Source: EXCEL.EXE, 00000000.00000002.757698394.0000000005541000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.757753405.0000000005564000.00000004.00000001.sdmp |
String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06 |
Source: EXCEL.EXE, 00000000.00000002.757753405.0000000005564000.00000004.00000001.sdmp |
String found in binary or memory: http://crl.entrust.net/2048ca.crl0 |
Source: EXCEL.EXE, 00000000.00000002.757753405.0000000005564000.00000004.00000001.sdmp |
String found in binary or memory: http://crl.entrust.net/server1.crl0 |
Source: EXCEL.EXE, 00000000.00000002.757753405.0000000005564000.00000004.00000001.sdmp |
String found in binary or memory: http://crl.globalsign.net/root-r2.crl0 |
Source: EXCEL.EXE, 00000000.00000002.757753405.0000000005564000.00000004.00000001.sdmp |
String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0 |
Source: EXCEL.EXE, 00000000.00000002.757753405.0000000005564000.00000004.00000001.sdmp |
String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0 |
Source: EXCEL.EXE, 00000000.00000002.756462860.0000000004DD0000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.458941535.0000000004840000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.433299064.0000000004A30000.00000002.00020000.sdmp |
String found in binary or memory: http://investor.msn.com |
Source: EXCEL.EXE, 00000000.00000002.756462860.0000000004DD0000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.458941535.0000000004840000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.433299064.0000000004A30000.00000002.00020000.sdmp |
String found in binary or memory: http://investor.msn.com/ |
Source: EXCEL.EXE, 00000000.00000002.756774289.0000000004FB7000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.459166553.0000000004A27000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.433499004.0000000004C17000.00000002.00020000.sdmp |
String found in binary or memory: http://localizability/practices/XML.asp |
Source: EXCEL.EXE, 00000000.00000002.756774289.0000000004FB7000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.459166553.0000000004A27000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.433499004.0000000004C17000.00000002.00020000.sdmp |
String found in binary or memory: http://localizability/practices/XMLConfiguration.asp |
Source: EXCEL.EXE, 00000000.00000002.757698394.0000000005541000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.757753405.0000000005564000.00000004.00000001.sdmp |
String found in binary or memory: http://ocsp.comodoca.com0 |
Source: EXCEL.EXE, 00000000.00000002.757753405.0000000005564000.00000004.00000001.sdmp |
String found in binary or memory: http://ocsp.comodoca.com0% |
Source: EXCEL.EXE, 00000000.00000002.757753405.0000000005564000.00000004.00000001.sdmp |
String found in binary or memory: http://ocsp.comodoca.com0- |
Source: EXCEL.EXE, 00000000.00000002.757753405.0000000005564000.00000004.00000001.sdmp |
String found in binary or memory: http://ocsp.comodoca.com0/ |
Source: EXCEL.EXE, 00000000.00000002.757753405.0000000005564000.00000004.00000001.sdmp |
String found in binary or memory: http://ocsp.comodoca.com05 |
Source: EXCEL.EXE, 00000000.00000002.757753405.0000000005564000.00000004.00000001.sdmp |
String found in binary or memory: http://ocsp.entrust.net03 |
Source: EXCEL.EXE, 00000000.00000002.757753405.0000000005564000.00000004.00000001.sdmp |
String found in binary or memory: http://ocsp.entrust.net0D |
Source: EXCEL.EXE, 00000000.00000002.758868165.0000000006936000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.758982507.0000000006966000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.761155154.0000000007AB6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.761078798.00000000071E6000.00000004.00000001.sdmp |
String found in binary or memory: http://schemas.open |
Source: EXCEL.EXE, 00000000.00000002.758982507.0000000006966000.00000004.00000001.sdmp |
String found in binary or memory: http://schemas.openformatrg/drawml/2006/spreadsheetD |
Source: EXCEL.EXE, 00000000.00000002.758868165.0000000006936000.00000004.00000001.sdmp |
String found in binary or memory: http://schemas.openformatrg/package/2006/content-t |
Source: EXCEL.EXE, 00000000.00000002.761155154.0000000007AB6000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.761078798.00000000071E6000.00000004.00000001.sdmp |
