Windows Analysis Report
https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=Link

Overview

General Information

Sample URL:	https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=Link
Analysis ID:	1592163
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Stores files to the Windows start menu directory

Classification

Signatures

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /FmBEL5nr1CkYwv7j?ref=Link HTTP/1.1Host: sway.cloud.microsoftConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/FmBEL5nr1CkYwv7j/get?currentClientVersion=201 HTTP/1.1Host: sway.cloud.microsoftConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AuthSess=aa683351-8f28-4455-8f72-6b5a9df4413e; AADNonce=0d4bb39b-2955-400d-880d-9899a15ac82c.638725681132858415; anonuserid=cd1e1038-c94b-40cb-967d-6743e745a281
Source: global traffic	HTTP traffic detected: GET /RemoteUls.ashx HTTP/1.1Host: sway.cloud.microsoftConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AuthSess=aa683351-8f28-4455-8f72-6b5a9df4413e; AADNonce=0d4bb39b-2955-400d-880d-9899a15ac82c.638725681132858415; anonuserid=cd1e1038-c94b-40cb-967d-6743e745a281; CDNFailureCount=0
Source: global traffic	HTTP traffic detected: GET /Content/times.woff HTTP/1.1Host: www.sway-cdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://sway.cloud.microsoftsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://sway.cloud.microsoft/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Content/ModernMT.woff HTTP/1.1Host: www.sway-cdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://sway.cloud.microsoftsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://sway.cloud.microsoft/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /RemoteUls.ashx HTTP/1.1Host: sway.cloud.microsoftConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AuthSess=aa683351-8f28-4455-8f72-6b5a9df4413e; AADNonce=0d4bb39b-2955-400d-880d-9899a15ac82c.638725681132858415; anonuserid=cd1e1038-c94b-40cb-967d-6743e745a281; CDNFailureCount=0
Source: global traffic	HTTP traffic detected: GET /webappmanifest.json HTTP/1.1Host: sway.cloud.microsoftConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=LinkAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /RemoteUls.ashx HTTP/1.1Host: sway.cloud.microsoftConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AuthSess=aa683351-8f28-4455-8f72-6b5a9df4413e; AADNonce=0d4bb39b-2955-400d-880d-9899a15ac82c.638725681132858415; anonuserid=cd1e1038-c94b-40cb-967d-6743e745a281; CDNFailureCount=0
Source: global traffic	HTTP traffic detected: GET /RemoteUls.ashx HTTP/1.1Host: sway.cloud.microsoftConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AuthSess=aa683351-8f28-4455-8f72-6b5a9df4413e; AADNonce=0d4bb39b-2955-400d-880d-9899a15ac82c.638725681132858415; anonuserid=cd1e1038-c94b-40cb-967d-6743e745a281; CDNFailureCount=0

Source: global traffic	DNS traffic detected: DNS query: sway.cloud.microsoft
Source: global traffic	DNS traffic detected: DNS query: eus-www.sway-cdn.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: www.sway-cdn.com

Source: unknown

HTTP traffic detected: POST /s/FmBEL5nr1CkYwv7j/get?currentClientVersion=201 HTTP/1.1Host: sway.cloud.microsoftConnection: keep-aliveContent-Length: 163sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-WebClientVersion: 201X-UserSessionId: e7e36183-ea4d-4f74-b59b-d994748f184bsec-ch-ua-mobile: ?0X-Key: /+ONcaKkjH9rNToELrCUBGrxGceAqL3jM+7JoZJ5Fgw=,638725681131608448User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded; charset=UTF-8X-LookupId: FmBEL5nr1CkYwv7janonuserid: cd1e1038-c94b-40cb-967d-6743e745a281X-StoryId: 2VfOH0nzECOezET80gbCsec-ch-ua-platform: "Windows"Accept: */*Origin: https://sway.cloud.microsoftSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=LinkAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AuthSess=aa683351-8f28-4455-8f72-6b5a9df4413e; AADNonce=0d4bb39b-2955-400d-880d-9899a15ac82c.638725681132858415; anonuserid=cd1e1038-c94b-40cb-967d-6743e745a281

