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeP
Source: EXCEL.EXE, 00000001.00000003.422011923.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.435352332.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456373840.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.282488457.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581020691.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439375212.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494762665.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382579863.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461680797.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421133082.00000000130A6000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeQ
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeU
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeV
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeW
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeb
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizec
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorized
Source: EXCEL.EXE, 00000001.00000003.422011923.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.435352332.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456373840.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.282488457.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581020691.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439375212.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494762665.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382579863.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461680797.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421133082.00000000130A6000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizee
Source: EXCEL.EXE, 00000001.00000003.422011923.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.435352332.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456373840.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.282488457.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581020691.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439375212.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494762665.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382579863.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461680797.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421133082.00000000130A6000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizef
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizefic
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeizeB
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizej
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizek
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizep
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeq
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizer
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizes
Source: EXCEL.EXE, 00000001.00000002.579029622.0000000012CD0000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizest
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizet
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeu
Source: EXCEL.EXE, 00000001.00000003.422011923.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.435352332.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456373840.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.282488457.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581020691.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439375212.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494762665.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382579863.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461680797.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421133082.00000000130A6000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizev
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1MBI_SSL_SHORT
Source: EXCEL.EXE, 00000001.00000003.422011923.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.435352332.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456373840.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.282488457.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581020691.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439375212.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494762665.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382579863.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461680797.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421133082.00000000130A6000.00000004.00000001.sdmp String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1w
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://management.azure.com
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://management.azure.com/
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://management.azure.com/t
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://messaging.office.com/
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech/F
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechBearer
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://ncus.contentsync.
Source: EXCEL.EXE, 00000001.00000003.494676351.0000000012EE8000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580094671.0000000012EEA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp String found in binary or memory: https://ncus.paaz
Source: EXCEL.EXE, 00000001.00000003.422011923.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.435352332.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456373840.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.282488457.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581020691.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439375212.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494762665.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382579863.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461680797.00000000130A6000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421133082.00000000130A6000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://ncus.pagecontentsync.
Source: EXCEL.EXE, 00000001.00000003.382185365.0000000015AE1000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapcom/
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com
Source: EXCEL.EXE, 00000001.00000003.282355078.000000001308B000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/R
Source: EXCEL.EXE, 00000001.00000003.282488457.00000000130A6000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/nexus/
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/nexus/rules
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382692648.000000000F62C000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/nexus/rules?Application=excel.exe&Version=16.0.4954.1000&ClientId=
Source: EXCEL.EXE, 00000001.00000003.282488457.00000000130A6000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com:443/nexus/rules?Applic
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecordDF
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecordhttps://login.windows.net/co
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://o365auditrealtimeingestion.manage.office.comBearer
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.netRx
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://ocos-office365-s2s.msedge.net/abe
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: EXCEL.EXE, 00000001.00000003.382563366.000000001308B000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://officeapps.live.com
Source: EXCEL.EXE, 00000001.00000003.282355078.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439358085.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421588516.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456199157.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491646356.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461659602.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580998572.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434685629.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382563366.000000001308B000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com$
Source: EXCEL.EXE, 00000001.00000003.282355078.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439358085.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421588516.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456199157.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491646356.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461659602.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580998572.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434685629.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382563366.000000001308B000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com.
Source: EXCEL.EXE, 00000001.00000003.282355078.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439358085.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421588516.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456199157.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491646356.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461659602.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580998572.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434685629.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382563366.000000001308B000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com2
Source: EXCEL.EXE, 00000001.00000003.282355078.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439358085.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421588516.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456199157.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491646356.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461659602.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580998572.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434685629.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382563366.000000001308B000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com6
Source: EXCEL.EXE, 00000001.00000003.282355078.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439358085.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421588516.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456199157.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491646356.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461659602.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580998572.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434685629.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382563366.000000001308B000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com8
Source: EXCEL.EXE, 00000001.00000003.282355078.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439358085.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421588516.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456199157.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491646356.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461659602.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580998572.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434685629.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382563366.000000001308B000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comL
Source: EXCEL.EXE, 00000001.00000003.282355078.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439358085.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421588516.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456199157.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491646356.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461659602.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580998572.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434685629.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382563366.000000001308B000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comP
Source: EXCEL.EXE, 00000001.00000003.282355078.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439358085.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421588516.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456199157.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491646356.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461659602.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580998572.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434685629.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382563366.000000001308B000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comZ
Source: EXCEL.EXE, 00000001.00000003.282355078.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439358085.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421588516.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456199157.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491646356.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461659602.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580998572.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434685629.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382563366.000000001308B000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comb
Source: EXCEL.EXE, 00000001.00000003.282355078.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439358085.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421588516.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456199157.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491646356.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461659602.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580998572.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434685629.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382563366.000000001308B000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comd
Source: EXCEL.EXE, 00000001.00000003.282355078.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439358085.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421588516.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456199157.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491646356.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461659602.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580998572.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434685629.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382563366.000000001308B000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comn
Source: EXCEL.EXE, 00000001.00000003.282355078.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439358085.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421588516.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456199157.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491646356.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461659602.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580998572.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434685629.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382563366.000000001308B000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comv
Source: EXCEL.EXE, 00000001.00000003.282355078.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439358085.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421588516.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456199157.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491646356.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461659602.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580998572.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434685629.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382563366.000000001308B000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comx
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://officesetup.getmicrosoftkey.coms
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities/sche
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesk
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://onedrive.live.com
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://onedrive.live.com/embed?