String found in binary or memory: http://schemas.openformatrg/package/2006/r |
Source: regsvr32.exe, 00000003.00000002.458519777.0000000003A60000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.432892506.0000000003B40000.00000002.00020000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous. |
Source: regsvr32.exe, 00000003.00000002.458167043.0000000001DE0000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.432455661.0000000001D40000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.486891484.0000000001DA0000.00000002.00020000.sdmp |
String found in binary or memory: http://servername/isapibackend.dll |
Source: EXCEL.EXE, 00000000.00000002.756774289.0000000004FB7000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.459166553.0000000004A27000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.433499004.0000000004C17000.00000002.00020000.sdmp |
String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check |
Source: EXCEL.EXE, 00000000.00000002.756774289.0000000004FB7000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.459166553.0000000004A27000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.433499004.0000000004C17000.00000002.00020000.sdmp |
String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true |
Source: regsvr32.exe, 00000003.00000002.458519777.0000000003A60000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.432892506.0000000003B40000.00000002.00020000.sdmp |
String found in binary or memory: http://www.%s.comPA |
Source: EXCEL.EXE, 00000000.00000002.757753405.0000000005564000.00000004.00000001.sdmp |
String found in binary or memory: http://www.digicert.com.my/cps.htm02 |
Source: EXCEL.EXE, 00000000.00000002.757753405.0000000005564000.00000004.00000001.sdmp |
String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0 |
Source: EXCEL.EXE, 00000000.00000002.756462860.0000000004DD0000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.458941535.0000000004840000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.433299064.0000000004A30000.00000002.00020000.sdmp |
String found in binary or memory: http://www.hotmail.com/oe |
Source: EXCEL.EXE, 00000000.00000002.756774289.0000000004FB7000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.459166553.0000000004A27000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.433499004.0000000004C17000.00000002.00020000.sdmp |
String found in binary or memory: http://www.icra.org/vocabulary/. |
Source: EXCEL.EXE, 00000000.00000002.756462860.0000000004DD0000.00000002.00020000.sdmp, regsvr32.exe, 00000003.00000002.458941535.0000000004840000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.433299064.0000000004A30000.00000002.00020000.sdmp |
String found in binary or memory: http://www.msnbc.com/news/ticker.txt |
Source: regsvr32.exe, 00000004.00000002.433299064.0000000004A30000.00000002.00020000.sdmp |
String found in binary or memory: http://www.windows.com/pctv. |
Source: EXCEL.EXE, 00000000.00000003.412689926.0000000005699000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.758475130.0000000005667000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.412675282.0000000005697000.00000004.00000001.sdmp |
String found in binary or memory: https://greenflag.esp.br/ |
Source: EXCEL.EXE, 00000000.00000002.757569584.00000000054D6000.00000004.00000001.sdmp |
String found in binary or memory: https://greenflag.esp.br/yuINdRbM/tiynh.html |
Source: EXCEL.EXE, 00000000.00000002.757569584.00000000054D6000.00000004.00000001.sdmp |
String found in binary or memory: https://greenflag.esp.br/yuINdRbM/tiynh.htmltv7y |
Source: EXCEL.EXE, 00000000.00000003.412689926.0000000005699000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.758475130.0000000005667000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.412675282.0000000005697000.00000004.00000001.sdmp |
String found in binary or memory: https://greenflag.esp.br/~ |
Source: EXCEL.EXE, 00000000.00000002.757830393.00000000055A1000.00000004.00000001.sdmp |
String found in binary or memory: https://noithat117.vn/ |
Source: EXCEL.EXE, 00000000.00000002.757569584.00000000054D6000.00000004.00000001.sdmp |
String found in binary or memory: https://noithat117.vn/TSh7GBeIR/tiynh.html |