Source: chromecache_118.1.dr, chromecache_131.1.dr	String found in binary or memory: http://hammerjs.github.io/
Source: chromecache_115.1.dr, chromecache_119.1.dr	String found in binary or memory: https://jqueryui.com
Source: chromecache_117.1.dr, chromecache_112.1.dr	String found in binary or memory: https://modernizr.com/download/?-animation-canvas-cssfilters-csstransforms-flexbox-geolocation-prese
Source: chromecache_101.1.dr, chromecache_132.1.dr	String found in binary or memory: https://pickit.com/terms-privacy/
Source: chromecache_101.1.dr, chromecache_132.1.dr	String found in binary or memory: https://www.flickr.com/people/

Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: classification engine

Classification label: clean0.win@17/86@20/8

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=2008,i,16609716589125160765,14148817323372105267,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=Link"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=2008,i,16609716589125160765,14148817323372105267,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
2.20.211.3	www.sway-cdn.com	European Union	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.111.243.44	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false
52.111.243.45	sway.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.17
192.168.2.16
192.168.2.23

Contacted Domains

Name	IP	Active
www.sway-cdn.com	2.20.211.3	true
s-part-0017.t-0009.fb-t-msedge.net	13.107.253.45	true
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true
www.google.com	142.250.184.228	true
sway.com	52.111.243.45	true
sway.cloud.microsoft	unknown	unknown
login.microsoftonline.com	unknown	unknown
eus-www.sway-cdn.com	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=Link	false	high
https://sway.cloud.microsoft/RemoteUls.ashx	false	high
https://sway.cloud.microsoft/sway/v1.0/FmBEL5nr1CkYwv7j/analytics?timeSpent=0&scrollDepth=0&readRatioGrade=0	false	high
https://sway.cloud.microsoft/s/FmBEL5nr1CkYwv7j/get?currentClientVersion=201	false	high
https://sway.cloud.microsoft/webappmanifest.json	false	high
https://sway.cloud.microsoft/sway/v1.0/FmBEL5nr1CkYwv7j/analytics?timeSpent=0&scrollDepth=1&readRatioGrade=0	false	high
https://www.sway-cdn.com/Content/times.woff	false	high
https://www.sway-cdn.com/Content/ModernMT.woff	false	high

ID:	1592163
Product:	CloudBasic
Start time:	21:01:19
Start date:	15.01.2025
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 19:01:52 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	809CAC7E266449A9B718956E860467A2	5E6B5DABD968D890FEC42A9D8588343F10A803BE	CB9CBA76714D7843FA7B3FDF009193A3F5B7FF49F07DB61D4B8F8348F813CC6B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 19:01:52 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	6D8B79352199FB120982397161756F8B	C2634E00AFEF639C91B62C51B4D7F6A01B9CEE87	2AF6B94C83B00D248CE42FF11A45C58D3310332E2037FE4DA0874A8840B70E22
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	852C31E73E0DA3B18DBEC7E76DBE468D	A17B6B73D10D84B120654EC400A18B8BAA6FA1B4	F4C8E723F5637893C5563BBC2E7994DDC7329A984F095C6993F755F5ACFB4CBD
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 19:01:52 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	3DD9A2395E95C132DA5540E34A6F6944	2B9F91BF682BA0718E2D0C7C73E60A21570D9472	2A05D999C39C9F6EEEFE1169B1A2C2C4486D81689DD351E9D90B7C3E46573938
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 19:01:52 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	06757FC857939D8BAE934CF2AFDBA090	9D53B9EE78AF12F253204239490733CE9CD69BF8	3715353982AA86EC1F6BAF633376F7F418D2CD077232160647C1AC1549691092
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 19:01:52 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	20260C416C5586A4734A9D872137F753	9E25EB42BF40391B7D7050982ECDBB363EDE6CCC	A96C07C30BB7F2E8E53A2FB06E69AF5D9D3D71F99B35ABA1075E9D95B87EC206
Chrome Cache Entry: 100	GIF image data, version 89a, 32 x 32	71FE5AA913D40CB6E596C795EB2A0BDC	7B9925CEE0045982261680D4ECEF525B29EFC314	11572F274D092466B9249659CFD382A0CFB640B23DF4D4A1071C1B8D70147415
Chrome Cache Entry: 101	Unicode text, UTF-8 text, with very long lines (65479), with no line terminators	5F20D18B83A97D000E2DA0C3A8222FF3	536C593CFCA83A76CE724D79A88F8FB08163E139	B59A9975A9E2891003414F9E02164DC765D7ACBE2A430CD934C585FFC931229A
Chrome Cache Entry: 102	PNG image data, 310 x 319, 8-bit/color RGBA, non-interlaced	B0D76C4804189526DCEF946D94CA58A9	CE86C3623F53E4B39D9CD33CC924AFC45E91F94F	D46375075D66174F88AD9834C0695792C9AFDD0F20456231FA4A873280A2C434
Chrome Cache Entry: 103	ASCII text, with no line terminators	A6F9C78D997A801FBCC0836D25BC5B49	FABE913CE6F1EF3578FF48B7899B1108C81E61EA	727B9D28113D6854D243727AA66D1D1FAB2E92C32C1DC16252CDC45E8C9F9E09
Chrome Cache Entry: 104	ASCII text, with very long lines (32416)	9F5DBA23BBFB4E0D50AC9AA6CE998D1A	0F027B6B4FD323C708592DCDE052774CA7FD5FD6	4F2D6301347A2FBF30FED521F2D319E78CFFD90713336DCC9C0A2676DC3FB37C
Chrome Cache Entry: 105	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 506x99, components 3	1AFA12F43A0730654FCBF142BAAF34E3	51836B66CB3EE5EC89ACC73723B65BF0AAA8202F	76890C8F5F4167CC49597143A1A3E68B6EC83AE1BC03D89711CA819576C25811
Chrome Cache Entry: 106	ASCII text, with very long lines (32416)	9F5DBA23BBFB4E0D50AC9AA6CE998D1A	0F027B6B4FD323C708592DCDE052774CA7FD5FD6	4F2D6301347A2FBF30FED521F2D319E78CFFD90713336DCC9C0A2676DC3FB37C
Chrome Cache Entry: 107	Unicode text, UTF-8 text, with very long lines (65534), with no line terminators	3A3ECA571E49966BDC90610849CB9AE5	FAF9F22A19CDE3CCA2B21FE2FB3FEC30A4E4E164	760897486502D412EF3E45FACF73BE4FC3DEAD7C928809C3D5C5F65E29F666A2
Chrome Cache Entry: 108	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 506x99, components 3	1AFA12F43A0730654FCBF142BAAF34E3	51836B66CB3EE5EC89ACC73723B65BF0AAA8202F	76890C8F5F4167CC49597143A1A3E68B6EC83AE1BC03D89711CA819576C25811
Chrome Cache Entry: 109	ASCII text, with very long lines (18297), with no line terminators	07AEACE14BC25BD80965074A2E1BEF99	1AAC494567122CBA3D74CE24F3929AAF6E795286	672C4522E341BC0C997527D35EF82B67428874DB680B485E9ACD5753BEB5CDBC
Chrome Cache Entry: 110	JSON data	D283604F5AE2A73E460A4ED4ED0F3173	14646D287B7418D333AFBB4F706F71E5DD30CD79	4AA4F1E597282B4754DDDAB238AD28553A7FC855B926757053950B39C450CD7D
Chrome Cache Entry: 111	ASCII text, with very long lines (65536), with no line terminators	042D35CD71CE494BF7819730894373E1	968E6CE3EC065E0BC6CA4217A39F9C049B5491F9	3EC5AD6EB10D5D8045B9F7A8627C613E8E84369882843A7715FC81CE4426B3D1
Chrome Cache Entry: 112	ASCII text, with very long lines (7649), with CRLF line terminators	F299DC10BCDDD2E7808B978B3DE18936	D8273FB0282BFA670F554E45F8AE7B1F73EC8071	160DACA799B276D8CE387E0187D972D715ABEAD1399795BFF9EC2A64B494527C
Chrome Cache Entry: 113	Unicode text, UTF-8 text, with very long lines (65534), with no line terminators	3A3ECA571E49966BDC90610849CB9AE5	FAF9F22A19CDE3CCA2B21FE2FB3FEC30A4E4E164	760897486502D412EF3E45FACF73BE4FC3DEAD7C928809C3D5C5F65E29F666A2
Chrome Cache Entry: 114	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	765886EE3AF3ADC313CB7381B34E4858	A7BC43EB212CE09D3B5B864FF8BF041418B8AA58	A92FACED88C70F90030B6DBF11C0E33714EB463624DFBD895904225F58466D3A
Chrome Cache Entry: 115	Unicode text, UTF-8 text, with very long lines (64393), with CRLF line terminators	D67A4D0BDDF71AB21FCD71A66D962E17	6D2A274BB0DB572A7D52B438F9CFC4BDF39D1F44	97074CA35C4DE9F01D6D58EC29988AC2A32F09BF95604C4D22CF7D3509E67605
Chrome Cache Entry: 116	Non-ISO extended-ASCII text, with very long lines (2360), with CRLF line terminators	FD14998BADF27D4F974CA33841C97397	D951A5FC5D3A3075E8986DBA845D956A9831423E	2306CA934E2C1A52219D8A608C130F2BCDB7D859303F4CA5806CD48DB0C9AE6F
Chrome Cache Entry: 117	ASCII text, with very long lines (7649), with CRLF line terminators	F299DC10BCDDD2E7808B978B3DE18936	D8273FB0282BFA670F554E45F8AE7B1F73EC8071	160DACA799B276D8CE387E0187D972D715ABEAD1399795BFF9EC2A64B494527C
Chrome Cache Entry: 118	ASCII text, with very long lines (18177), with CRLF line terminators	D22D7500AB7C72DA9195C571002C2495	528C2D1D834916F8A4C47191CB20D16D2F6A53D3	F2BFC0B2FFA4E26071E6D6D8B73D750F6E9F8EB4E021A8FFDB18B84AF0B919A3
Chrome Cache Entry: 119	Unicode text, UTF-8 text, with very long lines (64393), with CRLF line terminators	D67A4D0BDDF71AB21FCD71A66D962E17	6D2A274BB0DB572A7D52B438F9CFC4BDF39D1F44	97074CA35C4DE9F01D6D58EC29988AC2A32F09BF95604C4D22CF7D3509E67605
Chrome Cache Entry: 120	Web Open Font Format, TrueType, length 56984, version 1.6554	45586F9929A78F6FC868E820C20444CB	A4FC62D30978CC3BCFEE1F9623ECDD53AEBBC47A	FCBD729033BCFB895F97B76D14300604CEDFFFEBDA9F067FD98696A7CF7FC81A
Chrome Cache Entry: 121	ASCII text, with very long lines (52717), with no line terminators	413FCC759CC19821B61B6941808B29B5	1AD23B8A202043539C20681B1B3E9F3BC5D55133	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
Chrome Cache Entry: 122	ASCII text, with very long lines (65536), with no line terminators	F69ED7B2C776908F19485EAC7440E623	2E67A11B7C59AF6B7D4E93A381B1F798526C4604	511C42B68EE9AC6C4D65E42B413E7B3A94EA4A03759778C552B2A04424AB9C5A
Chrome Cache Entry: 123	ASCII text, with very long lines (65536), with no line terminators	A1F2EBBEAC975DD339C6DB9FCA63F508	232B27F4EE6815C7B64B4C2B5FF887846473363C	1A011AAF43355B8AD955EFD58135B5D7ECF1950DD7796B4DDF878A7F350495A5
Chrome Cache Entry: 124	GIF image data, version 89a, 32 x 32	71FE5AA913D40CB6E596C795EB2A0BDC	7B9925CEE0045982261680D4ECEF525B29EFC314	11572F274D092466B9249659CFD382A0CFB640B23DF4D4A1071C1B8D70147415
Chrome Cache Entry: 125	GIF image data, version 89a, 439 x 8	2BF75FED35AF53B95F6265C32AE6FA86	20F92AED3AD96C505F7A21CCAE780D8CEE27F252	2E237D89D57788E810720FD97BCC0992E159044281956ECBA83EFD3A4F4B56CF
Chrome Cache Entry: 126	GIF image data, version 89a, 439 x 8	2BF75FED35AF53B95F6265C32AE6FA86	20F92AED3AD96C505F7A21CCAE780D8CEE27F252	2E237D89D57788E810720FD97BCC0992E159044281956ECBA83EFD3A4F4B56CF
Chrome Cache Entry: 127	Web Open Font Format, TrueType, length 22140, version 1.0	7D6194A2C2E90678FEE013960EA9ECA7	98FA90EC84CAFCF1E0FF194664E8B4C4D99C056E	E27855EF831CD10EB0FE2153D1B169D24A148E0B81D3DEA001FD2637E7244238
Chrome Cache Entry: 128	Web Open Font Format, TrueType, length 128318, version 1.0	ED69A963D14845990C8C9067243BFC02	10972BA274795DE4611D26E6D3F83C40E1D76DCF	199C4A56DC05DC42344A9A8EC71C63B042FF5D041C1C6E0B924626A00B0214B5
Chrome Cache Entry: 129	Web Open Font Format, TrueType, length 17928, version 1.0	79FE1F8B05FEE28587B8F88540AEA467	77465646D7C48B25DEBBE396810D515BC4EF34EF	3BA8DB3C78DB3DC15CB4A8C2523B5FBE189CF4BA8A24B07A810616EF4946B279
Chrome Cache Entry: 130	C source, ASCII text, with very long lines (23668), with no line terminators	16596D4249F021D9B71BB5CADDB7CC3B	7D3F469CCEF320E01ECD9C601E80EF5192326869	AA26CFE55E8CD183738F42180AAE291DD666F4D39062E8A44C97B0BE021946EF
Chrome Cache Entry: 131	ASCII text, with very long lines (18177), with CRLF line terminators	D22D7500AB7C72DA9195C571002C2495	528C2D1D834916F8A4C47191CB20D16D2F6A53D3	F2BFC0B2FFA4E26071E6D6D8B73D750F6E9F8EB4E021A8FFDB18B84AF0B919A3
Chrome Cache Entry: 132	Unicode text, UTF-8 text, with very long lines (65479), with no line terminators	5F20D18B83A97D000E2DA0C3A8222FF3	536C593CFCA83A76CE724D79A88F8FB08163E139	B59A9975A9E2891003414F9E02164DC765D7ACBE2A430CD934C585FFC931229A
Chrome Cache Entry: 133	ASCII text, with very long lines (18297), with no line terminators	07AEACE14BC25BD80965074A2E1BEF99	1AAC494567122CBA3D74CE24F3929AAF6E795286	672C4522E341BC0C997527D35EF82B67428874DB680B485E9ACD5753BEB5CDBC
Chrome Cache Entry: 134	ASCII text, with very long lines (65536), with no line terminators	E8D4F0ABAD8FB107491A919BBD3F3D73	1E048048BECE156C0EA924EB94FF22FF89201054	0FF91B144B5BA2FB8303FF9C01BFB1031C9B8B170332623DF2A8D85AACE6583A
Chrome Cache Entry: 135	C source, ASCII text, with very long lines (23668), with no line terminators	16596D4249F021D9B71BB5CADDB7CC3B	7D3F469CCEF320E01ECD9C601E80EF5192326869	AA26CFE55E8CD183738F42180AAE291DD666F4D39062E8A44C97B0BE021946EF
Chrome Cache Entry: 136	ASCII text, with very long lines (65446), with CRLF line terminators	C9A1B0AA0167C8A4DF724D18D06814A8	F3F468CCF735476C87E3B49E274EB3752A884607	7AA6B0E08F48A0F95D8DF7EA89E4CBFE1EF3D1E8C0F7373F7F25EDFB4E4A325E
Chrome Cache Entry: 137	ASCII text, with very long lines (65536), with no line terminators	A1F2EBBEAC975DD339C6DB9FCA63F508	232B27F4EE6815C7B64B4C2B5FF887846473363C	1A011AAF43355B8AD955EFD58135B5D7ECF1950DD7796B4DDF878A7F350495A5
Chrome Cache Entry: 138	ASCII text, with very long lines (65446), with CRLF line terminators	C9A1B0AA0167C8A4DF724D18D06814A8	F3F468CCF735476C87E3B49E274EB3752A884607	7AA6B0E08F48A0F95D8DF7EA89E4CBFE1EF3D1E8C0F7373F7F25EDFB4E4A325E
Chrome Cache Entry: 139	ASCII text, with very long lines (3298), with no line terminators	B05AF20933A5C55D8228372B62CFF439	8C7D1B8F149A66F4C82266C284AA12E2CA384CC1	583F54C663C161E490DD8991D9E9101A3CA54822F458E73DCFC4885CE0EFE34F
Chrome Cache Entry: 140	MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel	765886EE3AF3ADC313CB7381B34E4858	A7BC43EB212CE09D3B5B864FF8BF041418B8AA58	A92FACED88C70F90030B6DBF11C0E33714EB463624DFBD895904225F58466D3A
Chrome Cache Entry: 141	ASCII text, with very long lines (52717), with no line terminators	413FCC759CC19821B61B6941808B29B5	1AD23B8A202043539C20681B1B3E9F3BC5D55133	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
Chrome Cache Entry: 142	PNG image data, 310 x 319, 8-bit/color RGBA, non-interlaced	B0D76C4804189526DCEF946D94CA58A9	CE86C3623F53E4B39D9CD33CC924AFC45E91F94F	D46375075D66174F88AD9834C0695792C9AFDD0F20456231FA4A873280A2C434
Chrome Cache Entry: 143	Non-ISO extended-ASCII text, with very long lines (2360), with CRLF line terminators	FD14998BADF27D4F974CA33841C97397	D951A5FC5D3A3075E8986DBA845D956A9831423E	2306CA934E2C1A52219D8A608C130F2BCDB7D859303F4CA5806CD48DB0C9AE6F
Chrome Cache Entry: 144	Web Open Font Format, TrueType, length 6140, version 1.0	A207072E073B59E21CCEDD04403389AD	053D31B075133B48F6B61C01858419768DCB0121	FC0F4C08C50F64C23B4C2031679BB705A2A426B09BE5865CBCB3931E0DBA447C
Chrome Cache Entry: 145	ASCII text, with very long lines (65536), with no line terminators	C3F888E6C69CD5DF49185B49BDBA869F	BD293B7DD931BE7806B5152DC7470841BF5FD324	222B17BC1A6DBE0EEF237BF6E4428E7E3EE3847D95567C80FD0E875D6E9059EF
Chrome Cache Entry: 146	ASCII text, with very long lines (65536), with no line terminators	F69ED7B2C776908F19485EAC7440E623	2E67A11B7C59AF6B7D4E93A381B1F798526C4604	511C42B68EE9AC6C4D65E42B413E7B3A94EA4A03759778C552B2A04424AB9C5A
Chrome Cache Entry: 98	Web Open Font Format, TrueType, length 23704, version 1.0	7DDED8E00E4E1FA6B8301BA58FDB96F1	A5CC4C84ED041EF71D6A989B34B841942234BA2B	56C3F81E1FCADA437F327CA47A70ACBCE01C7B3A8DE0BC93081698AD039A7C42
Chrome Cache Entry: 99	ASCII text, with very long lines (65536), with no line terminators	EA096B70A08E922F0A9CABBD802218D6	03D32A5D0743B0EEC3C1EE8DC4D47C1A01D2228C	4EAFEAA8F796A9BC2F6EF1DB4094E872EC00C3D9F7D52F9AB87B84B6640329AB

Windows Analysis Report
https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=Link

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=Link

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=Link