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://onedrive.live.com/embed?i
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://onedrive.live.com4
Source: EXCEL.EXE, 00000001.00000003.382505599.0000000013048000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580901025.0000000013048000.00000004.00000001.sdmp String found in binary or memory: https://onedrive.live.comOneDriveLogUploadServicehttps://storage.live.com/clientlogs/uploadlocationM
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://onedrive.live.comed
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://osi.office.net
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://osi.office.netQ-
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://osi.office.netX-
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://osi.office.netst
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://otelrules.azureedge.net
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://outlook.office.com
Source: EXCEL.EXE, 00000001.00000003.420487030.000000000F668000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581635779.0000000015990000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.577929196.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382801866.000000000F668000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.433675805.000000000F668000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://outlook.office.com/
Source: EXCEL.EXE, 00000001.00000002.579794121.0000000012E6D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581635779.0000000015990000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office.comC
Source: EXCEL.EXE, 00000001.00000002.581635779.0000000015990000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office.comSharepointFilesHostFormat
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office.comonG
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580437283.0000000012F52000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494575204.0000000012F4C000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office.comships
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580437283.0000000012F52000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581635779.0000000015990000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494575204.0000000012F4C000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://outlook.office365.com
Source: EXCEL.EXE, 00000001.00000003.282355078.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439358085.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421588516.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420487030.000000000F668000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456199157.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491646356.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461659602.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581635779.0000000015990000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.577929196.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580998572.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382801866.000000000F668000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434685629.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382563366.000000001308B000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.433675805.000000000F668000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://outlook.office365.com/
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.jsonwr9
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=OutlookMBI_SSL_SHORT
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://pages.store.office.com/review/query
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://pages.store.office.com/review/queryTemplateStarthttps://
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://pages.store.office.com/review/queryrd
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspxAwsCgQueryhttps://
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: EXCEL.EXE, 00000001.00000002.579794121.0000000012E6D000.00000004.00000001.sdmp String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptionsmU
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json3-U
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp String found in binary or memory: https://portal.office.
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13db8
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://powerlift-frontdesk.acompli.netPowerLiftGymBaseUrlhttps://powerlift.acompli.netSubstrateOffi
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://powerlift.acompli.net
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://roaming.edog.
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: EXCEL.EXE, 00000001.00000003.382012892.0000000015A33000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://s.w.org/images/core/emoji/13.1.0/svg/1f609.svg
Source: EXCEL.EXE, 00000001.00000002.580981700.0000000013083000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456615459.0000000013083000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382557056.0000000013083000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491634483.0000000013083000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://schema.org
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://settings.outlook.com
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://settings.outlook.comS
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://shell.suite.office.com:1443
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://skyapi.live.net/Activity/
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/workPowerBIGetDatasetsApihttps://api.pow
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/workhttps://login.windows.net/common/oau
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://staging.cortana.ai
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://staging.cortana.ai)
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://staging.cortana.airl7
Source: EXCEL.EXE, 00000001.00000003.421637044.0000000015A61000.00000004.00000001.sdmp String found in binary or memory: https://standoutglobal.com/
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://standoutglobal.com/2/MWpqeVgZ/
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://standoutglobal.com/2/MWpqeVgZ/A
Source: EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp String found in binary or memory: https://standoutglobal.com/wp-json/
Source: EXCEL.EXE, 00000001.00000002.579755476.0000000012E2B000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://store.office.cn/addinstemplate
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://store.office.de/addinstemplate
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com/Todo-Internal.ReadWrite
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com6
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com;
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.comP
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.comQ
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.comc
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.comj
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.comq
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFileM3g
Source: EXCEL.EXE, 00000001.00000003.494745897.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434093599.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455806682.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420762859.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382238814.0000000012EDA000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580027770.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439031880.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461211560.0000000012ED5000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491715403.0000000012ED5000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://tasks.office.com
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://tasks.office.comw
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://tellmeservice.osi.office.netst
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: EXCEL.EXE, 00000001.00000002.579794121.0000000012E6D000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: EXCEL.EXE, 00000001.00000003.421917396.0000000013079000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.384312092.0000000013079000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461632649.0000000013079000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.435017611.0000000013079000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491604378.0000000013079000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456171717.0000000013079000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439337436.0000000013079000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580947514.0000000013079000.00000004.00000001.sdmp String found in binary or memory: https://vendes.marketing
Source: BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/
Source: EXCEL.EXE, 00000001.00000003.438879530.0000000015A60000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.433112706.0000000015A64000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.457435159.0000000015A51000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.458744854.0000000015A55000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581811802.0000000015A64000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382043441.0000000015A64000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.493845933.0000000015A51000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.459293250.0000000015A55000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455490275.0000000015A5C000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421637044.0000000015A61000.00000004.00000001.sdmp String found in binary or memory: https://vendes.marketing/$s
Source: EXCEL.EXE, 00000001.00000003.382563366.000000001308B000.00000004.00000001.sdmp String found in binary or memory: https://vendes.marketing/LMEM8H
Source: EXCEL.EXE, 00000001.00000003.382185365.0000000015AE1000.00000004.00000001.sdmp String found in binary or memory: https://vendes.marketing/RRC:
Source: EXCEL.EXE, 00000001.00000003.382012892.0000000015A33000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital-en-cdmx/
Source: EXCEL.EXE, 00000001.00000003.382012892.0000000015A33000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital-en-guadalajara/
Source: EXCEL.EXE, 00000001.00000003.382012892.0000000015A33000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital-en-monterrey/
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/auditorias-y-optimizacion-de-camp
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/consultoria-en-marketing-basado-e
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/consultoria-para-adsense/
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/consultoria-para-youtube/
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/digital-partner-incubadora-de-neg
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/marketing-para-el-sector-salud/
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/marketing-para-inmobiliarias-cons
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/marketing-para-startups/
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/consultorias/transformacion-de-empresas/
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/amazon-seo/
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/conversion-rate-optimizati
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/crm/
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/emailing/
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/google-merchant-center/
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/pagos-online/
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/tienda-online-con-magento/
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/tienda-online-con-shopify/
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/tienda-online-con-wordpres
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/e-commerce-efectivo/tiendas-en-facebook-e-inst
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/amazon-seo/
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/conversion-rate-optimization/
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/crm/
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/emailing/
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/google-merchant-center/
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/pagos-online/
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/tienda-online-con-magento/
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/tienda-online-con-shopify/
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/tienda-online-con-wordpress-woocomme
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/ecommerce/tiendas-en-facebook-e-instagram/
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-creativos/
Source: BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-creativos/branding/
Source: BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-creativos/diseno-editorial/
Source: BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-creativos/diseno-grafico/
Source: BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-creativos/diseno-web-ux/
Source: BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-creativos/fotografia-y-edicion/
Source: BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-creativos/produccion-audiovisual/
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-desarrollo-web/
Source: BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-desarrollo-web/automatizacion-de-
Source: BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-desarrollo-web/desarrollo-de-apli
Source: BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-desarrollo-web/desarrollo-de-mega
Source: BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-desarrollo-web/desarrollo-de-pagi
Source: BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-desarrollo-web/desarrollo-de-tien
Source: BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/
Source: BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/creacion-de-con
Source: BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/estrategias-en-
Source: BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/facebook-ads/
Source: BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/google-ads-adwo
Source: BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/inbound-marketi
Source: BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/inteligencia-de
Source: BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/publicidad-digi
Source: BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/agencia-de-marketing-digital/servicios-de-marketing-digital/seo-posicionami
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/blog/
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/comments/feed/
Source: EXCEL.EXE, 00000001.00000003.438879530.0000000015A60000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.433112706.0000000015A64000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.457435159.0000000015A51000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.458744854.0000000015A55000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581811802.0000000015A64000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382043441.0000000015A64000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.493845933.0000000015A51000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.459293250.0000000015A55000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455490275.0000000015A5C000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421637044.0000000015A61000.00000004.00000001.sdmp String found in binary or memory: https://vendes.marketing/dr
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/feed/
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor-pro/assets/css/frontend.min.css?ver=3.0.2
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.0.2
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor-pro/assets/lib/lottie/lottie.min.js?ver=5.6.6
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor-pro/assets/lib/smartmenus/jquery.smartmenus.mi
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor-pro/assets/lib/sticky/jquery.sticky.min.js?ver
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=3.4.8
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.4.8
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.4.8
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/js/preloaded-modules.min.js?ver=3.4.8
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.4.8
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/animations/animations.min.css?ver=3
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/dialog/dialog.min.js?ver=4.8.1
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.eot?5.10.0);src
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.svg?5.10.0#eico
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.ttf?5.10.0)
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff2?5.10.0)
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff?5.10.0)
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/font-awesome/css/all.min.css?ver=4.
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/font-awesome/css/brands.min.css?ver
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/font-awesome/css/font-awesome.min.c
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.min.cs
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/font-awesome/css/solid.min.css?ver=
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/font-awesome/css/v4-shims.min.css?v
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/font-awesome/js/v4-shims.min.js?ver
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js?ver=3.
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/swiper/swiper.min.js?ver=5.3.6
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.0.
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/happy-elementor-addons/assets/fonts/style.min.css?ver=3.
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/plugins/happy-elementor-addons/assets/js/happy-addons.min.js?ver
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/themes/twentytwentyone/assets/css/ie.css?ver=1.4
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/themes/twentytwentyone/assets/css/print.css?ver=1.4
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/themes/twentytwentyone/assets/js/polyfills.js?ver=1.4
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/themes/twentytwentyone/assets/js/primary-navigation.js?ver=1.4
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/themes/twentytwentyone/assets/js/responsive-embeds.js?ver=1.4
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/AE.svg
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/anuncios-300x270.png
Source: BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/anuncios.png
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/apple_android.svg
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/elementor.svg
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/figma.svg
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/framer.svg
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/marketing-digital-con-facebook.png
Source: BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/marketing-digital-con-google-adwords.png
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/marketing-digital-con-instagram.png
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/marketing-digital-con-youtube.png
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/microsoft.svg
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/visual-Studio.svg
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/10/webflow.svg
Source: BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/11/logo-VNDSmkt-final-1024x348.png
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/11/logo-VNDSmkt-final-1536x522.png
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/11/logo-VNDSmkt-final-1568x533.png
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/11/logo-VNDSmkt-final-2048x696.png
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/11/logo-VNDSmkt-final-300x102.png
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/2021/11/logo-VNDSmkt-final-768x261.png
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/elementor/css/global.css?ver=1637592552
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/elementor/css/post-1522.css?ver=1638212153
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/elementor/css/post-2017.css?ver=1638212282
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/elementor/css/post-2157.css?ver=1638212282
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/elementor/css/post-5.css?ver=1637592550
Source: EXCEL.EXE, 00000001.00000003.382012892.0000000015A33000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/images/caso-exito1.png
Source: EXCEL.EXE, 00000001.00000003.382012892.0000000015A33000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/images/comentario1.jpg
Source: EXCEL.EXE, 00000001.00000003.382012892.0000000015A33000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/images/comentario5-m.jpg
Source: EXCEL.EXE, 00000001.00000003.382012892.0000000015A33000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-content/uploads/images/comentario6.jpg
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-includes/css/dist/block-library/style.min.css?ver=5.8.2
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-includes/js/imagesloaded.min.js?ver=4.1.4
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-includes/js/jquery/ui/core.min.js?ver=1.12.1
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-includes/js/wp-embed.min.js?ver=5.8.2
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-includes/wlwmanifest.xml
Source: EXCEL.EXE, 00000001.00000003.456181279.000000001307F000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382185365.0000000015AE1000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421917396.0000000013079000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491626007.000000001307F000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.384326864.000000001307E000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.384312092.0000000013079000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461632649.0000000013079000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.435017611.0000000013079000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.433424228.0000000015AD1000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421150549.0000000015AD7000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491604378.0000000013079000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456171717.0000000013079000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439337436.0000000013079000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580947514.0000000013079000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-json/
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fvendes.marketing%2F
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fvendes.marketing%2F&#038;format=
Source: EXCEL.EXE, 00000001.00000003.456181279.000000001307F000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382185365.0000000015AE1000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491626007.000000001307F000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.384326864.000000001307E000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.433424228.0000000015AD1000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421150549.0000000015AD7000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/wp-json/wp/v2/pages/1522
Source: EXCEL.EXE, 00000001.00000003.383127221.0000000015BE4000.00000004.00000001.sdmp, besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://vendes.marketing/xmlrpc.php?rsd
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devicesUserVoiceWordIOShttps://word.uservoice.com
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://web.microsoftstream.com/video/
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/z3
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://webshell.suite.office.com
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp String found in binary or memory: https://webshell.suite.office.comE
Source: EXCEL.EXE, 00000001.00000003.434130284.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580203373.0000000012F29000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.382272672.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420829297.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494716030.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461288590.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.455845066.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439067632.0000000012F1D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.491763903.0000000012F1D000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://wus2.contentsync.