Source: EXCEL.EXE, 00000000.00000002.757569584.00000000054D6000.00000004.00000001.sdmp |
String found in binary or memory: https://noithat117.vn/TSh7GBeIR/tiynh.htmlfs7y |
Source: EXCEL.EXE, 00000000.00000002.759428782.0000000006B20000.00000004.00000001.sdmp |
String found in binary or memory: https://playsis.com |
Source: EXCEL.EXE, 00000000.00000002.759428782.0000000006B20000.00000004.00000001.sdmp |
String found in binary or memory: https://playsis.com.boi |
Source: EXCEL.EXE, 00000000.00000002.757830393.00000000055A1000.00000004.00000001.sdmp |
String found in binary or memory: https://playsis.com.br/ |
Source: EXCEL.EXE, 00000000.00000002.759428782.0000000006B20000.00000004.00000001.sdmp |
String found in binary or memory: https://playsis.com.br/qJSL117. |
Source: EXCEL.EXE, 00000000.00000002.759428782.0000000006B20000.00000004.00000001.sdmp |
String found in binary or memory: https://playsis.com.br/qJSL1B.b |
Source: EXCEL.EXE, 00000000.00000002.758475130.0000000005667000.00000004.00000001.sdmp |
String found in binary or memory: https://playsis.com.br/qJSL1BN5V/tiynh.html |
Source: EXCEL.EXE, 00000000.00000002.759428782.0000000006B20000.00000004.00000001.sdmp |
String found in binary or memory: https://playsis.com.br/qJSL1BN5V/tiynh.html117.vn/TSh7GBeIR/tiynh.htmlink |
Source: EXCEL.EXE, 00000000.00000002.758475130.0000000005667000.00000004.00000001.sdmp |
String found in binary or memory: https://playsis.com.br/qJSL1BN5V/tiynh.html3W(y |
Source: EXCEL.EXE, 00000000.00000002.759428782.0000000006B20000.00000004.00000001.sdmp |
String found in binary or memory: https://playsis.com.br/qJSL1BNt |
Source: EXCEL.EXE, 00000000.00000002.759428782.0000000006B20000.00000004.00000001.sdmp |
String found in binary or memory: https://playsis.com.br/qJSi |
Source: EXCEL.EXE, 00000000.00000002.759428782.0000000006B20000.00000004.00000001.sdmp |
String found in binary or memory: https://playsis.com.br/qhtt |
Source: EXCEL.EXE, 00000000.00000002.757830393.00000000055A1000.00000004.00000001.sdmp |
String found in binary or memory: https://playsis.com.br/viderJ |
Source: EXCEL.EXE, 00000000.00000002.759428782.0000000006B20000.00000004.00000001.sdmp |
String found in binary or memory: https://playsis.cre |
Source: EXCEL.EXE, 00000000.00000002.757698394.0000000005541000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.757753405.0000000005564000.00000004.00000001.sdmp |
String found in binary or memory: https://secure.comodo.com/CPS0 |
Source: Screenshot number: 4 |
Screenshot OCR: Enable Editing 18 19 I OK 20 (D PROTECTED VIEW Be careful - files from the lnterne -cted View. E |
Source: Screenshot number: 4 |
Screenshot OCR: Enable Content 25 26 (i) SECURITY WARNING Macros have been disabled. Enable Content 27 28 29 3 |
Source: Screenshot number: 8 |
Screenshot OCR: Enable Editing (D PROTECTED VIEW Be careful - files from the lnterne Ln9k _J -cted View. Enable E |
Source: Screenshot number: 8 |
Screenshot OCR: Enable Content OSECURITY WARNING Macros have been disabled. Enable Content If you are using a mobi |
Source: Screenshot number: 12 |
Screenshot OCR: Enable Editing No RETURNQ or HALTQ function found on maao sheet. 18 19 I " I 20 (D PROTECTED VIE |
Source: Screenshot number: 12 |
Screenshot OCR: Enable Content 25 26 (i) SECURITY WARNING Macros have been disabled. Enable Content 27 28 29 3 |
Source: Document image extraction number: 0 |
Screenshot OCR: Enable Editing CD PROTECTED VIEW Be careful - files from the Internet can contain viruses. Unless y |
Source: Document image extraction number: 0 |
Screenshot OCR: Enable Content OSECURITY WARNING Macros have been disabled. Enable Content If you are using a mobi |
Source: Screenshot number: 16 |
Screenshot OCR: Enable Editing d 18 19 20 (D PROTECTED VIEW Be careful - files from the Internet can contain viru |
Source: Screenshot number: 16 |
Screenshot OCR: Enable Content 25 26 (i) SECURITY WARNING Macros have been disabled. Enable Content 27 28 29 3 |
Source: Screenshot number: 20 |
Screenshot OCR: Enable Editing 19 20 (D PROTECTED VIEW Be careful - files from the Internet can contain viruses. U |
Source: Screenshot number: 20 |
Screenshot OCR: Enable Content 25 26 (i) SECURITY WARNING Macros have been disabled. Enable Content 27 28 29 Z |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |