Edit tour

Windows Analysis Report
https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=Link

Overview

General Information

Sample URL:	https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=Link
Analysis ID:	1592163
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6784 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5444 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=2008,i,16609716589125160765,14148817323372105267,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6480 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=Link" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /s/FmBEL5nr1CkYwv7j/get?currentClientVersion=201 HTTP/1.1Host: sway.cloud.microsoftConnection: keep-aliveContent-Length: 163sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-WebClientVersion: 201X-UserSessionId: e7e36183-ea4d-4f74-b59b-d994748f184bsec-ch-ua-mobile: ?0X-Key: /+ONcaKkjH9rNToELrCUBGrxGceAqL3jM+7JoZJ5Fgw=,638725681131608448User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded; charset=UTF-8X-LookupId: FmBEL5nr1CkYwv7janonuserid: cd1e1038-c94b-40cb-967d-6743e745a281X-StoryId: 2VfOH0nzECOezET80gbCsec-ch-ua-platform: "Windows"Accept: */*Origin: https://sway.cloud.microsoftSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=LinkAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AuthSess=aa683351-8f28-4455-8f72-6b5a9df4413e; AADNonce=0d4bb39b-2955-400d-880d-9899a15ac82c.638725681132858415; anonuserid=cd1e1038-c94b-40cb-967d-6743e745a281

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.67
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /FmBEL5nr1CkYwv7j?ref=Link HTTP/1.1Host: sway.cloud.microsoftConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/FmBEL5nr1CkYwv7j/get?currentClientVersion=201 HTTP/1.1Host: sway.cloud.microsoftConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AuthSess=aa683351-8f28-4455-8f72-6b5a9df4413e; AADNonce=0d4bb39b-2955-400d-880d-9899a15ac82c.638725681132858415; anonuserid=cd1e1038-c94b-40cb-967d-6743e745a281
Source: global traffic	HTTP traffic detected: GET /RemoteUls.ashx HTTP/1.1Host: sway.cloud.microsoftConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AuthSess=aa683351-8f28-4455-8f72-6b5a9df4413e; AADNonce=0d4bb39b-2955-400d-880d-9899a15ac82c.638725681132858415; anonuserid=cd1e1038-c94b-40cb-967d-6743e745a281; CDNFailureCount=0
Source: global traffic	HTTP traffic detected: GET /Content/times.woff HTTP/1.1Host: www.sway-cdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://sway.cloud.microsoftsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://sway.cloud.microsoft/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Content/ModernMT.woff HTTP/1.1Host: www.sway-cdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://sway.cloud.microsoftsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://sway.cloud.microsoft/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /RemoteUls.ashx HTTP/1.1Host: sway.cloud.microsoftConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AuthSess=aa683351-8f28-4455-8f72-6b5a9df4413e; AADNonce=0d4bb39b-2955-400d-880d-9899a15ac82c.638725681132858415; anonuserid=cd1e1038-c94b-40cb-967d-6743e745a281; CDNFailureCount=0
Source: global traffic	HTTP traffic detected: GET /webappmanifest.json HTTP/1.1Host: sway.cloud.microsoftConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=LinkAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /RemoteUls.ashx HTTP/1.1Host: sway.cloud.microsoftConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AuthSess=aa683351-8f28-4455-8f72-6b5a9df4413e; AADNonce=0d4bb39b-2955-400d-880d-9899a15ac82c.638725681132858415; anonuserid=cd1e1038-c94b-40cb-967d-6743e745a281; CDNFailureCount=0
Source: global traffic	HTTP traffic detected: GET /RemoteUls.ashx HTTP/1.1Host: sway.cloud.microsoftConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AuthSess=aa683351-8f28-4455-8f72-6b5a9df4413e; AADNonce=0d4bb39b-2955-400d-880d-9899a15ac82c.638725681132858415; anonuserid=cd1e1038-c94b-40cb-967d-6743e745a281; CDNFailureCount=0

Source: global traffic	DNS traffic detected: DNS query: sway.cloud.microsoft
Source: global traffic	DNS traffic detected: DNS query: eus-www.sway-cdn.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: www.sway-cdn.com

Source: chromecache_118.1.dr, chromecache_131.1.dr	String found in binary or memory: http://hammerjs.github.io/
Source: chromecache_115.1.dr, chromecache_119.1.dr	String found in binary or memory: https://jqueryui.com
Source: chromecache_117.1.dr, chromecache_112.1.dr	String found in binary or memory: https://modernizr.com/download/?-animation-canvas-cssfilters-csstransforms-flexbox-geolocation-prese
Source: chromecache_101.1.dr, chromecache_132.1.dr	String found in binary or memory: https://pickit.com/terms-privacy/
Source: chromecache_101.1.dr, chromecache_132.1.dr	String found in binary or memory: https://www.flickr.com/people/

Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=2008,i,16609716589125160765,14148817323372105267,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=Link"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=2008,i,16609716589125160765,14148817323372105267,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
www.sway-cdn.com	2.20.211.3	true	false	high
s-part-0017.t-0009.fb-t-msedge.net	13.107.253.45	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	142.250.184.228	true	false	high
sway.com	52.111.243.45	true	false	high
sway.cloud.microsoft	unknown	unknown	false	high
login.microsoftonline.com	unknown	unknown	false	high
eus-www.sway-cdn.com	unknown	unknown	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
2.20.211.3	www.sway-cdn.com	European Union	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.111.243.44	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false
52.111.243.45	sway.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

IP
192.168.2.17
192.168.2.16
192.168.2.23

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1592163
Start date and time:	2025-01-15 21:01:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=Link
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@17/86@20/8
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Input	Output
URL: https://sway.cloud.microsoft Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false, "reasoning": "This appears to be a Microsoft Sway URL but the TLD is incomplete. A legitimate Microsoft URL would typically end in .com. The URL is missing the .com TLD which makes it suspicious. The correct URL should be sway.cloud.microsoft.com" }
URL: https://sway.cloud.microsoft
URL: https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=Link Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=Link Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "To view the document. Click on the above link then login to the secure portal.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=Link Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=Link Model: Joe Sandbox AI	{ "brands": [ "Todd & Dossett, P.C." ] }
	{ "brands": [ "Todd & Dossett, P.C." ] }

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.flickr.com/people/	chromecache_101.1.dr, chromecache_132.1.dr	false		high
https://jqueryui.com	chromecache_115.1.dr, chromecache_119.1.dr	false		high
http://hammerjs.github.io/	chromecache_118.1.dr, chromecache_131.1.dr	false		high
https://pickit.com/terms-privacy/	chromecache_101.1.dr, chromecache_132.1.dr	false		high
https://modernizr.com/download/?-animation-canvas-cssfilters-csstransforms-flexbox-geolocation-prese	chromecache_117.1.dr, chromecache_112.1.dr	false	Avira URL Cloud: safe	unknown

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 19:01:52 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9873758509362602
Encrypted:	false
SSDEEP:	48:8eCdDTHLvjH4idAKZdA1FehwiZUklqehQy+3:8e+LDS/y
MD5:	809CAC7E266449A9B718956E860467A2
SHA1:	5E6B5DABD968D890FEC42A9D8588343F10A803BE
SHA-256:	CB9CBA76714D7843FA7B3FDF009193A3F5B7FF49F07DB61D4B8F8348F813CC6B
SHA-512:	A722D7DDE22712B9F8821085D25D37BAE22996B063CFC84CF1FD31E050E8B06245878BB340CB6E1DB8BF8B203980AE8EE3A81F37837E6C6E500ADC891FB288F6
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......Q.g..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I/Z/.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/Z9.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/Z9.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/Z9............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/Z;............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............W_[.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 21:01:51.366236925 CET	53	52399	1.1.1.1	192.168.2.16
Jan 15, 2025 21:01:51.376456022 CET	53	51758	1.1.1.1	192.168.2.16
Jan 15, 2025 21:01:52.072151899 CET	59841	53	192.168.2.16	1.1.1.1
Jan 15, 2025 21:01:52.072263002 CET	58902	53	192.168.2.16	1.1.1.1
Jan 15, 2025 21:01:52.079447985 CET	53	58902	1.1.1.1	192.168.2.16
Jan 15, 2025 21:01:52.080022097 CET	53	59841	1.1.1.1	192.168.2.16
Jan 15, 2025 21:01:52.389691114 CET	53	65517	1.1.1.1	192.168.2.16
Jan 15, 2025 21:01:53.544572115 CET	50726	53	192.168.2.16	1.1.1.1
Jan 15, 2025 21:01:53.544684887 CET	65154	53	192.168.2.16	1.1.1.1
Jan 15, 2025 21:01:54.526951075 CET	51116	53	192.168.2.16	1.1.1.1
Jan 15, 2025 21:01:54.527142048 CET	49248	53	192.168.2.16	1.1.1.1
Jan 15, 2025 21:01:54.552191973 CET	64252	53	192.168.2.16	1.1.1.1
Jan 15, 2025 21:01:54.552810907 CET	55270	53	192.168.2.16	1.1.1.1
Jan 15, 2025 21:01:55.227381945 CET	56862	53	192.168.2.16	1.1.1.1
Jan 15, 2025 21:01:55.227488995 CET	58302	53	192.168.2.16	1.1.1.1
Jan 15, 2025 21:01:55.238701105 CET	53	56862	1.1.1.1	192.168.2.16
Jan 15, 2025 21:01:55.250121117 CET	53	58302	1.1.1.1	192.168.2.16
Jan 15, 2025 21:01:55.988827944 CET	64478	53	192.168.2.16	1.1.1.1
Jan 15, 2025 21:01:55.988996029 CET	56883	53	192.168.2.16	1.1.1.1
Jan 15, 2025 21:01:55.995786905 CET	53	56883	1.1.1.1	192.168.2.16
Jan 15, 2025 21:01:55.995908976 CET	53	64478	1.1.1.1	192.168.2.16
Jan 15, 2025 21:01:57.802242041 CET	53	49971	1.1.1.1	192.168.2.16
Jan 15, 2025 21:01:59.382487059 CET	54564	53	192.168.2.16	1.1.1.1
Jan 15, 2025 21:01:59.382661104 CET	51494	53	192.168.2.16	1.1.1.1
Jan 15, 2025 21:01:59.402017117 CET	53	51494	1.1.1.1	192.168.2.16
Jan 15, 2025 21:01:59.402427912 CET	53	54564	1.1.1.1	192.168.2.16
Jan 15, 2025 21:02:09.418412924 CET	53	52357	1.1.1.1	192.168.2.16
Jan 15, 2025 21:02:28.505491018 CET	53	51531	1.1.1.1	192.168.2.16
Jan 15, 2025 21:02:48.434681892 CET	138	138	192.168.2.16	192.168.2.255
Jan 15, 2025 21:02:51.087404013 CET	53	56632	1.1.1.1	192.168.2.16
Jan 15, 2025 21:02:51.151705027 CET	53	52153	1.1.1.1	192.168.2.16
Jan 15, 2025 21:02:56.642889977 CET	55347	53	192.168.2.16	1.1.1.1
Jan 15, 2025 21:02:56.643054962 CET	61177	53	192.168.2.16	1.1.1.1
Jan 15, 2025 21:03:21.953660965 CET	53	50113	1.1.1.1	192.168.2.16
Jan 15, 2025 21:03:46.943840027 CET	56082	53	192.168.2.16	1.1.1.1
Jan 15, 2025 21:03:46.944031000 CET	63432	53	192.168.2.16	1.1.1.1
Jan 15, 2025 21:03:46.951525927 CET	53	63432	1.1.1.1	192.168.2.16
Jan 15, 2025 21:03:46.955190897 CET	53	56082	1.1.1.1	192.168.2.16
Jan 15, 2025 21:03:47.982137918 CET	58436	53	192.168.2.16	1.1.1.1
Jan 15, 2025 21:03:47.982359886 CET	53732	53	192.168.2.16	1.1.1.1
Jan 15, 2025 21:03:47.989845037 CET	53	53732	1.1.1.1	192.168.2.16
Jan 15, 2025 21:03:48.004842043 CET	53	58436	1.1.1.1	192.168.2.16

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 15, 2025 21:01:54.731021881 CET	192.168.2.16	1.1.1.1	c281	(Port unreachable)	Destination Unreachable
Jan 15, 2025 21:02:56.696089029 CET	192.168.2.16	1.1.1.1	c281	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2025-01-15 20:01:52 UTC	688	OUT	GET /FmBEL5nr1CkYwv7j?ref=Link HTTP/1.1 Host: sway.cloud.microsoft Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 20:01:53 UTC	1829	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" Set-Cookie: pagerequesttime=deleted; path=/; Max-Age=0; expires=Sat, 1 Jan 2000 00:00:00 UTC; Version=1; Secure Set-Cookie: pagerequesttarget=deleted; path=/; Max-Age=0; expires=Sat, 1 Jan 2000 00:00:00 UTC; Version=1; Secure Set-Cookie: pagerequestoperation=deleted; path=/; Max-Age=0; expires=Sat, 1 Jan 2000 00:00:00 UTC; Version=1; Secure Set-Cookie: AuthSess=aa683351-8f28-4455-8f72-6b5a9df4413e; domain=sway.cloud.microsoft; path=/; samesite=none; secure; HttpOnly Set-Cookie: AADNonce=0d4bb39b-2955-400d-880d-9899a15ac82c.638725681132858415; domain=cloud.microsoft; path=/; samesite=none; secure; HttpOnly Set-Cookie: anonuserid=cd1e1038-c94b-40cb-967d-6743e745a281; expires=Tue, 15-Apr-2025 20:01:53 GMT; path=/; secure X-CorrelationId: e7e36183-ea4d-4f74-b59b-d994748f184b X-UserSessionId: e7e36183-ea4d-4f74-b59b-d994748f184b X-OfficeFE: SwayFrontEnd_IN_18 X-OfficeVersion: 16.0.18508.40101 X-OfficeCluster: eus-000.www.sway.com X-Partitioning-Enabled: true anonuserid: cd1e1038-c94b-40cb-967d-6743e745a281 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=15724800; includeSubDomains; preload Timing-Allow-Origin: * X-RequestId: f8b9ac36-1f65-438e-8c44-45468915f45c X-TrackingId: fee9f444-9b12-4120-ab54-bb9673de3e90 X-Frame-Options: SAMEORIGIN X-Key: /+ONcaKkjH9rNToELrCUBGrxGceAqL3jM+7JoZJ5Fgw=,638725681131608448 X-Robots-Tag: noindex, nofollow X-UA-Compatible: IE=edge X-HTML-Minification-Powered-By: WebMarkupMin X-Powered-By: ARR/3.0 Date: Wed, 15 Jan 2025 20:01:52 GMT Connection: close Content-Length: 42246
2025-01-15 20:01:53 UTC	14555	IN	Data Raw: ef bb bf 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 2d 55 53 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 68 74 74 70 73 3a 2f 2f 77 63 70 73 74 61 74 69 63 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 6d 73 63 63 2f 6c 69 62 2f 76 32 2f 77 63 70 2d 63 6f 6e 73 65 6e 74 2e 6a 73 3e 3c 2f 73 63 72 69 70 74 3e 3c 6e 6f 73 63 72 69 70 74 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 52 65 66 72 65 73 68 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 20 55 52 4c 3d 2f 6e 6f 73 63 72 69 70 74 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 67 6f 6f 67 6c 65 2d 73 69 74 65 2d 76 65 72 69 66 69 63 61 74 69 6f 6e 20 63 6f 6e 74 65 6e 74 3d 58 59 4f 35 35 5a 70 49 70 63 72 4a 48 6e 45 34 73 79 68 36 67 32 71 76 4f 6e 32 53 Data Ascii: <!DOCTYPE html><html lang=en-US><head><script src=https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js></script><noscript><meta http-equiv=Refresh content="0; URL=/noscript"><meta name=google-site-verification content=XYO55ZpIpcrJHnE4syh6g2qvOn2S
2025-01-15 20:01:53 UTC	16384	IN	Data Raw: 75 64 22 2c 22 69 6e 62 6f 78 22 2c 22 6c 61 76 61 62 69 74 22 2c 22 6c 69 76 65 22 2c 22 6d 61 63 22 2c 22 6d 61 69 6c 22 2c 22 6d 65 22 2c 22 6d 69 63 72 6f 73 6f 66 74 22 2c 22 6d 73 6e 22 2c 22 6f 75 74 6c 6f 6f 6b 22 2c 22 70 6f 62 6f 78 22 2c 22 72 6f 63 6b 65 74 6d 61 69 6c 22 2c 22 73 62 63 67 6c 6f 62 61 6c 22 2c 22 76 65 72 69 7a 6f 6e 22 2c 22 79 61 68 6f 6f 22 2c 22 79 61 6e 64 65 78 22 2c 22 79 67 6d 22 2c 22 79 6d 61 69 6c 22 2c 22 7a 6f 68 6f 22 5d 2c 22 53 77 61 79 41 6e 73 77 65 72 73 46 6f 72 75 6d 55 52 4c 22 3a 22 68 74 74 70 73 3a 2f 2f 61 6b 61 2e 6d 73 2f 73 77 61 79 61 6e 73 77 65 72 73 22 2c 22 4f 66 66 69 63 65 44 6f 74 43 6f 6d 48 65 6c 70 55 52 4c 22 3a 22 68 74 74 70 73 3a 2f 2f 61 6b 61 2e 6d 73 2f 73 77 61 79 67 65 74 74 69 Data Ascii: ud","inbox","lavabit","live","mac","mail","me","microsoft","msn","outlook","pobox","rocketmail","sbcglobal","verizon","yahoo","yandex","ygm","ymail","zoho"],"SwayAnswersForumURL":"https://aka.ms/swayanswers","OfficeDotComHelpURL":"https://aka.ms/swaygetti
2025-01-15 20:01:53 UTC	11307	IN	Data Raw: 70 73 3a 2f 2f 6f 66 66 69 63 65 2e 6c 69 76 65 2e 63 6f 6d 2f 73 74 61 72 74 2f 50 65 6f 70 6c 65 2e 61 73 70 78 3f 75 69 3d 65 6e 25 32 44 55 53 26 61 6d 70 3b 72 73 3d 55 53 27 20 73 74 79 6c 65 3d 27 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 64 32 34 37 32 36 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 64 32 34 37 32 36 3b 27 20 74 61 72 67 65 74 3d 27 5f 62 6c 61 6e 6b 27 3e 0d 0a 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 27 63 6c 69 70 31 31 30 78 31 31 30 20 63 69 20 27 3e 3c 69 6d 67 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 73 77 61 79 2e 63 6c 6f 75 64 2e 6d 69 63 72 6f 73 6f 66 74 2f 43 6f 6e 74 65 6e 74 2f 77 61 70 73 77 2e 70 6e 67 3f 62 3d 31 36 30 31 38 35 30 36 31 35 30 31 30 27 20 63 6c 61 73 73 3d 27 77 61 70 73 77 5f 4f 44 Data Ascii: ps://office.live.com/start/People.aspx?ui=en%2DUS&rs=US' style='background-color:#d24726;border-color:#d24726;' target='_blank'><span class='clip110x110 ci '><img src='https://sway.cloud.microsoft/Content/wapsw.png?b=1601850615010' class='wapsw_OD

Timestamp	Bytes transferred	Direction	Data
2025-01-15 20:01:54 UTC	1152	OUT	POST /s/FmBEL5nr1CkYwv7j/get?currentClientVersion=201 HTTP/1.1 Host: sway.cloud.microsoft Connection: keep-alive Content-Length: 163 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-WebClientVersion: 201 X-UserSessionId: e7e36183-ea4d-4f74-b59b-d994748f184b sec-ch-ua-mobile: ?0 X-Key: /+ONcaKkjH9rNToELrCUBGrxGceAqL3jM+7JoZJ5Fgw=,638725681131608448 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-LookupId: FmBEL5nr1CkYwv7j anonuserid: cd1e1038-c94b-40cb-967d-6743e745a281 X-StoryId: 2VfOH0nzECOezET80gbC sec-ch-ua-platform: "Windows" Accept: / Origin: https://sway.cloud.microsoft Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=Link Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AuthSess=aa683351-8f28-4455-8f72-6b5a9df4413e; AADNonce=0d4bb39b-2955-400d-880d-9899a15ac82c.638725681132858415; anonuserid=cd1e1038-c94b-40cb-967d-6743e745a281
2025-01-15 20:01:54 UTC	163	OUT	Data Raw: 63 6c 69 65 6e 74 44 65 76 69 63 65 3d 44 65 73 6b 74 6f 70 26 77 69 64 74 68 3d 31 32 38 30 26 68 65 69 67 68 74 3d 39 30 37 26 69 73 41 63 63 65 73 73 69 62 6c 65 4d 6f 64 65 3d 26 69 6e 45 6d 62 65 64 48 6f 73 74 4d 6f 64 65 3d 26 72 65 74 75 72 6e 50 65 72 66 6f 72 6d 61 6e 63 65 44 65 74 61 69 6c 73 3d 66 61 6c 73 65 26 76 69 65 77 4f 70 74 69 6f 6e 4f 76 65 72 72 69 64 65 73 3d 7b 7d 26 69 73 45 6d 62 65 64 64 65 64 3d 66 61 6c 73 65 26 63 6f 75 6e 74 56 69 65 77 3d 74 72 75 65 Data Ascii: clientDevice=Desktop&width=1280&height=907&isAccessibleMode=&inEmbedHostMode=&returnPerformanceDetails=false&viewOptionOverrides={}&isEmbedded=false&countView=true
2025-01-15 20:01:55 UTC	1163	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Content-Type: application/json Content-Encoding: gzip Expires: -1 P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" Set-Cookie: anonuserid=cd1e1038-c94b-40cb-967d-6743e745a281; expires=Tue, 15-Apr-2025 20:01:55 GMT; path=/; secure X-CorrelationId: 6c8243a3-d3dc-4d2a-a65d-243ebee86687 X-UserSessionId: e7e36183-ea4d-4f74-b59b-d994748f184b X-OfficeFE: SwayFrontEnd_IN_15 X-OfficeVersion: 16.0.18508.40101 X-OfficeCluster: eus-002.www.sway.com X-Partitioning-Enabled: true anonuserid: cd1e1038-c94b-40cb-967d-6743e745a281 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=15724800; includeSubDomains; preload Timing-Allow-Origin: * X-StoryId: 2VfOH0nzECOezET80gbC X-LookupId: FmBEL5nr1CkYwv7j X-RequestId: 0478e8da-fd71-4e83-bea0-4b82526a9608 X-TrackingId: 760115d1-1165-442d-99a7-3661fe13865d X-Frame-Options: SAMEORIGIN X-Server-Time-Elapsed: 234 X-Payload-Size: 10349 X-Powered-By: ARR/3.0 Date: Wed, 15 Jan 2025 20:01:54 GMT Connection: close Content-Length: 9608
2025-01-15 20:01:55 UTC	9608	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 7d 59 93 ea b8 b2 ee 5f a9 e0 3c ec 7b 23 8a 6a 1b 30 c3 7a 39 17 cc 3c cf 43 dd d8 41 18 5b 80 0b 63 53 b6 19 3b d6 7f 3f 92 27 84 6c 06 15 b0 56 f5 3e ab f7 ee e8 42 b6 a4 74 e6 97 a9 54 2a 25 fd 1d ea 98 9a be cf ca d3 69 e8 c7 df a1 95 ae ad 32 c2 cc 08 fd f8 ff 7f 87 64 29 f4 23 54 d3 24 a0 b4 35 cd 0c bd 86 cc fd 0a c0 a2 3a 2c 0a 3b 45 a8 82 81 6a 76 c4 39 58 0a 7d a0 1b b2 a6 86 7e b0 6c ea e7 6b 48 9c cb 8a a4 03 35 a0 b9 48 a7 ba 6c 2d 8e 8d e6 a4 19 08 7b 85 fe 8a 6d a0 4a 40 0f 22 c4 7a 80 93 e9 d1 54 15 f6 da da ec 98 7b 05 94 50 1b 7d 41 95 15 45 48 4f 0c 53 17 44 fb 41 1a 56 b0 fe f0 48 0f 71 ed 6c ad dd eb 6f f7 66 04 3e 1c 68 ba 22 1d 1f 32 b0 28 27 c9 e6 f1 4b e3 af a1 ae 6c 2a 88 a0 ae 26 49 2f 59 cd 30 Data Ascii: }Y_<{#j0z9<CA[cS;?'lV>BtT%i2d)#T$5:,;Ejv9X}~lkH5Hl-{mJ@"zT{P}AEHOSDAVHqlof>h"2('Kl&I/Y0

Timestamp	Bytes transferred	Direction	Data
2025-01-15 20:01:56 UTC	561	OUT	GET /s/FmBEL5nr1CkYwv7j/get?currentClientVersion=201 HTTP/1.1 Host: sway.cloud.microsoft Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AuthSess=aa683351-8f28-4455-8f72-6b5a9df4413e; AADNonce=0d4bb39b-2955-400d-880d-9899a15ac82c.638725681132858415; anonuserid=cd1e1038-c94b-40cb-967d-6743e745a281
2025-01-15 20:01:56 UTC	974	IN	HTTP/1.1 405 Method Not Allowed Cache-Control: private P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" Set-Cookie: anonuserid=cd1e1038-c94b-40cb-967d-6743e745a281; expires=Tue, 15-Apr-2025 20:01:56 GMT; path=/; secure X-CorrelationId: e3434803-926d-4f91-b753-0b7d848b3790 X-UserSessionId: e3434803-926d-4f91-b753-0b7d848b3790 X-OfficeFE: SwayFrontEnd_IN_11 X-OfficeVersion: 16.0.18508.40101 X-OfficeCluster: eus-001.www.sway.com X-Partitioning-Enabled: true anonuserid: cd1e1038-c94b-40cb-967d-6743e745a281 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=15724800; includeSubDomains; preload Timing-Allow-Origin: * X-RequestId: a92d86e0-c04e-4b49-8532-387d5ede2680 X-TrackingId: a5f2badb-ddf8-43bd-acf9-f2aca37dc531 X-Frame-Options: SAMEORIGIN X-Server-Time-Elapsed: 31 X-Powered-By: ARR/3.0 Date: Wed, 15 Jan 2025 20:01:55 GMT Connection: close Content-Length: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-15 20:01:57 UTC	927	OUT	POST /RemoteUls.ashx HTTP/1.1 Host: sway.cloud.microsoft Connection: keep-alive Content-Length: 629 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/json X-UserSessionId: e7e36183-ea4d-4f74-b59b-d994748f184b anonuserid: cd1e1038-c94b-40cb-967d-6743e745a281 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://sway.cloud.microsoft Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=Link Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AuthSess=aa683351-8f28-4455-8f72-6b5a9df4413e; AADNonce=0d4bb39b-2955-400d-880d-9899a15ac82c.638725681132858415; anonuserid=cd1e1038-c94b-40cb-967d-6743e745a281
2025-01-15 20:01:57 UTC	629	OUT	Data Raw: 7b 22 54 22 3a 31 37 33 36 39 37 31 33 31 35 39 32 34 2c 22 4c 22 3a 5b 7b 22 47 22 3a 35 39 36 34 37 37 31 33 34 2c 22 54 22 3a 30 2c 22 4d 22 3a 22 7b 5c 22 55 73 65 72 53 65 73 73 69 6f 6e 49 64 5c 22 3a 5c 22 65 37 65 33 36 31 38 33 2d 65 61 34 64 2d 34 66 37 34 2d 62 35 39 62 2d 64 39 39 34 37 34 38 66 31 38 34 62 5c 22 2c 5c 22 50 75 72 70 6f 73 65 5c 22 3a 5c 22 49 6e 73 74 61 6e 74 69 61 74 65 64 20 55 70 6c 6f 61 64 69 6e 67 55 6c 73 48 6f 73 74 2e 5c 22 2c 5c 22 55 6e 73 75 70 70 6f 72 74 65 64 42 72 6f 77 73 65 72 5c 22 3a 5c 22 66 61 6c 73 65 5c 22 7d 20 5b 41 6e 6f 6e 55 73 65 72 49 64 3d 63 64 31 65 31 30 33 38 2d 63 39 34 62 2d 34 30 63 62 2d 39 36 37 64 2d 36 37 34 33 65 37 34 35 61 32 38 31 5d 22 2c 22 43 22 3a 31 31 30 30 2c 22 44 22 3a Data Ascii: {"T":1736971315924,"L":[{"G":596477134,"T":0,"M":"{\"UserSessionId\":\"e7e36183-ea4d-4f74-b59b-d994748f184b\",\"Purpose\":\"Instantiated UploadingUlsHost.\",\"UnsupportedBrowser\":\"false\"} [AnonUserId=cd1e1038-c94b-40cb-967d-6743e745a281]","C":1100,"D":
2025-01-15 20:01:58 UTC	959	IN	HTTP/1.1 200 OK Cache-Control: private Content-Type: text/plain P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" X-CorrelationId: bdd850ac-ac8b-4394-88ae-4f56b0473e08 X-UserSessionId: e7e36183-ea4d-4f74-b59b-d994748f184b X-OfficeFE: SwayFrontEnd_IN_0 X-OfficeVersion: 16.0.18508.40101 X-OfficeCluster: weu-000.www.sway.com X-Partitioning-Enabled: true anonuserid: cd1e1038-c94b-40cb-967d-6743e745a281 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=15724800; includeSubDomains; preload Timing-Allow-Origin: * X-RequestId: bd568101-0a4e-4f27-807d-4904f60b4b8b X-TrackingId: 0917d402-3230-4765-a59e-1877ee1d36b0 X-bULS-SuppressionETag: N/A X-bULS-SuppressedTags: X-Content-Type-Options: nosniff X-Download-Options: noopen Content-Disposition: attachment X-Powered-By: ARR/3.0 Date: Wed, 15 Jan 2025 20:01:57 GMT Connection: close Content-Length: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-15 20:01:58 UTC	1261	OUT	POST /sway/v1.0/FmBEL5nr1CkYwv7j/analytics?timeSpent=0&scrollDepth=0&readRatioGrade=0 HTTP/1.1 Host: sway.cloud.microsoft Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-WebClientVersion: 201 X-UserSessionId: e7e36183-ea4d-4f74-b59b-d994748f184b sec-ch-ua-mobile: ?0 X-Key: /+ONcaKkjH9rNToELrCUBGrxGceAqL3jM+7JoZJ5Fgw=,638725681131608448 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json; charset=utf-8 X-LookupId: FmBEL5nr1CkYwv7j Accept: application/json, text/javascript, /; q=0.01 X-Requested-With: XMLHttpRequest anonuserid: cd1e1038-c94b-40cb-967d-6743e745a281 X-StoryId: 2VfOH0nzECOezET80gbC sec-ch-ua-platform: "Windows" Origin: https://sway.cloud.microsoft Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=Link Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AuthSess=aa683351-8f28-4455-8f72-6b5a9df4413e; AADNonce=0d4bb39b-2955-400d-880d-9899a15ac82c.638725681132858415; anonuserid=cd1e1038-c94b-40cb-967d-6743e745a281; CDNFailureCount=0
2025-01-15 20:01:59 UTC	1032	IN	HTTP/1.1 202 Accepted Cache-Control: private Content-Type: application/json P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" Set-Cookie: anonuserid=cd1e1038-c94b-40cb-967d-6743e745a281; expires=Tue, 15-Apr-2025 20:01:58 GMT; path=/; secure X-CorrelationId: e35753e8-a896-44b6-9581-a8ccf1da4fbe X-UserSessionId: e7e36183-ea4d-4f74-b59b-d994748f184b X-OfficeFE: SwayFrontEnd_IN_21 X-OfficeVersion: 16.0.18508.40101 X-OfficeCluster: eus-002.www.sway.com X-Partitioning-Enabled: true anonuserid: cd1e1038-c94b-40cb-967d-6743e745a281 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=15724800; includeSubDomains; preload Timing-Allow-Origin: * X-StoryId: 2VfOH0nzECOezET80gbC X-LookupId: FmBEL5nr1CkYwv7j X-RequestId: 5d44d4d5-1a45-4585-a632-c53928c62aa4 X-TrackingId: 644e3a28-4f0e-4452-8539-0471f8005812 X-Frame-Options: SAMEORIGIN X-Powered-By: ARR/3.0 Date: Wed, 15 Jan 2025 20:01:58 GMT Connection: close Content-Length: 2
2025-01-15 20:01:59 UTC	2	IN	Data Raw: 5b 5d Data Ascii: []

Timestamp	Bytes transferred	Direction	Data
2025-01-15 20:01:59 UTC	547	OUT	GET /RemoteUls.ashx HTTP/1.1 Host: sway.cloud.microsoft Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AuthSess=aa683351-8f28-4455-8f72-6b5a9df4413e; AADNonce=0d4bb39b-2955-400d-880d-9899a15ac82c.638725681132858415; anonuserid=cd1e1038-c94b-40cb-967d-6743e745a281; CDNFailureCount=0
2025-01-15 20:01:59 UTC	998	IN	HTTP/1.1 500 Internal Server Error Cache-Control: private Content-Type: text/plain P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" X-CorrelationId: 47ec622a-a1ba-476c-b41d-9fae7a8f1bec X-UserSessionId: 47ec622a-a1ba-476c-b41d-9fae7a8f1bec X-OfficeFE: SwayFrontEnd_IN_5 X-OfficeVersion: 16.0.18508.40101 X-OfficeCluster: weu-000.www.sway.com X-Partitioning-Enabled: true anonuserid: cd1e1038-c94b-40cb-967d-6743e745a281 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=15724800; includeSubDomains; preload Timing-Allow-Origin: * X-RequestId: 9ead5c7a-5838-4c81-a0b6-5a2aaddf4806 X-TrackingId: 15ea3c53-525e-45ac-9de4-6827de07f663 X-bULS-SuppressionETag: N/A X-bULS-SuppressedTags: X-InvalidUlsJson: X-Content-Type-Options: nosniff X-Download-Options: noopen Content-Disposition: attachment X-Powered-By: ARR/3.0 Date: Wed, 15 Jan 2025 20:01:58 GMT Connection: close Content-Length: 0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=Link

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Windows Analysis Report
https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=Link

Timestamp	Bytes transferred	Direction	Data
2025-01-15 20:01:59 UTC	1036	OUT	POST /RemoteUls.ashx HTTP/1.1 Host: sway.cloud.microsoft Connection: keep-alive Content-Length: 11198 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-WebClientVersion: 201 X-UserSessionId: e7e36183-ea4d-4f74-b59b-d994748f184b sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json X-LookupId: FmBEL5nr1CkYwv7j anonuserid: cd1e1038-c94b-40cb-967d-6743e745a281 X-StoryId: 2VfOH0nzECOezET80gbC sec-ch-ua-platform: "Windows" Accept: / Origin: https://sway.cloud.microsoft Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=Link Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AuthSess=aa683351-8f28-4455-8f72-6b5a9df4413e; AADNonce=0d4bb39b-2955-400d-880d-9899a15ac82c.638725681132858415; anonuserid=cd1e1038-c94b-40cb-967d-6743e745a281; CDNFailureCount=0
2025-01-15 20:01:59 UTC	11198	OUT	Data Raw: 7b 22 54 22 3a 31 37 33 36 39 37 31 33 31 35 39 33 35 2c 22 4c 22 3a 5b 7b 22 47 22 3a 35 39 36 34 37 37 33 38 35 2c 22 54 22 3a 32 39 2c 22 4d 22 3a 22 7b 5c 22 54 45 4c 45 4d 5f 44 41 54 41 43 4f 4c 55 4d 4e 53 5c 22 3a 7b 5c 22 45 6c 61 70 73 65 64 54 69 6d 65 5c 22 3a 31 2e 31 30 30 30 30 30 30 30 30 30 30 35 38 32 30 38 2c 5c 22 43 6f 6e 74 61 69 6e 65 72 45 6c 65 6d 65 6e 74 43 6f 75 6e 74 5c 22 3a 30 2c 5c 22 4e 6f 6e 43 6f 6e 74 61 69 6e 65 72 45 6c 65 6d 65 6e 74 43 6f 75 6e 74 5c 22 3a 30 2c 5c 22 43 6c 69 65 6e 74 44 65 76 69 63 65 5c 22 3a 5c 22 44 65 73 6b 74 6f 70 5c 22 2c 5c 22 57 69 64 74 68 5c 22 3a 31 32 38 30 2c 5c 22 48 65 69 67 68 74 5c 22 3a 39 30 37 2c 5c 22 49 73 4e 61 74 69 76 65 43 6c 69 65 6e 74 5c 22 3a 66 61 6c 73 65 2c 5c 22 Data Ascii: {"T":1736971315935,"L":[{"G":596477385,"T":29,"M":"{\"TELEM_DATACOLUMNS\":{\"ElapsedTime\":1.1000000000058208,\"ContainerElementCount\":0,\"NonContainerElementCount\":0,\"ClientDevice\":\"Desktop\",\"Width\":1280,\"Height\":907,\"IsNativeClient\":false,\"
2025-01-15 20:02:00 UTC	1022	IN	HTTP/1.1 200 OK Cache-Control: private Content-Type: text/plain P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" X-CorrelationId: ab29eede-70bd-4017-9f8e-29966116fe19 X-UserSessionId: e7e36183-ea4d-4f74-b59b-d994748f184b X-OfficeFE: SwayFrontEnd_IN_7 X-OfficeVersion: 16.0.18508.40101 X-OfficeCluster: weu-000.www.sway.com X-Partitioning-Enabled: true anonuserid: cd1e1038-c94b-40cb-967d-6743e745a281 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=15724800; includeSubDomains; preload Timing-Allow-Origin: * X-StoryId: 2VfOH0nzECOezET80gbC X-LookupId: FmBEL5nr1CkYwv7j X-RequestId: 2482c61d-bde1-47b6-af77-36cb6e156ede X-TrackingId: ffd93338-7579-45f5-b2af-2571034e5acb X-bULS-SuppressionETag: N/A X-bULS-SuppressedTags: X-Content-Type-Options: nosniff X-Download-Options: noopen Content-Disposition: attachment X-Powered-By: ARR/3.0 Date: Wed, 15 Jan 2025 20:01:59 GMT Connection: close Content-Length: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-15 20:02:00 UTC	571	OUT	GET /Content/times.woff HTTP/1.1 Host: www.sway-cdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://sway.cloud.microsoft sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://sway.cloud.microsoft/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 20:02:00 UTC	527	IN	HTTP/1.1 200 OK Content-Type: application/font-woff Accept-Ranges: bytes P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" X-Partitioning-Enabled: true X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=15724800; includeSubDomains; preload Timing-Allow-Origin: * Access-Control-Allow-Origin: * X-Powered-By: ARR/3.0 Content-Length: 128318 Cache-Control: public, max-age=86400 Date: Wed, 15 Jan 2025 20:02:00 GMT Connection: close
2025-01-15 20:02:00 UTC	15857	IN	Data Raw: 77 4f 46 46 00 01 00 00 00 01 f5 3e 00 15 00 00 00 02 fb 88 00 01 00 00 00 01 f1 e4 00 00 03 5a 00 00 06 ad 00 00 00 00 00 00 00 00 47 44 45 46 00 00 01 d0 00 00 00 3a 00 00 00 44 0d 51 0f 70 47 50 4f 53 00 00 02 0c 00 00 12 40 00 00 20 1c 2e 8a f2 3b 47 53 55 42 00 00 14 4c 00 00 01 02 00 00 01 d2 f0 33 f4 d7 4c 54 53 48 00 00 15 50 00 00 01 a8 00 00 02 05 0e fa 6e cc 4f 53 2f 32 00 00 16 f8 00 00 00 5d 00 00 00 60 72 c3 12 fc 56 44 4d 58 00 00 17 58 00 00 05 1f 00 00 11 94 4e 23 68 82 63 6d 61 70 00 00 1c 78 00 00 03 01 00 00 03 dc f1 31 ce e7 63 76 74 20 00 00 1f 7c 00 00 06 47 00 00 07 e0 02 21 e7 37 66 70 67 6d 00 00 25 c4 00 00 03 bc 00 00 06 6a 73 4a a7 1b 67 61 73 70 00 00 29 80 00 00 00 10 00 00 00 10 00 18 00 09 67 6c 79 66 00 00 29 90 00 01 80 Data Ascii: wOFF>ZGDEF:DQpGPOS@ .;GSUBL3LTSHPnOS/2]`rVDMXXN#hcmapx1cvt \|G!7fpgm%jsJgasp)glyf)
2025-01-15 20:02:00 UTC	16384	IN	Data Raw: d9 7d 1b d6 fd ba b1 9a 43 46 b5 f6 3e 07 eb 65 1f b6 59 27 88 43 6e a4 66 2a 6f 11 56 69 6e 35 dc 21 bc 17 f9 38 c2 b2 14 5c 4f ad a5 d7 da ef 72 d0 4d 7c 9c 65 a8 90 2b ee 62 a9 c0 7c 4c a3 31 b6 1c 0e 44 61 34 6a c4 14 f0 fe 03 4e c0 10 8a 73 c0 a8 87 58 d0 0a d1 97 62 d6 ba 41 a5 52 89 94 ca ee ca 1d 95 a7 2a e9 4a 57 49 07 f8 2d 60 11 2d 01 4b da a2 58 b6 58 76 58 38 8b ab e2 12 d1 39 8f 09 ee e9 32 d3 51 a1 04 83 3f 96 70 d7 60 1f 29 59 5c 92 eb 41 2d 2b b1 48 15 27 c6 97 2a 4f 44 30 7b 3d 3e 0f 62 4d 11 7d 34 22 84 30 82 88 d2 42 20 1b f0 28 ac 89 2e 84 1e 73 60 21 08 ea 70 03 2e 16 c6 2a cb 90 02 6d 06 8a 2b 27 ec 2a d3 31 65 cd e1 ba 0c 24 25 8c 0b d2 c7 81 82 da 7a e7 33 4f 2d 0b 6f 79 f0 de b7 97 dc f6 f6 bd 0b 5e 7e 08 1a bf 5c 36 f4 b6 79 e2 Data Ascii: }CF>eY'CnfoVin5!8\OrM\|e+b\|L1Da4jNsXbARJWI-`-KXXvX892Q?p`)Y\A-+H'OD0{=>bM}4"0B (.s`!p.m+'*1e$%z3O-oy^~\6y
2025-01-15 20:02:00 UTC	2421	IN	Data Raw: ba c6 5c d1 a7 f1 e8 36 db 2e 73 6e 75 5d e2 de e2 15 30 ab d3 08 3a ad 81 77 ac d0 ec 65 ee d3 ec 36 7c 5a ba 3b f0 55 e6 5b ee 23 b6 57 98 df 98 7f 2b 9d 61 fe 2f 6b b3 8e 0a a3 da 31 f2 76 7b 75 df 17 7e 6c 3e 2d 10 29 28 18 ef 62 58 1d f4 1a 0d e9 35 03 ad ba 5e a6 4f 37 18 5a cf ac d7 5d ce 4c 30 7b 6d 7b 3d 0f d9 be a6 fb 9a 38 a3 3d a2 3b 20 fe 88 f9 23 f3 86 e1 8c 68 d7 9e 14 30 12 4e 0a cc 38 a4 d0 76 10 d4 77 40 d0 08 b7 73 76 54 70 3a e0 51 6d d6 b2 75 ab 63 97 63 da f1 ba 83 73 38 7c ff 0a a8 2f 67 4f 12 e1 02 63 b7 07 d5 c1 5a a5 df 5a 86 36 be d4 87 e1 8b 08 3f d3 3a 93 be b2 d9 89 77 3a 77 39 f7 39 59 e7 19 bb 7d 12 26 53 4e 69 99 82 76 9f f6 75 2d 2b 69 15 2d 79 13 ed 01 ed 1b 5a 8d f6 9b 26 07 87 f6 02 5d b1 19 c5 5a 30 01 9e 11 8b 4c 92 Data Ascii: \6.snu]0:we6\|Z;U[#W+a/k1v{u~l>-)(bX5^O7Z]L0{m{=8=; #h0N8vw@svTp:Qmuccs8\|/gOcZZ6?:w:w99Y}&SNivu-+i-yZ&]Z0L
2025-01-15 20:02:00 UTC	16384	IN	Data Raw: 21 0a 3f 3f 0a 57 eb 8c ee ba 24 20 99 df 1f ae 75 bd 37 ea 5d ef d5 23 b4 e7 c9 e0 4c 71 0d 86 77 86 77 11 f1 dc b0 93 74 6d 58 54 91 6a bb d4 e6 87 0a 34 0d 1a 1b d1 18 5f 25 cc fe c4 88 f4 da 48 cd bf a2 8e f5 9c 20 dd 83 f0 d2 34 8c a0 2e f4 0a a3 4c fb 43 98 ee a1 9e c3 2b 57 d6 32 5d 5d 6a 46 f1 b4 b5 69 36 28 e0 36 db af 61 e0 a6 08 c9 e1 06 c1 06 af f7 8e e2 87 92 3a 5d 34 62 a4 7d c3 c8 40 17 30 d2 be 01 6f a6 f6 0d 37 30 01 da 97 c8 99 63 6a 77 8a 46 16 f5 07 d5 26 25 cf fe da 89 ca 09 75 38 a4 d6 2d 3c 53 51 3c 1a 1d 8b 4e 45 f7 47 4f 47 79 39 3a 14 65 14 d8 45 41 90 36 37 17 69 da de a1 a6 d9 82 9a 46 62 34 55 72 1e 6f 91 74 16 db 40 83 31 15 b4 92 2e 92 f0 74 c9 c1 70 8f c1 63 b0 4d 91 57 29 23 d4 60 10 6c 56 71 4a 87 75 65 3a 9c de 4d 47 d5 Data Ascii: !??W$ u7]#LqwwtmXTj4_%H 4.LC+W2]]jFi6(6a:]4b}@0o70cjwF&%u8-<SQ<NEGOGy9:eEA67iFb4Urot@1.tpcMW)#`lVqJue:MG
2025-01-15 20:02:00 UTC	12120	IN	Data Raw: 3d e8 30 9b d6 5d 95 a9 13 e2 b4 3f 33 21 7f 98 fe fe 03 17 44 81 71 c0 ac 81 57 50 3c 4d 63 c1 37 95 da 08 42 72 31 8c 57 0c 26 96 c5 e9 88 00 81 20 fa c8 11 32 9c 18 7c af 04 2d 81 4f 55 97 ca 39 6b 30 13 9d 9a f2 f4 fa 2c 1c 5b 5d 06 9f 50 57 57 c3 ed ef 06 fb 9a e1 4b 73 b3 ba f7 de 35 1a 55 39 4e 07 cf af d8 e3 f1 f7 e0 4d d5 11 09 7c b2 7f fd 98 db a4 31 45 a3 36 7d 48 7f c9 fa fe 5d 81 7e 78 f2 bc 66 18 0a 89 02 46 4d 7c ea 73 f8 59 ce 6a 34 28 59 26 14 32 fb 2f aa da fb 35 42 1f ba b5 da cb f6 92 d8 00 f0 c9 2c 7d 54 0b 49 50 5b 24 3e d2 bc 41 5d 1c 6b 79 ae 05 69 5a a0 93 0b 30 32 ab 0c 8a 35 c4 eb dc 6a 1c 34 41 13 d1 b7 68 ac 92 84 c7 63 95 27 d5 81 00 6a 76 72 46 12 41 62 ba 4f c1 c9 48 90 88 4f 2e 57 f0 6a 92 57 b5 44 13 6c 28 60 5a d1 a1 18 Data Ascii: =0]?3!DqWP<Mc7Br1W& 2\|-OU9k0,[]PWWKs5U9NM\|1E6}H]~xfFM\|sYj4(Y&2/5B,}TIP[$>A]kyiZ025j4Ahc'jvrFAbOHO.WjWDl(`Z
2025-01-15 20:02:00 UTC	16384	IN	Data Raw: f1 0b ae 2e 4a 3f 91 de 00 1e 72 2d f9 62 26 db a3 5c ac 5c a5 dc a2 bc 59 f9 80 52 ac 9c 80 ce c3 81 37 fc 7e a9 9e a5 e4 30 01 13 47 e0 6a 20 05 36 38 e7 80 33 a8 a7 94 0f cb ec 98 f2 1d 92 8a 00 53 2c 11 74 77 79 b6 a5 39 95 4e e7 92 4d 4d cd 04 46 db 92 4b e5 f3 b9 fb 32 59 fc 26 39 23 ca 17 ae 2f 27 ff 52 ca 94 b3 13 70 ce c1 cc 8a 4a 82 44 29 ab d9 94 39 e0 f7 9b c3 09 b9 27 21 4f 6b 26 d0 91 43 66 6b 2b c1 45 a3 44 f3 c4 a4 90 b2 8b cc 27 c4 0f b0 72 42 68 da 4a 47 e5 54 63 ae 9a da ae 40 57 09 45 a5 ea 51 21 54 56 60 0a a7 c7 a5 84 15 d2 0b 6d 14 fc 4e 44 ff 3d b9 95 4c d3 da d9 cd cc 4e 7d 39 82 9b f4 8b 7b be 96 02 6f bc 52 20 bf a2 1b d7 6f a9 3e 81 5b 7c 0b 6e f1 35 a4 6d 1f fa 3a 7a 3c 77 05 12 c8 f1 97 fe d9 2d 4f ba ba 17 00 e6 79 2c 73 e5 Data Ascii: .J?r-b&\\YR7~0Gj 683S,twy9NMMFK2Y&9#/'RpJD)9'!Ok&Cfk+ED'rBhJGTc@WEQ!TV`mND=LN}9{oR o>[\|n5m:z<w-Oy,s
2025-01-15 20:02:00 UTC	16384	IN	Data Raw: 9a ea 5a 1a 3b 72 1d 75 6b 72 6b ea fa 72 7d 75 3b c3 3b c5 f3 a2 97 86 0f 45 9f 32 f2 fe 7a af 2b 2c 56 d5 7b 2b c2 62 a6 a6 22 11 08 76 54 d7 d7 57 38 72 4e bd 64 10 0a 7a 3d cf 73 09 ac c1 41 c4 e5 84 85 61 54 25 e5 f7 45 8e 47 60 24 52 e5 74 38 3a 89 99 64 b1 ee 82 3c e8 03 c7 89 33 ed 0f 04 aa ab 33 22 f3 7a 15 90 aa 7a ab 86 aa 50 55 55 63 83 12 20 1b df 33 dd 14 23 d5 ad 2c 5a b7 02 9f 2a c6 c9 52 4a 9b 7f 82 00 2a 6e 14 10 a6 71 f1 09 b7 d5 e2 06 45 b8 0f b4 9b a9 39 4a 72 91 74 c3 58 4b d9 c8 08 ba 51 de ff e2 b7 e7 74 15 62 c1 8a aa e8 f2 73 da f6 b2 be c5 4b 7d 0b 7e fc ca f9 07 7f f6 5f f2 a2 95 73 fc 27 0a e1 0b ef 7b e0 0e 0e ca fb 47 bf 27 df d7 91 8d d5 05 b0 e4 04 5f 03 3e 8a 06 02 e2 cc 01 f9 50 db b7 b7 9e f3 f8 92 18 8c 4c db 01 ae 19 Data Ascii: Z;rukrkr}u;;E2z+,V{+b"vTW8rNdz=sAaT%EG`$Rt8:d<33"zzPUUc 3#,ZRJnqE9JrtXKQtbsK}~_s'{G'_>PL
2025-01-15 20:02:00 UTC	7952	IN	Data Raw: 8f c6 9e 71 3e 13 7b d1 f9 62 8c 85 9e f4 18 15 aa 29 a5 f1 b5 06 a3 11 9f e9 59 b3 5e cf 42 8b 15 9f 49 05 e5 56 8e c3 67 76 9b d9 6e b7 19 1f 37 8c 51 fd c7 d8 1d e8 80 7c e1 29 76 87 5e fe b8 02 5d 52 ee 40 07 f0 92 72 87 8a 7a 9c 44 97 c0 0e 74 00 2f 81 1d 04 f7 b8 15 5d b2 ed 40 07 e4 0b 35 c1 b6 c3 0e 29 e9 82 8c e1 51 a9 34 f0 5b 78 64 7a bd 06 7e be 07 7e 8e 0b fe 7a 64 9d 3a f2 0e 22 4c b5 13 7e f8 6b 26 44 2a 44 68 a8 e5 84 19 fe 7a d0 57 72 69 e6 89 2f bb 5e f6 84 d1 17 54 a5 64 69 28 34 fb 3c fb fc e8 d4 a8 37 83 6d e6 23 e6 67 cd 6f 99 69 b3 3d 7e f1 9a 06 66 dd e2 89 77 de 19 98 60 cf 9e 3d 4b a4 26 ce 9d 43 47 bf 03 68 b0 25 b2 29 b1 61 f9 cf 8f d8 33 13 13 c4 99 33 13 ff cd 01 42 1d 6c 9a b3 1f 73 8f 18 03 fa 4e a0 68 95 a3 0e 43 ab 3c 84 Data Ascii: q>{b)Y^BIVgvn7Q\|)v^]R@rzDt/]@5)Q4[xdz~~zd:"L~k&D*DhzWri/^Tdi(4<7m#goi=~fw`=K&CGh%)a33BlsNhC<
2025-01-15 20:02:00 UTC	16384	IN	Data Raw: 17 be 3a 3a 38 40 0e 5e a9 75 de 7b 54 b9 ae 9e 3d b1 f6 c3 4f 18 17 b7 1f a0 be c4 ab 3f 3c 10 73 d3 e3 64 fd d4 03 bf ae bf fb 39 a4 d3 1b 73 a9 89 79 40 37 93 bf 36 ea 81 07 90 6e 86 ab 41 3e aa 50 bd d4 15 d4 5d d4 e7 28 d9 3e fa 41 9a 5c c8 ad e5 c8 97 39 e0 e1 80 d5 1e b2 ef b0 53 5b dc 3b dc 64 d0 73 83 87 74 b6 a5 a0 b9 06 88 4e 7d c2 93 48 25 28 45 42 08 a4 4f 76 82 4e a2 c0 16 86 0a e3 85 93 05 99 86 2a 98 8d 4e 13 64 96 a7 2c 4e f3 fc da 3c dc cd 04 d9 63 1e 31 bf ad ad 96 2e 67 92 71 67 a2 46 24 21 0b 26 93 9a ff af ad 2b 81 6e e3 ac f3 f3 7d 33 1a 49 b6 8e d1 7d 4b d6 48 23 c9 d6 65 8f 2e cb 87 2e db f2 2d 3b 8a 2d 3b 34 72 12 48 d2 26 34 b4 0e 24 29 84 1c 0d e4 39 6d 29 1b 78 69 69 f3 a0 cd 12 96 d2 d2 42 a1 a5 0d ed 52 4c 30 21 b0 b1 29 4b Data Ascii: ::8@^u{T=O?<sd9sy@76nA>P](>A\9S[;dstN}H%(EBOvN*Nd,N<c1.gqgF$!&+n}3I}KH#e..-;-;4rH&4$)9m)xiiBRL0!)K
2025-01-15 20:02:00 UTC	8048	IN	Data Raw: dc 51 4b 74 ec 11 9c c5 db 92 ff 0f 4b de fc 4b be 35 4b de fc 4b de 54 4b f8 f9 1a ae a9 d9 e0 df 6f c9 57 60 19 0f df c0 70 77 55 c8 64 0b ce 2b 87 bd ab d8 f3 0a f9 7c 09 43 bd 15 bd 55 dc c7 0a f5 06 9b 0d 32 a9 fc df c3 3d 2c 57 ec d2 8a b5 ac e8 61 05 0f 8f e0 aa 72 4d 86 0e ac d8 e1 aa bd ad 7a c7 56 8d 5e f5 cd ad 6a 59 b5 b7 55 7b 5b b5 03 55 63 ad b2 a7 7d 30 13 a8 87 55 e3 ae 3a ab ab 46 5f 75 f6 56 3d 9b ab f1 8a 9a aa ac a9 09 d1 57 9d 90 9a f7 76 cd 7b bb c6 4d 18 34 8d 32 bc 47 35 27 b3 e6 9e d6 88 32 04 e7 95 17 64 99 b7 b8 e6 14 d5 dc e5 9a 7d ae 39 4b 6b 4e f2 9a 99 ac 39 2d 6b ac 7e 0b 37 d2 4f 61 88 be ae ff 75 fc 97 61 d8 c7 75 f7 71 1d 6f 41 53 65 5f d6 9d f3 75 3b bf ee df e0 3a 1e b8 01 99 87 20 87 dd fc d0 aa ef fa d6 df 65 f5 68 Data Ascii: QKtKK5KKTKoW`pwUd+\|CU2=,WarMzV^jYU{[Uc}0U:F_uV=Wv{M42G5'2d}9KkN9-k~7OauauqoASe_u;: eh

Timestamp	Bytes transferred	Direction	Data
2025-01-15 20:02:00 UTC	574	OUT	GET /Content/ModernMT.woff HTTP/1.1 Host: www.sway-cdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://sway.cloud.microsoft sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://sway.cloud.microsoft/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 20:02:00 UTC	526	IN	HTTP/1.1 200 OK Content-Type: application/font-woff Accept-Ranges: bytes P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" X-Partitioning-Enabled: true X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=15724800; includeSubDomains; preload Timing-Allow-Origin: * Access-Control-Allow-Origin: * X-Powered-By: ARR/3.0 Content-Length: 56984 Cache-Control: public, max-age=86400 Date: Wed, 15 Jan 2025 20:02:00 GMT Connection: close
2025-01-15 20:02:00 UTC	15858	IN	Data Raw: 77 4f 46 46 00 01 00 00 00 00 de 98 00 12 00 00 00 01 ac f4 00 01 19 9a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 44 53 49 47 00 00 96 2c 00 00 13 0d 00 00 1c a0 fe 74 f0 d4 47 44 45 46 00 00 a9 3c 00 00 00 56 00 00 00 62 1b 11 1d 2d 47 50 4f 53 00 00 a9 94 00 00 31 8f 00 00 7b 20 9b 4a 48 95 47 53 55 42 00 00 db 24 00 00 03 71 00 00 08 14 f1 bd e4 7f 4f 53 2f 32 00 00 02 10 00 00 00 5d 00 00 00 60 b5 8e d3 63 63 6d 61 70 00 00 07 50 00 00 05 ee 00 00 07 ce 7f 94 8c 63 63 76 74 20 00 00 0d 5c 00 00 00 02 00 00 00 02 00 00 00 00 66 70 67 6d 00 00 0d 40 00 00 00 07 00 00 00 07 b0 21 59 b0 67 61 73 70 00 00 96 20 00 00 00 0c 00 00 00 0c 00 08 00 1b 67 6c 79 66 00 00 12 bc 00 00 80 c5 00 00 eb 96 12 43 da e9 68 65 61 64 00 00 01 94 00 00 00 Data Ascii: wOFFDSIG,tGDEF<Vb-GPOS1{ JHGSUB$qOS/2]`ccmapPccvt \fpgm@!Ygasp glyfChead
2025-01-15 20:02:00 UTC	8718	IN	Data Raw: 10 2b b5 f3 a3 a3 ac ce 52 70 ce 5b aa 39 ae 9e dc f7 37 b5 3e 38 27 63 63 e5 d9 d3 9f 6b ee 18 f0 15 73 44 7a 44 e7 9c 21 66 5e 08 07 9c 97 7a 74 db 61 19 ca f3 4c c0 0a 91 3b a0 20 07 87 56 97 31 d8 b4 4c b6 ab cb 72 85 04 21 3a d0 0e 2e 24 1e 12 44 d1 b9 a9 16 19 9d 0a c9 71 99 e1 64 06 9a 43 7d 65 bd 27 74 ae 73 19 b6 47 53 26 f3 b3 36 9b b7 c6 a0 36 6a 74 b6 de 64 63 ab 5a 65 d7 79 dd 56 6f 8d 2a 59 57 57 f4 77 96 ac 5d e9 06 7b 8c b8 4d ab 91 6a d4 6a a3 4d e7 4f 37 d4 ff 0b 65 e9 cc e4 a2 99 ba 60 7d 30 e1 b1 87 3c 94 ac b0 a9 a1 ae bb e4 47 b8 fc a0 0d 7a db 9f 12 90 28 8b af 5d 25 0b ca 97 e4 7d a8 3f 14 ea 6f 68 e8 0f 85 fb 23 39 b7 22 10 80 b6 3d 03 da 62 e3 89 f4 64 3c 36 91 4c ad 89 6b e7 ba f2 5d f5 6b 87 47 47 b9 4e 90 50 67 c4 b8 13 24 ee Data Ascii: +Rp[97>8'ccksDzD!f^ztaL; V1Lr!:.$DqdC}e'tsGS&66jtdcZeyVo*YWWw]{MjjMO7e`}0<Gz(]%}?oh#9"=bd<6Lk]kGGNPg$
2025-01-15 20:02:00 UTC	16384	IN	Data Raw: ab f8 f6 7d bf e1 3b c3 61 ea 8b f8 db f7 a2 18 9c a7 f7 f1 f4 23 ec db 47 aa bf 0f 9f d2 85 a8 78 5f c0 d4 1f b3 4f 61 de 8e 86 65 84 e9 af 30 74 60 c6 74 1c 09 62 fa 53 ec f7 1f 13 f0 6f 0f c2 f4 a7 59 3a d3 e3 15 fb b0 98 fe 6f 2c fd 5f 98 ae 59 ac 37 26 66 fb 05 72 f6 5c 0c 7e 82 df 3e f4 ee d2 df 6a ae 25 7e 2c d8 5a 75 ea 5e 71 6d 0d 5f 6e 47 93 85 bc 61 ee 63 89 60 29 8c bb 46 e9 cb ed 75 e0 ff d2 e8 4f 92 b2 b7 8c 68 62 fc 16 49 6f 57 5f 3a e8 b0 b8 73 0a a9 3e ec 2e 6e 9b 6c f3 99 d6 3d 9e 51 1b b7 d8 23 ad b5 e6 e6 54 ab 3b d6 e4 8a 4d a4 24 1a d7 fe ba f0 ac d4 b4 2e aa e8 1e b5 fb 02 85 01 8b eb 16 f3 fa 6b 3b 8b dd 61 95 37 a6 b3 1a 9a 76 3a b6 9a e7 5f b1 78 1b 27 76 b7 c8 fa 1a 43 8d 2e 4a 13 15 03 e8 de 79 ac dd 3b d6 a5 dd d7 7c d7 2f 4b Data Ascii: };a#Gx_Oae0t`tbSoY:o,_Y7&fr\~>j%~,Zu^qm_nGac`)FuOhbIoW_:s>.nl=Q#T;M$.k;a7v:_x'vC.Jy;\|/K
2025-01-15 20:02:00 UTC	8192	IN	Data Raw: 9e 4d 8a 90 17 9d c9 ff 32 b4 92 0b c7 bc 53 e8 1a a0 71 f6 d0 d6 fb be 6f cb 92 6d 56 50 b3 ce 09 45 08 71 4f 1b 18 ae de 70 be 50 3d f3 3a 31 50 30 3d f6 a0 75 e2 87 7c bf 0f fe 38 5e 83 52 f7 b3 4b 2c c2 fc c6 57 da 6f 35 71 4f 0b bc 3b ac 33 5e 25 f2 a8 fc 0d 21 1c c2 da 0b 08 6b b7 e7 b0 96 9c f1 d8 2e 61 15 a5 23 bb 47 b8 01 65 7a 23 97 73 ca d0 10 d6 52 fe 2d f7 f3 5d ee df dd cf 0f 72 ff 85 3d 9b 97 ac db 6a 4b 9c a1 11 d4 5c 08 91 ed 8d 38 b6 58 86 c0 18 67 ba 80 22 c8 a9 99 e0 16 50 14 fb e3 00 25 80 d8 ec 7e 50 d0 09 6a 16 4f 08 83 68 41 a7 d3 e6 b7 7e 3c a2 dc 5e e4 e0 18 6a 34 56 1e c8 b2 ef 44 4c dc 89 1c 4d a6 27 50 88 18 3b 28 40 59 bd b2 c9 35 57 8e fc 87 f2 df 52 e3 1e c3 17 de 56 ec 86 df b7 38 ec 94 e5 aa b8 3c 4a 74 59 f5 e8 e7 a7 99 Data Ascii: M2SqomVPEqOpP=:1P0=u\|8^RK,Wo5qO;3^%!k.a#Gez#sR-]r=jK\8Xg"P%~PjOhA~<^j4VDLM'P;(@Y5WRV8<JtY
2025-01-15 20:02:00 UTC	7832	IN	Data Raw: de 5a 2e 59 77 36 38 3a e0 7c 7e c4 3e 16 9e 92 d7 e9 48 72 fa 76 7d b9 60 1f 2f 17 ed d3 e5 2e 8b dc ec 33 e0 59 78 1b f4 6e 34 78 23 9e 30 11 ea ec 22 d7 3a ee 3c 54 ce db 27 48 3f 0b ef b9 f0 7d 69 27 1a f2 50 b9 dd b2 6e e3 9e ab c5 dd cf 51 4b 81 3c 79 fb bc 4e 3c 14 89 1e 6e 85 b3 96 d9 f5 21 3e 1f 25 d7 e3 2a 51 b0 4f 81 a7 01 6b 08 4a 17 28 5d 0c 4b 17 54 3a 38 9d 9c f5 4e 70 bf 1d 50 cf ef 26 c7 fa b0 86 a7 cb dd 61 ef 7d 57 aa f7 54 ec 68 9d b7 ea 26 82 71 25 d6 32 e7 b3 ba b6 eb f8 0c c6 ed da f5 29 dd 49 e9 4e 4a 67 69 d7 d5 90 af 3c c7 48 0d 5d 1a e5 3c 62 00 f5 9f 3a ee 66 54 ee 54 c6 63 e5 6e f2 76 61 27 cc 17 8c aa 93 d1 74 ab 1f cf 52 db 73 7c 06 63 ef 26 72 b8 95 1c 41 1f 8a f6 e7 d4 f1 90 7a 9f af 90 7d 9e 52 79 27 7b 4a 39 f9 77 b8 11 Data Ascii: Z.Yw68:\|~>Hrv}`/.3Yxn4x#0":<T'H?}i'PnQK<yN<n!>%*QOkJ(]KT:8NpP&a}WTh&q%2)INJgi<H]<b:fTTcnva'tRs\|c&rAz}Ry'{J9w

Timestamp	Bytes transferred	Direction	Data
2025-01-15 20:02:00 UTC	547	OUT	GET /RemoteUls.ashx HTTP/1.1 Host: sway.cloud.microsoft Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AuthSess=aa683351-8f28-4455-8f72-6b5a9df4413e; AADNonce=0d4bb39b-2955-400d-880d-9899a15ac82c.638725681132858415; anonuserid=cd1e1038-c94b-40cb-967d-6743e745a281; CDNFailureCount=0
2025-01-15 20:02:01 UTC	998	IN	HTTP/1.1 500 Internal Server Error Cache-Control: private Content-Type: text/plain P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" X-CorrelationId: 35e71c1f-d9b0-4163-9e9b-52005c85a44e X-UserSessionId: 35e71c1f-d9b0-4163-9e9b-52005c85a44e X-OfficeFE: SwayFrontEnd_IN_1 X-OfficeVersion: 16.0.18508.40101 X-OfficeCluster: weu-001.www.sway.com X-Partitioning-Enabled: true anonuserid: cd1e1038-c94b-40cb-967d-6743e745a281 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=15724800; includeSubDomains; preload Timing-Allow-Origin: * X-RequestId: 5e6495ba-e08d-4a95-a83e-bf4e811b00ae X-TrackingId: 85e88c53-03a6-4a64-8ec5-def73f22c3e2 X-bULS-SuppressionETag: N/A X-bULS-SuppressedTags: X-InvalidUlsJson: X-Content-Type-Options: nosniff X-Download-Options: noopen Content-Disposition: attachment X-Powered-By: ARR/3.0 Date: Wed, 15 Jan 2025 20:02:00 GMT Connection: close Content-Length: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-15 20:02:01 UTC	568	OUT	GET /webappmanifest.json HTTP/1.1 Host: sway.cloud.microsoft Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: manifest Referer: https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=Link Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 20:02:02 UTC	835	IN	HTTP/1.1 200 OK Cache-Control: private, max-age=86400 Content-Type: application/json P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" X-CorrelationId: e8a2be1b-7379-49bd-a19f-1692d4ca3efd X-UserSessionId: e8a2be1b-7379-49bd-a19f-1692d4ca3efd X-OfficeFE: SwayFrontEnd_IN_0 X-OfficeVersion: 16.0.18508.40101 X-OfficeCluster: weu-000.www.sway.com X-Partitioning-Enabled: true anonuserid: 1131d085-4c5a-4d26-89ef-b108abd2dc91 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=15724800; includeSubDomains; preload Timing-Allow-Origin: * X-RequestId: 7dfe8664-1187-401b-9d2b-97d13c9b66b7 X-TrackingId: bc6496c2-071d-4789-b46e-a9e217cdda25 X-Powered-By: ARR/3.0 Date: Wed, 15 Jan 2025 20:02:02 GMT Connection: close Content-Length: 1191
2025-01-15 20:02:02 UTC	1191	IN	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 53 77 61 79 22 2c 22 73 68 6f 72 74 5f 6e 61 6d 65 22 3a 22 53 77 61 79 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 43 72 65 61 74 65 20 61 6e 64 20 73 68 61 72 65 20 69 6e 74 65 72 61 63 74 69 76 65 20 72 65 70 6f 72 74 73 2c 20 70 72 65 73 65 6e 74 61 74 69 6f 6e 73 2c 20 70 65 72 73 6f 6e 61 6c 20 73 74 6f 72 69 65 73 2c 20 61 6e 64 20 6d 6f 72 65 2e 20 53 77 61 79 20 69 73 20 61 6e 20 65 61 73 79 2d 74 6f 2d 75 73 65 20 64 69 67 69 74 61 6c 20 73 74 6f 72 79 74 65 6c 6c 69 6e 67 20 61 70 70 20 66 6f 72 20 63 72 65 61 74 69 6e 67 20 69 6e 74 65 72 61 63 74 69 76 65 20 72 65 70 6f 72 74 73 2c 20 70 72 65 73 65 6e 74 61 74 69 6f 6e 73 2c 20 70 65 72 73 6f 6e 61 6c 20 73 74 6f 72 69 65 73 20 61 6e 64 20 6d 6f 72 65 2e 20 Data Ascii: {"name":"Sway","short_name":"Sway","description":"Create and share interactive reports, presentations, personal stories, and more. Sway is an easy-to-use digital storytelling app for creating interactive reports, presentations, personal stories and more.

Timestamp	Bytes transferred	Direction	Data
2025-01-15 20:02:47 UTC	1035	OUT	POST /RemoteUls.ashx HTTP/1.1 Host: sway.cloud.microsoft Connection: keep-alive Content-Length: 2120 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-WebClientVersion: 201 X-UserSessionId: e7e36183-ea4d-4f74-b59b-d994748f184b sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json X-LookupId: FmBEL5nr1CkYwv7j anonuserid: cd1e1038-c94b-40cb-967d-6743e745a281 X-StoryId: 2VfOH0nzECOezET80gbC sec-ch-ua-platform: "Windows" Accept: / Origin: https://sway.cloud.microsoft Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=Link Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AuthSess=aa683351-8f28-4455-8f72-6b5a9df4413e; AADNonce=0d4bb39b-2955-400d-880d-9899a15ac82c.638725681132858415; anonuserid=cd1e1038-c94b-40cb-967d-6743e745a281; CDNFailureCount=0
2025-01-15 20:02:47 UTC	2120	OUT	Data Raw: 7b 22 54 22 3a 31 37 33 36 39 37 31 33 31 37 39 34 37 2c 22 4c 22 3a 5b 7b 22 47 22 3a 33 37 38 31 38 34 37 2c 22 54 22 3a 34 34 2c 22 4d 22 3a 22 7b 5c 22 52 65 71 75 65 73 74 20 49 44 5c 22 3a 5c 22 31 5c 22 2c 5c 22 55 52 4c 5c 22 3a 5c 22 2f 73 77 61 79 2f 76 31 2e 30 2f 46 6d 42 45 4c 35 6e 72 31 43 6b 59 77 76 37 6a 2f 61 6e 61 6c 79 74 69 63 73 5c 22 2c 5c 22 52 65 73 70 6f 6e 73 65 20 74 69 6d 65 5c 22 3a 5c 22 32 30 3a 30 31 3a 35 37 2e 39 39 31 5c 22 2c 5c 22 43 6f 6e 74 65 6e 74 20 74 79 70 65 5c 22 3a 5c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 5c 22 2c 5c 22 53 74 61 74 75 73 20 63 6f 64 65 5c 22 3a 5c 22 32 30 32 5c 22 2c 5c 22 53 74 61 74 75 73 20 74 65 78 74 5c 22 3a 5c 22 41 63 63 65 70 74 65 64 5c 22 2c 5c 22 43 6f 72 72 65 6c Data Ascii: {"T":1736971317947,"L":[{"G":3781847,"T":44,"M":"{\"Request ID\":\"1\",\"URL\":\"/sway/v1.0/FmBEL5nr1CkYwv7j/analytics\",\"Response time\":\"20:01:57.991\",\"Content type\":\"application/json\",\"Status code\":\"202\",\"Status text\":\"Accepted\",\"Correl
2025-01-15 20:02:48 UTC	1022	IN	HTTP/1.1 200 OK Cache-Control: private Content-Type: text/plain P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" X-CorrelationId: 92bdff5f-327b-4ad7-853d-70f800720c90 X-UserSessionId: e7e36183-ea4d-4f74-b59b-d994748f184b X-OfficeFE: SwayFrontEnd_IN_0 X-OfficeVersion: 16.0.18508.40101 X-OfficeCluster: weu-001.www.sway.com X-Partitioning-Enabled: true anonuserid: cd1e1038-c94b-40cb-967d-6743e745a281 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=15724800; includeSubDomains; preload Timing-Allow-Origin: * X-StoryId: 2VfOH0nzECOezET80gbC X-LookupId: FmBEL5nr1CkYwv7j X-RequestId: 87abd3a4-baa5-4239-a8b5-18e788727fb9 X-TrackingId: d60fe41e-7e2b-478a-abae-69ada55dfa85 X-bULS-SuppressionETag: N/A X-bULS-SuppressedTags: X-Content-Type-Options: nosniff X-Download-Options: noopen Content-Disposition: attachment X-Powered-By: ARR/3.0 Date: Wed, 15 Jan 2025 20:02:48 GMT Connection: close Content-Length: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-15 20:02:49 UTC	547	OUT	GET /RemoteUls.ashx HTTP/1.1 Host: sway.cloud.microsoft Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AuthSess=aa683351-8f28-4455-8f72-6b5a9df4413e; AADNonce=0d4bb39b-2955-400d-880d-9899a15ac82c.638725681132858415; anonuserid=cd1e1038-c94b-40cb-967d-6743e745a281; CDNFailureCount=0
2025-01-15 20:02:49 UTC	998	IN	HTTP/1.1 500 Internal Server Error Cache-Control: private Content-Type: text/plain P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" X-CorrelationId: 42d405b9-84b1-4c07-bed0-e324519d3a23 X-UserSessionId: 42d405b9-84b1-4c07-bed0-e324519d3a23 X-OfficeFE: SwayFrontEnd_IN_7 X-OfficeVersion: 16.0.18508.40101 X-OfficeCluster: weu-001.www.sway.com X-Partitioning-Enabled: true anonuserid: cd1e1038-c94b-40cb-967d-6743e745a281 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=15724800; includeSubDomains; preload Timing-Allow-Origin: * X-RequestId: 7592e4cb-5e97-4570-a590-487191263523 X-TrackingId: cdf2cd97-aa5a-47f0-9195-dac3f198c1e0 X-bULS-SuppressionETag: N/A X-bULS-SuppressedTags: X-InvalidUlsJson: X-Content-Type-Options: nosniff X-Download-Options: noopen Content-Disposition: attachment X-Powered-By: ARR/3.0 Date: Wed, 15 Jan 2025 20:02:48 GMT Connection: close Content-Length: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-15 20:03:47 UTC	1035	OUT	POST /RemoteUls.ashx HTTP/1.1 Host: sway.cloud.microsoft Connection: keep-alive Content-Length: 6581 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-WebClientVersion: 201 X-UserSessionId: e7e36183-ea4d-4f74-b59b-d994748f184b sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json X-LookupId: FmBEL5nr1CkYwv7j anonuserid: cd1e1038-c94b-40cb-967d-6743e745a281 X-StoryId: 2VfOH0nzECOezET80gbC sec-ch-ua-platform: "Windows" Accept: / Origin: https://sway.cloud.microsoft Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://sway.cloud.microsoft/FmBEL5nr1CkYwv7j?ref=Link Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AuthSess=aa683351-8f28-4455-8f72-6b5a9df4413e; AADNonce=0d4bb39b-2955-400d-880d-9899a15ac82c.638725681132858415; anonuserid=cd1e1038-c94b-40cb-967d-6743e745a281; CDNFailureCount=0
2025-01-15 20:03:47 UTC	6581	OUT	Data Raw: 7b 22 54 22 3a 31 37 33 36 39 37 31 33 36 35 38 32 35 2c 22 4c 22 3a 5b 7b 22 47 22 3a 35 39 36 34 37 36 31 36 37 2c 22 54 22 3a 35 32 2c 22 4d 22 3a 22 7b 5c 22 54 79 70 65 5c 22 3a 5c 22 63 6c 69 63 6b 5c 22 2c 5c 22 58 5c 22 3a 5c 22 31 31 36 32 5c 22 2c 5c 22 59 5c 22 3a 5c 22 33 34 34 5c 22 2c 5c 22 55 73 65 72 20 49 64 5c 22 3a 5c 22 63 64 31 65 31 30 33 38 2d 63 39 34 62 2d 34 30 63 62 2d 39 36 37 64 2d 36 37 34 33 65 37 34 35 61 32 38 31 5c 22 2c 5c 22 53 74 6f 72 79 20 49 64 5c 22 3a 5c 22 32 56 66 4f 48 30 6e 7a 45 43 4f 65 7a 45 54 38 30 67 62 43 5c 22 2c 5c 22 50 75 72 70 6f 73 65 5c 22 3a 5c 22 55 73 65 72 20 41 63 74 69 6f 6e 3a 20 4d 6f 75 73 65 20 65 76 65 6e 74 5c 22 2c 5c 22 55 6e 73 75 70 70 6f 72 74 65 64 42 72 6f 77 73 65 72 5c 22 3a Data Ascii: {"T":1736971365825,"L":[{"G":596476167,"T":52,"M":"{\"Type\":\"click\",\"X\":\"1162\",\"Y\":\"344\",\"User Id\":\"cd1e1038-c94b-40cb-967d-6743e745a281\",\"Story Id\":\"2VfOH0nzECOezET80gbC\",\"Purpose\":\"User Action: Mouse event\",\"UnsupportedBrowser\":
2025-01-15 20:03:47 UTC	1022	IN	HTTP/1.1 200 OK Cache-Control: private Content-Type: text/plain P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" X-CorrelationId: 35b13fe5-725c-4bb6-9bea-f7757f561fa6 X-UserSessionId: e7e36183-ea4d-4f74-b59b-d994748f184b X-OfficeFE: SwayFrontEnd_IN_2 X-OfficeVersion: 16.0.18508.40101 X-OfficeCluster: weu-001.www.sway.com X-Partitioning-Enabled: true anonuserid: cd1e1038-c94b-40cb-967d-6743e745a281 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=15724800; includeSubDomains; preload Timing-Allow-Origin: * X-StoryId: 2VfOH0nzECOezET80gbC X-LookupId: FmBEL5nr1CkYwv7j X-RequestId: 11a6b2b2-4553-4f43-8d19-07cd835f4471 X-TrackingId: 0f9b60bf-7c39-4d08-af38-74993179c310 X-bULS-SuppressionETag: N/A X-bULS-SuppressedTags: X-Content-Type-Options: nosniff X-Download-Options: noopen Content-Disposition: attachment X-Powered-By: ARR/3.0 Date: Wed, 15 Jan 2025 20:03:47 GMT Connection: close Content-Length: 0

Timestamp	Bytes transferred	Direction	Data
2025-01-15 20:03:48 UTC	547	OUT	GET /RemoteUls.ashx HTTP/1.1 Host: sway.cloud.microsoft Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: AuthSess=aa683351-8f28-4455-8f72-6b5a9df4413e; AADNonce=0d4bb39b-2955-400d-880d-9899a15ac82c.638725681132858415; anonuserid=cd1e1038-c94b-40cb-967d-6743e745a281; CDNFailureCount=0
2025-01-15 20:03:49 UTC	998	IN	HTTP/1.1 500 Internal Server Error Cache-Control: private Content-Type: text/plain P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" X-CorrelationId: 5540accb-0fb3-43d3-963e-2367d5be0e66 X-UserSessionId: 5540accb-0fb3-43d3-963e-2367d5be0e66 X-OfficeFE: SwayFrontEnd_IN_1 X-OfficeVersion: 16.0.18508.40101 X-OfficeCluster: weu-000.www.sway.com X-Partitioning-Enabled: true anonuserid: cd1e1038-c94b-40cb-967d-6743e745a281 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=15724800; includeSubDomains; preload Timing-Allow-Origin: * X-RequestId: b020ebe4-8162-4ceb-aa9e-b8e697188b10 X-TrackingId: 2b021a26-f341-4fc6-8bfb-aed759f6f952 X-bULS-SuppressionETag: N/A X-bULS-SuppressedTags: X-InvalidUlsJson: X-Content-Type-Options: nosniff X-Download-Options: noopen Content-Disposition: attachment X-Powered-By: ARR/3.0 Date: Wed, 15 Jan 2025 20:03:48 GMT Connection: close Content-Length: 0

Target ID:	0
Start time:	15:01:49
Start date:	15/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false