Source: EXCEL.EXE, 00000001.00000002.579794121.0000000012E6D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://wus2.pagecontentsync.
Source: EXCEL.EXE, 00000001.00000003.382474617.000000001301A000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.439243495.000000001301A000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.434833888.0000000013019000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.421041076.0000000013019000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.494384383.000000001301A000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.282412041.000000001301E000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.461524519.000000001301A000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.580829333.000000001301A000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.456076552.000000001301A000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.422155036.0000000013019000.00000004.00000001.sdmp, 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: EXCEL.EXE, 00000001.00000002.581598775.0000000015940000.00000004.00000001.sdmp String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2Azur
Source: 72CBFE55-51D8-483F-AB8D-10F17659EA7C.1.dr String found in binary or memory: https://www.odwebp.svc.ms
Source: EXCEL.EXE, 00000001.00000002.581651772.00000000159A1000.00000004.00000001.sdmp String found in binary or memory: https://www.odwebp.svc.mst.FP
Source: besta.ocx.1.dr, BX1IWYL9.htm.1.dr String found in binary or memory: https://www.thinkwithgoogle.com/intl/es-419/futuro-del-marketing/transformacion-digital/tiendas-omni
Source: BX1IWYL9.htm.1.dr String found in binary or memory: https://www.thinkwithgoogle.com/intl/es-419/insights/tendencias-de-consumo/6-certezas-sobre-el-nuevo
Source: unknown DNS traffic detected: queries for: standoutglobal.com
Source: global traffic HTTP traffic detected: GET /2/MWpqeVgZ/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: standoutglobal.com
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: vendes.marketing
Source: global traffic HTTP traffic detected: GET /2/MWpqeVgZ/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: standoutglobal.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /transmigrant/Wplzr/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: vendes.marketingConnection: Keep-Alive
Source: unknown HTTPS traffic detected: 162.240.9.126:443 -> 192.168.2.3:49745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 107.180.46.229:443 -> 192.168.2.3:49747 version: TLS 1.2

System Summary:

barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: ENABLE EDITING" FROM YELLOW BAR ABOVE 5 Once you have enabled editing, please click "Enable Content
Source: Screenshot number: 4 Screenshot OCR: protected documents. 4 CLICK "ENABLE EDITING" FROM YELLOW BAR ABOVE 5 Once you have enabled editin
Source: Screenshot number: 4 Screenshot OCR: Enable Content" button 6 7 8 9 10 11 12 13 14 15 16 1'7 T U V W r 18 19 20 1 G
Source: Screenshot number: 8 Screenshot OCR: ENABLE EDITING" FROM YELLOW BAR ABOVE 5 Once you have enabled editing, please click "Enable Content
Source: Screenshot number: 8 Screenshot OCR: protected documents 4 CLICK "ENABLE EDITING" FROM YELLOW BAR ABOVE 5 Once you have enabled editing
Source: Screenshot number: 8 Screenshot OCR: Enable Content" button 6 7 ' O 9 10 11 12 13 14 15 16 1'7 N , O , P , Q , R , S T U V
Source: Document image extraction number: 0 Screenshot OCR: ENABLE EDITING" FROM YELLOW BAR ABOVE Once you have enabled editing, please click "Enable Content"
Source: Document image extraction number: 0 Screenshot OCR: protected documents. CLICK "ENABLE EDITING" FROM YELLOW BAR ABOVE Once you have enabled editing, p
Source: Document image extraction number: 0 Screenshot OCR: Enable Content" button
Source: Document image extraction number: 1 Screenshot OCR: ENABLE EDITING" FROM YELLOW BAR ABOVE Once you have enabled editing, please click "Enable Content'
