Windows Analysis Report order 4544471372.xls

Overview

General Information

Sample Name: order 4544471372.xls
Analysis ID: 532575
MD5: 531039a455e1f0598cd201b785a1152a
SHA1: 4880df9e94090243029e54a34e941c70298401c7
SHA256: cf0d6ea61f8e56f80f24792e356adeab2f92b6db2f980a9e5932415484f5b732
Tags: Dridexxlsx
Infos:

Most interesting Screenshot:

Detection

Hidden Macro 4.0 Dridex Downloader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Yara detected Dridex Downloader
Multi AV Scanner detection for submitted file
Sigma detected: TA505 Dropper Load Pattern
Creates and opens a fake document (probably a fake document to hide exploiting)
Found Excel 4.0 Macro with suspicious formulas
Sigma detected: Suspicious MSHTA Process Patterns
Sigma detected: Microsoft Office Product Spawning Windows Shell
Document exploit detected (process start blacklist hit)
Creates processes via WMI
Found protected and hidden Excel 4.0 Macro sheet
Contains functionality to create processes via WMI
Found obfuscated Excel 4.0 Macro
Found a hidden Excel 4.0 Macro sheet
Potential document exploit detected (unknown TCP traffic)
Searches for the Microsoft Outlook file path
May sleep (evasive loops) to hinder dynamic analysis
Yara detected Xls With Macro 4.0
Detected TCP or UDP traffic on non-standard ports
Sigma detected: Suspicious WMI Execution
Contains functionality to detect virtual machines (SLDT)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Launches processes in debugging mode, may be used to hinder debugging
Potential document exploit detected (performs HTTP gets)
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers

Classification

AV Detection:

barindex
Multi AV Scanner detection for submitted file
Source: order 4544471372.xls ReversingLabs: Detection: 13%
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File opened: C:\Windows\SysWOW64\MSVCR100.dll Jump to behavior

Software Vulnerabilities:

barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process created: C:\Windows\SysWOW64\wbem\WMIC.exe
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.7:49816 -> 149.129.254.152:8080
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.7:49816 -> 149.129.254.152:8080

Networking:

barindex
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.7:49816 -> 149.129.254.152:8080
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 149.129.254.152 149.129.254.152
Source: unknown TCP traffic detected without corresponding DNS query: 149.129.254.152
Source: unknown TCP traffic detected without corresponding DNS query: 149.129.254.152
Source: unknown TCP traffic detected without corresponding DNS query: 149.129.254.152
Source: unknown TCP traffic detected without corresponding DNS query: 149.129.254.152
Source: mshta.exe, 0000001A.00000002.534688222.0000020F08921000.00000004.00000020.sdmp, mshta.exe, 0000001A.00000003.469184261.0000020F08921000.00000004.00000001.sdmp String found in binary or memory: http://149.129.254.1524
Source: mshta.exe, 0000001A.00000002.534688222.0000020F08921000.00000004.00000020.sdmp, mshta.exe, 0000001A.00000003.469184261.0000020F08921000.00000004.00000001.sdmp String found in binary or memory: http://149.129.254.152:8
Source: mshta.exe, 0000001A.00000003.469090020.0000020F08971000.00000004.00000001.sdmp String found in binary or memory: http://149.129.254.152:8080/
Source: mshta.exe, 0000001A.00000003.469151527.0000020F088F8000.00000004.00000001.sdmp String found in binary or memory: http://149.129.254.152:8080/6llr
Source: mshta.exe, 0000001A.00000003.469151527.0000020F088F8000.00000004.00000001.sdmp String found in binary or memory: http://149.129.254.152:8080/6tf
Source: mshta.exe, 0000001A.00000003.469151527.0000020F088F8000.00000004.00000001.sdmp String found in binary or memory: http://149.129.254.152:8080/6tfc
Source: mshta.exe, 0000001A.00000003.469151527.0000020F088F8000.00000004.00000001.sdmp String found in binary or memory: http://149.129.254.152:8080/6tfcnfuSVZF2
Source: mshta.exe, 0000001A.00000003.469151527.0000020F088F8000.00000004.00000001.sdmp String found in binary or memory: http://149.129.254.152:8080/6tfcnfucknugget4gp
Source: mshta.exe, 0000001A.00000003.469151527.0000020F088F8000.00000004.00000001.sdmp, mshta.exe, 0000001A.00000002.534554271.0000020F088F8000.00000004.00000020.sdmp String found in binary or memory: http://149.129.254.152:8080/6tfcnfucknugget4gpen
Source: mshta.exe, 0000001A.00000003.469104734.0000020F088BC000.00000004.00000001.sdmp String found in binary or memory: http://149.129.254.152:8080/6tfcnfucknugget4gpenis3da
Source: mshta.exe, 0000001A.00000003.469104734.0000020F088BC000.00000004.00000001.sdmp, mshta.exe, 0000001A.00000002.534411624.0000020F088B5000.00000004.00000020.sdmp String found in binary or memory: http://149.129.254.152:8080/6tfcnfucknugget4gpenis3dad
Source: mshta.exe, 0000001A.00000003.469104734.0000020F088BC000.00000004.00000001.sdmp, mshta.exe, 0000001A.00000002.534411624.0000020F088B5000.00000004.00000020.sdmp String found in binary or memory: http://149.129.254.152:8080/6tfcnfucknugget4gpenis3dadV
Source: mshta.exe, 0000001A.00000003.469104734.0000020F088BC000.00000004.00000001.sdmp, mshta.exe, 0000001A.00000002.534411624.0000020F088B5000.00000004.00000020.sdmp String found in binary or memory: http://149.129.254.152:8080/6tfcnfucknugget4gpenis3dade5H
Source: mshta.exe, 0000001A.00000003.469104734.0000020F088BC000.00000004.00000001.sdmp, mshta.exe, 0000001A.00000002.534411624.0000020F088B5000.00000004.00000020.sdmp String found in binary or memory: http://149.129.254.152:8080/6tfcnfucknugget4gpenis3dade5z6c
Source: mshta.exe, 0000001A.00000003.469104734.0000020F088BC000.00000004.00000001.sdmp, mshta.exe, 0000001A.00000003.469184261.0000020F08921000.00000004.00000001.sdmp, mshta.exe, 0000001A.00000002.534411624.0000020F088B5000.00000004.00000020.sdmp String found in binary or memory: http://149.129.254.152:8080/6tfcnfucknugget4gpenis3dade5z6cpc
Source: mshta.exe, 0000001A.00000003.469056454.000002170B64B000.00000004.00000001.sdmp, mshta.exe, 0000001A.00000002.538705158.000002170B64E000.00000004.00000001.sdmp String found in binary or memory: http://149.129.254.152:8080/6tfcnfucknugget4gpenis3dade5z6cpc3
Source: mshta.exe, 0000001A.00000003.469104734.0000020F088BC000.00000004.00000001.sdmp String found in binary or memory: http://149.129.254.152:8080/6tfcnfucknugget4gpenis3dade5z6cpcY
Source: mshta.exe, 0000001A.00000003.469104734.0000020F088BC000.00000004.00000001.sdmp, mshta.exe, 0000001A.00000002.534411624.0000020F088B5000.00000004.00000020.sdmp String found in binary or memory: http://149.129.254.152:8080/6tfcnfucknugget4gpenis3dade5z6cpcZ
Source: mshta.exe, 0000001A.00000002.534688222.0000020F08921000.00000004.00000020.sdmp, mshta.exe, 0000001A.00000003.469184261.0000020F08921000.00000004.00000001.sdmp String found in binary or memory: http://149.129.254.152:8080d-
Source: mshta.exe, 0000001A.00000002.534688222.0000020F08921000.00000004.00000020.sdmp, mshta.exe, 0000001A.00000003.469184261.0000020F08921000.00000004.00000001.sdmp String found in binary or memory: http://149.129.254.ingsb6
Source: EXCEL.EXE, 00000000.00000002.543373563.0000000012E6D000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: EXCEL.EXE, 00000000.00000003.459410247.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350232384.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397001902.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263009518.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460721096.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383781939.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263429090.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544023705.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.463256033.00000000131E6000.00000004.00000001.sdmp String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glidesb
Source: EXCEL.EXE, 00000000.00000002.541727751.000000000F500000.00000004.00000001.sdmp String found in binary or memory: http://purl.oclc.org/ooxml/drawingml/diagram
Source: EXCEL.EXE, 00000000.00000002.539687730.000000000D80C000.00000004.00000001.sdmp String found in binary or memory: http://purl.oclc.org/ooxml/drawingml/table
Source: EXCEL.EXE, 00000000.00000003.396495769.0000000015C73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.399131900.0000000015C42000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396289594.0000000015D2D000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396429856.0000000015C42000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396246170.0000000015CE5000.00000004.00000001.sdmp String found in binary or memory: http://schemas.open
Source: EXCEL.EXE, 00000000.00000003.399131900.0000000015C42000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396429856.0000000015C42000.00000004.00000001.sdmp String found in binary or memory: http://schemas.openformatrg/package/2006/content-t
Source: EXCEL.EXE, 00000000.00000003.396495769.0000000015C73000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396289594.0000000015D2D000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396246170.0000000015CE5000.00000004.00000001.sdmp String found in binary or memory: http://schemas.openformatrg/package/2006/r
Source: EXCEL.EXE, 00000000.00000003.463050039.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396929162.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544045161.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263447705.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350253673.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460111881.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459950914.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383864499.000000001321C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261336835.000000001321E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383803999.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp String found in binary or memory: https://addinsinstallation.store.office.com/app/downloadAppInfoQuery15https://api.addins.omex.office
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalledMBI_SSL_SHORT
Source: EXCEL.EXE, 00000000.00000002.543668539.0000000013090000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350357731.0000000013090000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383432005.0000000013090000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459478979.0000000013090000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397090354.0000000013090000.00000004.00000001.sdmp String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalledq
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticatedBearer
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp String found in binary or memory: https://addinslicensing.store.office.com/commerce/queryDeepLinkingServicehttps://api.addins.store.of
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query6H
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.260270306.0000000012FD9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/removeBearer
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/removeH
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/queryBearer
Source: EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460764651.0000000013209000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: EXCEL.EXE, 00000000.00000003.463050039.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396929162.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544045161.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263447705.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350253673.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460111881.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459950914.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383864499.000000001321C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261336835.000000001321E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383803999.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp String found in binary or memory: https://analysis.windows.net/powerbi/apiB
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://analysis.windows.net/powerbi/apiN
Source: EXCEL.EXE, 00000000.00000003.459410247.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350232384.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397001902.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263009518.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460721096.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383781939.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263429090.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544023705.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.463256033.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechBearer
Source: EXCEL.EXE, 00000000.00000003.463050039.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396929162.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544045161.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263447705.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350253673.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460111881.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459950914.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383864499.000000001321C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261336835.000000001321E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383803999.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://api.aadrm.com
Source: EXCEL.EXE, 00000000.00000003.463050039.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396929162.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544045161.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263447705.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350253673.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460111881.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459950914.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383864499.000000001321C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261336835.000000001321E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383803999.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://api.aadrm.com/
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://api.addins.omex.office.net/appinfo/query3e
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://api.addins.omex.office.net/appstate/queryFgp
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://api.addins.store.office.com/app/query
Source: EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp String found in binary or memory: https://api.addins.store.office.com/app/queryAppStateQuery15https://api.addins.omex.office.net/appst
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://api.addins.store.office.com/app/queryl
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://api.cortana.ai
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://api.cortana.aiBearer
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://api.cortana.aihttps://login.windows.net/common/oauth2/authorize
Source: D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://api.diagnostics.office.com
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://api.diagnostics.office.com#v
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://api.diagnostics.office.comBearer
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://api.diagnostics.office.comhttps://login.windows.net/common/oauth2/authorize
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://api.diagnosticssdf.office.com
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://api.diagnosticssdf.office.comMix
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://api.microsoftstream.com/api/
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://api.microsoftstream.com/api/StreamVideoBasehttps://web.microsoftstream.com/video/PPTQuickSta
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp String found in binary or memory: https://api.microsoftstream.com/api/nt
Source: D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://api.office.net
Source: EXCEL.EXE, 00000000.00000003.463050039.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396929162.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544045161.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263447705.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350253673.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460111881.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459950914.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383864499.000000001321C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261336835.000000001321E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383803999.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp String found in binary or memory: https://api.office.net$
Source: EXCEL.EXE, 00000000.00000003.463050039.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396929162.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544045161.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263447705.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350253673.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460111881.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459950914.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383864499.000000001321C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261336835.000000001321E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383803999.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp String found in binary or memory: https://api.office.net?
Source: EXCEL.EXE, 00000000.00000003.463050039.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396929162.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544045161.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263447705.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350253673.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460111881.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459950914.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383864499.000000001321C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261336835.000000001321E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383803999.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp String found in binary or memory: https://api.office.netH
Source: EXCEL.EXE, 00000000.00000003.463050039.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396929162.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544045161.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263447705.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350253673.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460111881.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459950914.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383864499.000000001321C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261336835.000000001321E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383803999.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp String found in binary or memory: https://api.office.netU
Source: EXCEL.EXE, 00000000.00000003.463050039.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396929162.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544045161.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263447705.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350253673.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460111881.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459950914.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383864499.000000001321C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261336835.000000001321E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383803999.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp String found in binary or memory: https://api.office.netf
Source: EXCEL.EXE, 00000000.00000003.463050039.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396929162.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544045161.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263447705.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350253673.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460111881.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459950914.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383864499.000000001321C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261336835.000000001321E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383803999.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp String found in binary or memory: https://api.office.neto
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://api.onedrive.com
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://api.onedrive.comMBI
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp String found in binary or memory: https://api.onedrive.comce
Source: EXCEL.EXE, 00000000.00000003.463050039.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396929162.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544045161.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263447705.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350253673.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460111881.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459950914.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383864499.000000001321C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261336835.000000001321E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383803999.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets)
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: EXCEL.EXE, 00000000.00000003.463050039.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396929162.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544045161.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263447705.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350253673.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460111881.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459950914.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383864499.000000001321C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261336835.000000001321E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383803999.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups-
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groupsBearer
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://apis.live.net/v5.0/
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp String found in binary or memory: https://apis.live.net/v5.0/rl
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/Gzu
Source: EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/OneNoteBulletinshttps://
Source: EXCEL.EXE, 00000000.00000003.260270306.0000000012FD9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://augloop.office.com
Source: D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://augloop.office.com/v2
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://augloop.office.com/v2Bearer
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://augloop.office.com/v2https://login.windows.net/common/oauth2/authorize
Source: EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://augloop.office.comLinkRequestApiPageTitleRetrievalhttps://uci.
Source: EXCEL.EXE, 00000000.00000003.414564418.000000000F58E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.541998187.000000000F58E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.349622287.000000000F58E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://autodiscover-s.outlook.com/
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://cdn.entity.
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: EXCEL.EXE, 00000000.00000003.349574960.000000000F536000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.411656756.000000000F537000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.414512357.000000000F537000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.541923673.000000000F537000.00000004.00000001.sdmp String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.pngW
Source: EXCEL.EXE, 00000000.00000003.459410247.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350232384.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397001902.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263009518.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460721096.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383781939.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263429090.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544023705.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.463256033.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsellSkyDriveSignUpUpsellImageht
Source: EXCEL.EXE, 00000000.00000003.459410247.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350232384.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397001902.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263009518.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460721096.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383781939.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263429090.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544023705.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.463256033.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsellLiveProfileServicehttps
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://clients.config.office.net/
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://clients.config.office.net/Bearer
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://clients.config.office.net/https://login.windows.net/common/oauth2/authorize
Source: D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: EXCEL.EXE, 00000000.00000003.463050039.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396929162.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544045161.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263447705.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350253673.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460111881.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459950914.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383864499.000000001321C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261336835.000000001321E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383803999.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policiesE
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policieshttps://login.windows.net/common/oauth2/
Source: D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://clients.config.office.net/user/v1.0/iosBearer
Source: EXCEL.EXE, 00000000.00000003.463050039.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396929162.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544045161.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263447705.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350253673.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460111881.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459950914.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383864499.000000001321C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261336835.000000001321E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383803999.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp String found in binary or memory: https://clients.config.office.net/user/v1.0/iosU
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://clients.config.office.net/user/v1.0/ioshttps://login.windows.net/common/oauth2/authorize
Source: D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://clients.config.office.net/user/v1.0/macBearer
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://clients.config.office.net/user/v1.0/machttps://login.windows.net/common/oauth2/authorize
Source: D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkeyBearer
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkeyhttps://login.windows.net/common/oau
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp String found in binary or memory: https://cloudfiles.onenote.com/upload.aspxOneNoteCloudFilesConsumerEmbedhttps://onedrive.live.com/em
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://config.edge.skype.com
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://cortana.ai
Source: D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://cortana.ai/api
Source: EXCEL.EXE, 00000000.00000003.463050039.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396929162.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544045161.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263447705.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350253673.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460111881.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459950914.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383864499.000000001321C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261336835.000000001321E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383803999.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp String found in binary or memory: https://cortana.ai/api5
Source: EXCEL.EXE, 00000000.00000003.463050039.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396929162.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544045161.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263447705.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350253673.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460111881.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459950914.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383864499.000000001321C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261336835.000000001321E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383803999.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp String found in binary or memory: https://cortana.ai/apiA
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://cortana.ai/apiBearer
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://cortana.ai/apihttps://login.windows.net/common/oauth2/authorize
Source: EXCEL.EXE, 00000000.00000003.463050039.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396929162.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544045161.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263447705.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350253673.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460111881.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459950914.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383864499.000000001321C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261336835.000000001321E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383803999.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp String found in binary or memory: https://cortana.aietl
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://cr.office.com
Source: EXCEL.EXE, 00000000.00000003.463050039.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396929162.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544045161.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263447705.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350253673.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460111881.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459950914.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383864499.000000001321C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261336835.000000001321E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383803999.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp String found in binary or memory: https://cr.office.com~
Source: D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://dataservice.o365filtering.com
Source: D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://dataservice.o365filtering.com/
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFileBearer
Source: EXCEL.EXE, 00000000.00000003.459410247.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350232384.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397001902.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263009518.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460721096.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383781939.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263429090.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544023705.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.463256033.00000000131E6000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFilefully
Source: EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.com/https://login.windows.net/common/oauth2/authorize
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.comZvk
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.comxiu
Source: EXCEL.EXE, 00000000.00000003.459410247.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350232384.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397001902.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263009518.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460721096.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383781939.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263429090.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544023705.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.463256033.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFileBearer
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPoliciesBearer
Source: D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://dev.cortana.ai
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://dev.cortana.aiBearer
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://dev.cortana.aihttps://login.windows.net/common/oauth2/authorize
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://devnull.onenote.com
Source: EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp String found in binary or memory: https://devnull.onenote.comBearer
Source: EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp String found in binary or memory: https://devnull.onenote.comMBI_SSL_SHORT
Source: mshta.exe, 0000001A.00000003.469104734.0000020F088BC000.00000004.00000001.sdmp, mshta.exe, 0000001A.00000002.534411624.0000020F088B5000.00000004.00000020.sdmp String found in binary or memory: https://di.129.254.152:8080/
Source: EXCEL.EXE, 00000000.00000003.463050039.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396929162.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544045161.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263447705.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350253673.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460111881.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459950914.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383864499.000000001321C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261336835.000000001321E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383803999.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://directory.services.
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://enrichment.osi.office.net/
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/D_
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1AuthorizationBearer
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1$
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1C
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1EnrichmentWACUrlhttps://enrichment.osi.
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/EnrichmentMetadataUrlhttps://enrichm
Source: EXCEL.EXE, 00000000.00000003.459410247.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350232384.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397001902.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263009518.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460721096.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383781939.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263429090.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544023705.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.463256033.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: EXCEL.EXE, 00000000.00000003.459410247.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350232384.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397001902.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263009518.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460721096.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383781939.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263429090.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544023705.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.463256033.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtmlEnrichmentDisambiguat
Source: EXCEL.EXE, 00000000.00000003.459410247.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350232384.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397001902.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263009518.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460721096.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383781939.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263429090.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544023705.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.463256033.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/https://login.windows.net/common/oauth2/authorizeMBI_SSLhttps://os
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/j_=
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://entitlement.diagnostics.office.com
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp String found in binary or memory: https://entity.osi.office.net/t
Source: EXCEL.EXE, 00000000.00000003.459410247.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350232384.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397001902.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263009518.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460721096.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383781939.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263429090.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544023705.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.463256033.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechBearer
Source: EXCEL.EXE, 00000000.00000003.459410247.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350232384.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397001902.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263009518.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460721096.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383781939.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263429090.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544023705.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.463256033.00000000131E6000.00000004.00000001.sdmp String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechi
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: EXCEL.EXE, 00000000.00000002.543306954.0000000012E40000.00000004.00000001.sdmp String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android(E
Source: EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-androidUserVoiceOf
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://graph.ppe.windows.net
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://graph.ppe.windows.net/
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://graph.ppe.windows.net/https://graph.ppe.windows.net
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://graph.windows.net
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://graph.windows.net/
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://graph.windows.net/https://graph.windows.net
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp String found in binary or memory: https://graph.windows.netse
Source: EXCEL.EXE, 00000000.00000003.463050039.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396929162.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544045161.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263447705.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350253673.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460111881.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459950914.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383864499.000000001321C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261336835.000000001321E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383803999.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp String found in binary or memory: https://hubble.officeapps.live.com
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: EXCEL.EXE, 00000000.00000003.383523554.00000000130D0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459554867.00000000130D0000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetryOfficeOnlineContenthttps://insertmedia.
Source: EXCEL.EXE, 00000000.00000003.463050039.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396929162.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544045161.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263447705.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350253673.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460111881.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459950914.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383864499.000000001321C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261336835.000000001321E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383803999.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetryi
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: EXCEL.EXE, 00000000.00000002.543668539.0000000013090000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350357731.0000000013090000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383432005.0000000013090000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459478979.0000000013090000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397090354.0000000013090000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3dips
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: EXCEL.EXE, 00000000.00000002.543306954.0000000012E40000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: EXCEL.EXE, 00000000.00000003.263363412.0000000013175000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350133174.0000000013175000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397386669.0000000013175000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383712060.0000000013175000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459326223.0000000013175000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.463180999.0000000013175000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460536369.0000000013175000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262945436.0000000013175000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396836402.0000000013175000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543940616.0000000013175000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1BD
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: EXCEL.EXE, 00000000.00000003.263363412.0000000013175000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350133174.0000000013175000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397386669.0000000013175000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383712060.0000000013175000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459326223.0000000013175000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.463180999.0000000013175000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460536369.0000000013175000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262945436.0000000013175000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396836402.0000000013175000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543940616.0000000013175000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: EXCEL.EXE, 00000000.00000003.463050039.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396929162.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544045161.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263447705.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350253673.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460111881.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459950914.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383864499.000000001321C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261336835.000000001321E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383803999.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: EXCEL.EXE, 00000000.00000003.383523554.00000000130D0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459554867.00000000130D0000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?OfficeOnlineContentM365Iconshttps://hu
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://incidents.diagnostics.office.com
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://inclient.store.office.com/gyro/clientl
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://inclient.store.office.com/gyro/clientstoreGdw
Source: EXCEL.EXE, 00000000.00000002.543306954.0000000012E40000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=ImmersiveAppqq
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: EXCEL.EXE, 00000000.00000003.459410247.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350232384.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397001902.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263009518.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460721096.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383781939.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263429090.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544023705.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.463256033.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: EXCEL.EXE, 00000000.00000003.383523554.00000000130D0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459554867.00000000130D0000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArtOfficeOnlineContentF
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: EXCEL.EXE, 00000000.00000003.459410247.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350232384.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397001902.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263009518.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460721096.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383781939.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263429090.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544023705.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.463256033.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: EXCEL.EXE, 00000000.00000003.383523554.00000000130D0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459554867.00000000130D0000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=FlickrMBI_SSL_SHORTssl.
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: EXCEL.EXE, 00000000.00000003.383523554.00000000130D0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459554867.00000000130D0000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDriveMBI_SSL_SHORTssl.
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: EXCEL.EXE, 00000000.00000003.383523554.00000000130D0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459554867.00000000130D0000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmediaMBI_SSL_SHORTofficeapps.
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia_I
Source: EXCEL.EXE, 00000000.00000003.459410247.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350232384.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397001902.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263009518.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460721096.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383781939.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263429090.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544023705.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.463256033.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: EXCEL.EXE, 00000000.00000003.459410247.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350232384.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397001902.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263009518.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460721096.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383781939.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263429090.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544023705.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.463256033.00000000131E6000.00000004.00000001.sdmp String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech(
Source: EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeechBearer
Source: D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://lifecycle.office.com
Source: EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp String found in binary or memory: https://lifecycle.office.comMBI_SSL_SHORThttps://lifecycle.office.com
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp String found in binary or memory: https://lifecycle.office.comP
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://login.microsoftonline.com/
Source: D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://login.windows.local
Source: EXCEL.EXE, 00000000.00000003.459410247.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350232384.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397001902.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263009518.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460721096.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383781939.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263429090.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544023705.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.463256033.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261257878.0000000015A65000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize$2
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize$c
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261257878.0000000015A65000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize%3
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize-
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize-R
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize.
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize/f
Source: EXCEL.EXE, 00000000.00000002.543373563.0000000012E6D000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize018
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize1g
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261257878.0000000015A65000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize52
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261257878.0000000015A65000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize63
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261257878.0000000015A65000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize80=
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize;Wm
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize=Uo
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize?
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeAT#
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeCR%
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeD
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeEfq
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeIee
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeJbd
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261257878.0000000015A65000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeK2b
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261257878.0000000015A65000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeM0
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeMBI_SSL_SHORT
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeOV
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizePV
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeRT
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeT
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeTR
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeVf
Source: EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeWgg
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeZe
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizea
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeaRC
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizecom
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizedgR
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeedQ
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizefic
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizehbF
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261257878.0000000015A65000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizei2L
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeicE
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261257878.0000000015A65000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeize
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeizeSU
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261257878.0000000015A65000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizej3C
Source: EXCEL.EXE, 00000000.00000002.541727751.000000000F500000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizel
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizemV?
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeoTA
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizepT0
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeqU3
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizer
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizerR2
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizete
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeugA
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeybu
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261257878.0000000015A65000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizez2s
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize~V.
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261257878.0000000015A65000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1MBI_SSL_SHORT
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://management.azure.com
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://management.azure.com/
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://management.azure.com/BingGeospatialEndpointServiceUrlhttps://dev.virtualearth.net/REST/V1/Ge
Source: EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://messaging.office.com/
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://metadata.templates.cdn.office.net/client/logU
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy(
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicyBearer
Source: EXCEL.EXE, 00000000.00000003.459410247.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350232384.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397001902.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263009518.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460721096.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383781939.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263429090.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544023705.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.463256033.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechBearer
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://ncus.contentsync.
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261257878.0000000015A65000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://ncus.pagecontentsync.
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com
Source: EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/
Source: EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/=
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/nexus/rules
Source: EXCEL.EXE, 00000000.00000002.541923673.000000000F537000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/nexus/rules?Application=excel.exe&Version=16.0.4954.1000&ClientId=
Source: EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/rsion=16.0.4954.1000&ClientId=%7bF8E64007-356C-4DA5-86A8-66FF7C280
Source: EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/uZY
Source: EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.comKtz
Source: EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.comPtm
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: EXCEL.EXE, 00000000.00000003.459410247.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350232384.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397001902.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263009518.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460721096.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383781939.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263429090.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544023705.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.463256033.00000000131E6000.00000004.00000001.sdmp String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecordD
Source: EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecordhttps://login.windows.net/co
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com0f
Source: EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp String found in binary or memory: https://o365auditrealtimeingestion.manage.office.comBearer
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.neth
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://ocos-office365-s2s.msedge.net/abQ
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: EXCEL.EXE, 00000000.00000003.383321801.000000000F6A0000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://officeapps.live.com
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com%Z
Source: EXCEL.EXE, 00000000.00000003.460004006.000000000F6A0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261290511.000000000F6A0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.349904456.000000000F6A0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.462771787.000000000F6A0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397630783.000000000F6A0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.411581844.000000000F6A0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.542480026.000000000F6A0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383321801.000000000F6A0000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com.csv)
Source: EXCEL.EXE, 00000000.00000003.349574960.000000000F536000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.411656756.000000000F537000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.414512357.000000000F537000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.541923673.000000000F537000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com.dllt
Source: EXCEL.EXE, 00000000.00000003.460004006.000000000F6A0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261290511.000000000F6A0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.349904456.000000000F6A0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.462771787.000000000F6A0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397630783.000000000F6A0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.411581844.000000000F6A0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.542480026.000000000F6A0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383321801.000000000F6A0000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com.ods)
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com/
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com5
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com;
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comAZu
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comE
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comK
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comQ
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comc
Source: EXCEL.EXE, 00000000.00000003.349574960.000000000F536000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.411656756.000000000F537000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.414512357.000000000F537000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.541923673.000000000F537000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comdlll
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.come
Source: EXCEL.EXE, 00000000.00000002.543373563.0000000012E6D000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comh
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comi
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comk
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://officeci.azurewebsites.net/api/=v
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: EXCEL.EXE, 00000000.00000003.459410247.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350232384.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397001902.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263009518.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460721096.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383781939.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263429090.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544023705.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.463256033.00000000131E6000.00000004.00000001.sdmp String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks_
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: EXCEL.EXE, 00000000.00000003.463050039.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396929162.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544045161.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263447705.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350253673.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460111881.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459950914.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383864499.000000001321C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261336835.000000001321E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383803999.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: EXCEL.EXE, 00000000.00000002.543668539.0000000013090000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350357731.0000000013090000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383432005.0000000013090000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459478979.0000000013090000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397090354.0000000013090000.00000004.00000001.sdmp String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdatedT
Source: EXCEL.EXE, 00000000.00000002.543668539.0000000013090000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350357731.0000000013090000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383432005.0000000013090000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459478979.0000000013090000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397090354.0000000013090000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: EXCEL.EXE, 00000000.00000002.543668539.0000000013090000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350357731.0000000013090000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383432005.0000000013090000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459478979.0000000013090000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397090354.0000000013090000.00000004.00000001.sdmp String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdatedj
Source: D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://onedrive.live.com
Source: EXCEL.EXE, 00000000.00000003.459410247.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350232384.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397001902.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263009518.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460721096.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383781939.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263429090.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544023705.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.463256033.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://onedrive.live.com/embed?
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://onedrive.live.com/embed?iointiwD
Source: EXCEL.EXE, 00000000.00000003.383523554.00000000130D0000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459554867.00000000130D0000.00000004.00000001.sdmp String found in binary or memory: https://onedrive.live.comOneDriveLogUploadServicehttps://storage.live.com/clientlogs/uploadlocationM
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp String found in binary or memory: https://onedrive.live.comed
Source: EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://osi.office.net
Source: EXCEL.EXE, 00000000.00000003.463050039.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396929162.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544045161.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263447705.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350253673.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460111881.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459950914.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383864499.000000001321C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261336835.000000001321E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383803999.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp String found in binary or memory: https://osi.office.netj
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp String found in binary or memory: https://osi.office.netst
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://otelrules.azureedge.net
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp String found in binary or memory: https://otelrules.azureedge.netG
Source: EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://outlook.office.com
Source: EXCEL.EXE, 00000000.00000003.414564418.000000000F58E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.541998187.000000000F58E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.349622287.000000000F58E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://outlook.office.com/
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office.comh
Source: EXCEL.EXE, 00000000.00000002.543359602.0000000012E61000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://outlook.office365.com
Source: EXCEL.EXE, 00000000.00000003.414564418.000000000F58E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.541998187.000000000F58E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.349622287.000000000F58E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543373563.0000000012E6D000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://outlook.office365.com/
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office365.com/api/v1.0/me/ActivitiesMBI_SSL
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activitiess
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.jsonHNz
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.jsonSubstrateOfficeIntelligenceServicehttps:
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.jsonY
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=OutlookJ
Source: EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=OutlookMBI_SSL_SHORT
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://pages.store.office.com/review/query
Source: EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp String found in binary or memory: https://pages.store.office.com/review/queryTemplateStarthttps://
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspxAwsCgQueryhttps://
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: EXCEL.EXE, 00000000.00000003.459410247.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350232384.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397001902.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263009518.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460721096.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383781939.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263429090.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544023705.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.463256033.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.jsonMBI_SSLpeople.directory.
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: EXCEL.EXE, 00000000.00000003.463050039.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396929162.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544045161.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263447705.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350253673.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460111881.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459950914.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383864499.000000001321C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261336835.000000001321E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383803999.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.jsonD
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.jsonMBI_SSL_SHORTssl.
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13IdentityServicehttps://identity.
Source: EXCEL.EXE, 00000000.00000002.543373563.0000000012E6D000.00000004.00000001.sdmp String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13db8
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://powerlift-user.acompli.net
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://powerlift.acompli.net
Source: EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp String found in binary or memory: https://powerlift.acompli.netSubstrateOfficeIntelligenceInsightsServicehttps://
Source: EXCEL.EXE, 00000000.00000003.459410247.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350232384.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397001902.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263009518.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460721096.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383781939.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263429090.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544023705.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.463256033.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.jsonP
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptioneventsMBI_SSLhttps://rpsticket.partnerservices.getmicr
Source: EXCEL.EXE, 00000000.00000003.263403796.00000000131C8000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://roaming.edog.
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.comBU
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://settings.outlook.com
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp String found in binary or memory: https://settings.outlook.comS
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://shell.suite.office.com:1443
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://skyapi.live.net/Activity/
Source: D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/workPowerBIGetDatasetsApihttps://api.pow
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/workhttps://login.windows.net/common/oau
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/worko
Source: D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://staging.cortana.ai
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://staging.cortana.aiBearer
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://staging.cortana.aihttps://login.windows.net/common/oauth2/authorize
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp String found in binary or memory: https://staging.cortana.airla
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://store.office.cn/addinstemplate
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://store.office.de/addinstemplate
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com#D8
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com/Todo-Internal.ReadWrite
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistoryMBI_SSL
Source: EXCEL.EXE, 00000000.00000003.463050039.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396929162.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544045161.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263447705.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350253673.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460111881.0000000013215000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459950914.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383864499.000000001321C000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261336835.000000001321E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383803999.0000000013209000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263029066.0000000013209000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com/search/api/v2/initMBI_SSL
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com1
Source: EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.comP
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.comS
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.comW
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.coma
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.comc-
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.comg
Source: EXCEL.EXE, 00000000.00000003.260270306.0000000012FD9000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459410247.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350232384.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397001902.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263009518.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460721096.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383781939.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263429090.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544023705.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.463256033.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFileBearer
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://tasks.office.com
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp String found in binary or memory: https://tasks.office.comst
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp String found in binary or memory: https://tellmeservice.osi.office.netst
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: EXCEL.EXE, 00000000.00000003.459410247.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350232384.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397001902.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263009518.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460721096.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383781939.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263429090.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544023705.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.463256033.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.htmlInsightsImmersivehttps
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://web.microsoftstream.com/video/
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp String found in binary or memory: https://web.microsoftstream.com/video/$
Source: EXCEL.EXE, 00000000.00000003.459410247.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350232384.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397001902.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263009518.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460721096.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383781939.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263429090.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544023705.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.463256033.00000000131E6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/ExchangeAutoDiscoverhttps:/
Source: EXCEL.EXE, 00000000.00000002.543479968.0000000012F44000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://webshell.suite.office.com
Source: EXCEL.EXE, 00000000.00000003.261353142.00000000131FF000.00000004.00000001.sdmp String found in binary or memory: https://webshell.suite.office.comOCSettingsCloudPolicyServiceAndroidUrlhttps://clients.config.office
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261230471.0000000015A31000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://wus2.contentsync.
Source: EXCEL.EXE, 00000000.00000003.462955973.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262867755.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.263246828.0000000015A31000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.544699284.0000000015A17000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261257878.0000000015A65000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350831613.0000000015A18000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://wus2.pagecontentsync.
Source: EXCEL.EXE, 00000000.00000003.263363412.0000000013175000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.350133174.0000000013175000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.397386669.0000000013175000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.383712060.0000000013175000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.459326223.0000000013175000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.463180999.0000000013175000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.460536369.0000000013175000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.262945436.0000000013175000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.396836402.0000000013175000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543940616.0000000013175000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: EXCEL.EXE, 00000000.00000003.261328451.000000001320F000.00000004.00000001.sdmp String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2Azur
Source: EXCEL.EXE, 00000000.00000003.261269362.000000000F66F000.00000004.00000001.sdmp, D2E8A974-A9E1-4AA2-B9A4-381BFC494102.0.dr String found in binary or memory: https://www.odwebp.svc.ms
Source: EXCEL.EXE, 00000000.00000003.396504480.0000000012FCB000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.543540101.0000000012F99000.00000004.00000001.sdmp String found in binary or memory: https://www.odwebp.svc.msm
Source: global traffic HTTP traffic detected: GET /6tfcnfucknugget4gpenis3dade5z6cpc HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Language: en-USUser-Agent: rapeHost: 149.129.254.152:8080

E-Banking Fraud:

barindex
Yara detected Dridex Downloader
Source: Yara match File source: C:\ProgramData\tCeltZ.rtf, type: DROPPED

System Summary:

barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: Enable Editing" and "Enable Content" to display. 0 3 Data peraeaeoeeaoei: paIUO uaiee aanoaiue o
Source: Screenshot number: 4 Screenshot OCR: Enable Content" to display. 0 3 Data peraeaeoeeaoei: paIUO uaiee aanoaiue oIue'luujiod notr Serv
Source: Screenshot number: 8 Screenshot OCR: Enable Editing" and "Enable Content" to display. 3 Data paIUO uaiee aanoaiue oIue'luujiod notr S
Source: Screenshot number: 8 Screenshot OCR: Enable Content" to display. 3 Data paIUO uaiee aanoaiue oIue'luujiod notr Service issue 4 zIe 1
Found Excel 4.0 Macro with suspicious formulas
Source: order 4544471372.xls Initial sample: EXEC
Found protected and hidden Excel 4.0 Macro sheet
Source: order 4544471372.xls Initial sample: Sheet name: Macro1
Contains functionality to create processes via WMI
Source: EXCEL.EXE, 00000000.00000002.542772455.00000000117E0000.00000004.00000001.sdmp Binary or memory string: C:\Users\user\Documents\C:\Windows\SysWOW64\Wbem\wmic.exewmic process call create "mshta C:\ProgramData\tCeltZ.rtf"C:\Windows\System32\Wbem\wmic.exeWinSta0\Default=::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=computerComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\computerNUMBER_OF_PROCESSORS=4OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 85 Stepping 7, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=5507ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user~1\AppData\Local\TempTMP=C:\Users\user~1\AppData\Local\TempUSERDOMAIN=RAYHIWGUSERDOMAIN_ROAMINGPROFILE=computerUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windowsx
Found obfuscated Excel 4.0 Macro
Source: order 4544471372.xls Macro extractor: Sheet: Macro1 high usage of CHAR() function: 26
Found a hidden Excel 4.0 Macro sheet
Source: order 4544471372.xls Macro extractor: Sheet name: Macro1
Searches for the Microsoft Outlook file path
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE Jump to behavior
Detected potential crypto function
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Code function: 0_3_130234FB 0_3_130234FB
Source: order 4544471372.xls ReversingLabs: Detection: 13%
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic process call create "mshta C:\ProgramData\tCeltZ.rtf"
Source: C:\Windows\SysWOW64\wbem\WMIC.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Process created: C:\Windows\System32\mshta.exe mshta C:\ProgramData\tCeltZ.rtf
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic process call create "mshta C:\ProgramData\tCeltZ.rtf" Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Process created: C:\Windows\System32\mshta.exe mshta C:\ProgramData\tCeltZ.rtf Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32 Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5324:120:WilError_01
Source: C:\Windows\SysWOW64\wbem\WMIC.exe WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File created: C:\Users\user~1\AppData\Local\Temp\{BFEB2554-F1FC-4B55-8EC7-29D40F128D11} - OProcSessId.dat Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winXLS@7/8@0/1
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: order 4544471372.xls Initial sample: OLE zip file path = xl/media/image1.png
Source: order 4544471372.xls Initial sample: OLE zip file path = docProps/custom.xml
Source: FFC20000.0.dr Initial sample: OLE zip file path = xl/media/image1.png
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File opened: C:\Windows\SysWOW64\MSVCR100.dll Jump to behavior

Persistence and Installation Behavior:

barindex
Creates processes via WMI
Source: C:\Windows\SysWOW64\wbem\WMIC.exe WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create

Hooking and other Techniques for Hiding and Protection:

barindex
Creates and opens a fake document (probably a fake document to hide exploiting)
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Process created: cmd line: tceltz.rtf Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process created: cmd line: tceltz.rtf Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\mshta.exe TID: 5464 Thread sleep time: -30000s >= -30000s Jump to behavior
Contains functionality to detect virtual machines (SLDT)
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Code function: 0_3_0F53FA58 sldt word ptr [eax] 0_3_0F53FA58
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Code function: 0_3_0F542E4C rdtsc 0_3_0F542E4C
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.411702761.000000000F59E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.349574960.000000000F536000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.411656756.000000000F537000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.414628702.000000000F59E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.349641759.000000000F59E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.542025374.000000000F59E000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.414512357.000000000F537000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.541923673.000000000F537000.00000004.00000001.sdmp, mshta.exe, 0000001A.00000003.469056454.000002170B64B000.00000004.00000001.sdmp, mshta.exe, 0000001A.00000003.469008575.0000020F08951000.00000004.00000001.sdmp, mshta.exe, 0000001A.00000002.538705158.000002170B64E000.00000004.00000001.sdmp, mshta.exe, 0000001A.00000002.534821002.0000020F08952000.00000004.00000020.sdmp, mshta.exe, 0000001A.00000003.469215918.000002170B653000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW
Source: EXCEL.EXE, 00000000.00000002.539215911.000000000D793000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAWH

Anti Debugging:

barindex
Launches processes in debugging mode, may be used to hinder debugging
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Process created: C:\Windows\System32\mshta.exe mshta C:\ProgramData\tCeltZ.rtf Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Code function: 0_3_0F542E4C rdtsc 0_3_0F542E4C

HIPS / PFW / Operating System Protection Evasion:

barindex
Yara detected Xls With Macro 4.0
Source: Yara match File source: app.xml, type: SAMPLE
Source: EXCEL.EXE, 00000000.00000002.536920215.0000000002DA0000.00000002.00020000.sdmp, mshta.exe, 0000001A.00000002.535628470.0000020F08D70000.00000002.00020000.sdmp Binary or memory string: uProgram Manager
Source: EXCEL.EXE, 00000000.00000002.536920215.0000000002DA0000.00000002.00020000.sdmp, mshta.exe, 0000001A.00000002.535628470.0000020F08D70000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: EXCEL.EXE, 00000000.00000002.536920215.0000000002DA0000.00000002.00020000.sdmp, mshta.exe, 0000001A.00000002.535628470.0000020F08D70000.00000002.00020000.sdmp Binary or memory string: Progman
Source: EXCEL.EXE, 00000000.00000002.536920215.0000000002DA0000.00000002.00020000.sdmp, mshta.exe, 0000001A.00000002.535628470.0000020F08D70000.00000002.00020000.sdmp Binary or memory string: Progmanlock
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 532575 Sample: order 4544471372.xls Startdate: 02/12/2021 Architecture: WINDOWS Score: 100 29 Multi AV Scanner detection for submitted file 2->29 31 Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros) 2->31 33 Sigma detected: TA505 Dropper Load Pattern 2->33 35 8 other signatures 2->35 7 EXCEL.EXE 26 26 2->7         started        11 WmiPrvSE.exe 2->11         started        process3 file4 21 C:\Users\user\...\~$order 4544471372.xls, data 7->21 dropped 23 C:\Users\user\...\order 4544471372.xls (copy), Microsoft 7->23 dropped 25 C:\ProgramData\tCeltZ.rtf, HTML 7->25 dropped 37 Creates and opens a fake document (probably a fake document to hide exploiting) 7->37 13 WMIC.exe 1 7->13         started        16 mshta.exe 11->16         started        signatures5 process6 dnsIp7 39 Creates processes via WMI 13->39 19 conhost.exe 13->19         started        27 149.129.254.152, 49816, 8080 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC Singapore 16->27 signatures8 process9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
149.129.254.152
 unknown Singapore
45102 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC false

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://149.129.254.152:8080/6tfcnfucknugget4gpenis3dade5z6cpc false
  • Avira URL Cloud: safe
 unknown