Source: Document image extraction number: 1 Screenshot OCR: protected documents. CLICK "ENABLE EDITING" FROM YELLOW BAR ABOVE Once you have enabled editing, p
Source: Document image extraction number: 1 Screenshot OCR: Enable Content' button
Found a hidden Excel 4.0 Macro sheet
Source: CU-6431 report.xlsm Macro extractor: Sheet name: Buk2
Source: CU-6431 report.xlsm Macro extractor: Sheet name: Buk5
Source: CU-6431 report.xlsm Macro extractor: Sheet name: Buk1
Source: CU-6431 report.xlsm Macro extractor: Sheet name: Buk7
Source: CU-6431 report.xlsm Macro extractor: Sheet name: EFEWF
Source: CU-6431 report.xlsm Macro extractor: Sheet name: Buk3
Source: CU-6431 report.xlsm Macro extractor: Sheet name: Buk4
Source: CU-6431 report.xlsm Macro extractor: Sheet name: Buk6
Excel documents contains an embedded macro which executes code when the document is opened
Source: workbook.xml Binary string: \Desktop\Fil\1d\Cir\" xmlns:x15ac="http://schemas.microsoft.com/office/spreadsheetml/2010/11/ac"/></mc:Choice></mc:AlternateContent><xr:revisionPtr revIDLastSave="0" documentId="13_ncr:1_{8197EE46-A436-4D64-BA91-0FA619A1F240}" xr6:coauthVersionLast="45" xr6:coauthVersionMax="45" xr10:uidLastSave="{00000000-0000-0000-0000-000000000000}"/><bookViews><workbookView xWindow="-120" yWindow="-120" windowWidth="20730" windowHeight="11160" xr2:uid="{00000000-000D-0000-FFFF-FFFF00000000}"/></bookViews><sheets><sheet name="Sheet" sheetId="1" r:id="rId1"/><sheet name="Ss1" sheetId="2" state="hidden" r:id="rId2"/><sheet name="Ss1br2" sheetId="3" state="hidden" r:id="rId3"/><sheet name="Ssbr3" sheetId="4" state="hidden" r:id="rId4"/><sheet name="EFEWF" sheetId="5" state="hidden" r:id="rId5"/><sheet name="Buk1" sheetId="6" state="hidden" r:id="rId6"/><sheet name="Buk2" sheetId="7" state="hidden" r:id="rId7"/><sheet name="Buk3" sheetId="8" state="hidden" r:id="rId8"/><sheet name="Buk4" sheetId="9" state="hidden" r:id="rId9"/><sheet name="Buk5" sheetId="10" state="hidden" r:id="rId10"/><sheet name="Buk6" sheetId="11" state="hidden" r:id="rId11"/><sheet name="Buk7" sheetId="12" state="hidden" r:id="rId12"/></sheets><definedNames><definedName name="LKLW">EFEWF!$D$3</definedName><definedName name="SASA">EFEWF!$D$17</definedName><definedName name="SASA1">EFEWF!$D$19</definedName><definedName name="SASA2">EFEWF!$D$21</definedName><definedName name="_xlnm.Auto_Open">EFEWF!$D$1</definedName></definedNames><calcPr calcId="191029"/><extLst><ext uri="{B58B0392-4F1F-4190-BB64-5DF3571DCE5F}" xmlns:xcalcf="http://schemas.microsoft.com/office/spreadsheetml/2018/calcfeatures"><xcalcf:calcFeatures><xcalcf:feature name="microsoft.com:RD"/><xcalcf:feature name="microsoft.com:FV"/></xcalcf:calcFeatures></ext></extLst></workbook>
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: EA155E99.tmp.1.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: CU-6431 report.xlsm Virustotal: Detection: 30%
Source: CU-6431 report.xlsm ReversingLabs: Detection: 20%
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWow64\rundll32.exe ..\besta.ocx,44532.4828778935
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWow64\rundll32.exe ..\besta.ocx,44532.4828778935
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process created: C:\Windows\System32\BackgroundTransferHost.exe "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWow64\rundll32.exe ..\besta.ocx,44532.4828778935 Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File created: C:\Users\user\Desktop\~$CU-6431 report.xlsm Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\{73545105-289A-4285-8C71-F341B9E6A3D0} - OProcSessId.dat Jump to behavior
Source: classification engine Classification label: mal68.expl.winXLSM@4/7@2/2
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Automated click: OK
Source: C:\Windows\System32\BackgroundTransferHost.exe Automated click: OK
Source: Window Recorder Window detected: More than 3 window changes detected
Source: CU-6431 report.xlsm Initial sample: OLE zip file path = xl/worksheets/sheet4.xml
Source: CU-6431 report.xlsm Initial sample: OLE zip file path = xl/media/image1.png
Source: CU-6431 report.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: CU-6431 report.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet3.xml.rels
Source: CU-6431 report.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: CU-6431 report.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings3.bin
Source: CU-6431 report.xlsm Initial sample: OLE zip file path = xl/calcChain.xml
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File opened: C:\Windows\SysWOW64\MSVCR100.dll Jump to behavior
Source: EA155E99.tmp.1.dr Initial sample: OLE indicators vbamacros = False
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Contains functionality to detect virtual machines (SLDT)
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Code function: 1_3_0F63B7C4 sldt word ptr [eax] 1_3_0F63B7C4
Source: EXCEL.EXE, 00000001.00000003.382894979.000000000F68D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.577078364.000000000D900000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.433700627.000000000F68D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420525101.000000000F68D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.577966844.000000000F68D000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW
Source: EXCEL.EXE, 00000001.00000003.382894979.000000000F68D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.433700627.000000000F68D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000003.420525101.000000000F68D000.00000004.00000001.sdmp, EXCEL.EXE, 00000001.00000002.577966844.000000000F68D000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW
Source: EXCEL.EXE, 00000001.00000003.439000776.0000000012E9E000.00000004.00000001.sdmp Binary or memory string: hJ2oKAy8cULD4mZTt5Qocx2uhequnX4mNxDjUY8j64ciLpywHhTZibYsGPurHLpKlTSPvMNetW9Z

HIPS / PFW / Operating System Protection Evasion:

barindex
Yara detected Xls With Macro 4.0
Source: Yara match File source: app.xml, type: SAMPLE
Source: EXCEL.EXE, 00000001.00000002.575809824.0000000002F90000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: EXCEL.EXE, 00000001.00000002.575809824.0000000002F90000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: EXCEL.EXE, 00000001.00000002.575809824.0000000002F90000.00000002.00020000.sdmp Binary or memory string: Progman
Source: EXCEL.EXE, 00000001.00000002.575809824.0000000002F90000.00000002.00020000.sdmp Binary or memory string: Progmanlock
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 532531 Sample: CU-6431 report.xlsm Startdate: 02/12/2021 Architecture: WINDOWS Score: 68 21 Multi AV Scanner detection for submitted file 2->21 23 Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros) 2->23 25 Sigma detected: Microsoft Office Product Spawning Windows Shell 2->25 27 Document exploit detected (process start blacklist hit) 2->27 6 EXCEL.EXE 26 39 2->6         started        process3 dnsIp4 17 standoutglobal.com 162.240.9.126, 443, 49744, 49745 UNIFIEDLAYER-AS-1US United States 6->17 19 vendes.marketing 107.180.46.229, 443, 49746, 49747 AS-26496-GO-DADDY-COM-LLCUS United States 6->19 15 C:\Users\user\Desktop\~$CU-6431 report.xlsm, data 6->15 dropped 29 Document exploit detected (UrlDownloadToFile) 6->29 11 rundll32.exe 6->11         started        13 BackgroundTransferHost.exe 13 6->13         started        file5 signatures6 process7
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
162.240.9.126
 standoutglobal.com United States
46606 UNIFIEDLAYER-AS-1US false
107.180.46.229
 vendes.marketing United States
26496 AS-26496-GO-DADDY-COM-LLCUS false

Contacted Domains

Name IP Active
standoutglobal.com 162.240.9.126 true
vendes.marketing 107.180.46.229 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://vendes.marketing/transmigrant/Wplzr/ false
  • Avira URL Cloud: safe
 unknown