Windows Analysis Report
https://gcv.microsoft.us/kgRWagmalJ

Overview

General Information

Sample URL:	https://gcv.microsoft.us/kgRWagmalJ
Analysis ID:	1417061
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

HTTP GET or POST without a user agent

Stores files to the Windows start menu directory

Classification

Signatures

AV Detection

Antivirus detection for URL or domain

Source: https://pub-67b1238eb6e243dc93f415a9f97faade.r2.dev/df-invest.html

Avira URL Cloud: Label: phishing

Multi AV Scanner detection for domain / URL

Source: https://cloudflare-ipfs.com/ipfs/QmX4WG9i6svNo7QbAwn7yb2Tk6a5rFAhM5XvSGusSr18f8

Virustotal: Detection: 19%

Perma Link

Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.17:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.54.46.90:443 -> 192.168.2.17:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.54.46.90:443 -> 192.168.2.17:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.190.194:443 -> 192.168.2.17:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.17:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.17:49765 version: TLS 1.2

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.194
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.194
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.194
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.194
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.194
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.194
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.194
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88

Source: global traffic	HTTP traffic detected: GET /kgRWagmalJ HTTP/1.1Host: gcv.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7D HTTP/1.1Host: customervoice.microsoft.usConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/dist/cv-response-page.min.css?v=b3c1eb4c85&ring=UsGovGccProduction HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /Scripts/dists/ls-pro.en-us.18e0edc91.js?ring=UsGovGccProduction HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://customervoice.microsoft.ussec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /FormsPro/Scripts/Vendors/combined/basics_osi_v5_j3_3997ff6.js?ring=UsGovGccProduction HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://customervoice.microsoft.ussec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /FormsPro/Scripts/Vendors/combined/response_v2_5234a19.js?ring=UsGovGccProduction HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /Scripts/dists/response-page-pro.cachegroup-nerve.min.js?v=b3c1eb4c85&ring=UsGovGccProduction HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://customervoice.microsoft.ussec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /Scripts/dists/response-page-pro.min.js?v=b3c1eb4c85&ring=UsGovGccProduction HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://customervoice.microsoft.ussec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /formapi/api/f8c813f9-acbb-4b18-bb10-10729643538d/users/1b5da865-0b25-4d96-82dc-8362c1f0a3f3/light/runtimeForms('-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u')?$expand=questions($expand=choices) HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-UserSessionId: a3919d51-85c1-4c51-9e9d-a7542e522dd0x-ms-form-request-ring: formsprogccsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonContextParams: {"First Name":"Chez "}__RequestVerificationToken: SIHUJP0J4jcJ9nI2RIqeMfX9-76tZexD-QfhSpl_0t2pxrn7apZX__XC5CfYVOTLLAY9MTwqW0ARoD2B7IxYziWSRm7Q0qghvZFzYscuh8c1sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /Scripts/dists/response-page-pro.chunk.1ds.323a60b.js?ring=UsGovGccProduction HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /formapi/api/f8c813f9-acbb-4b18-bb10-10729643538d/users/1b5da865-0b25-4d96-82dc-8362c1f0a3f3/light/runtimeForms('-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u')?$expand=questions($expand=choices) HTTP/1.1Host: customervoice.microsoft.usConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /Scripts/dists/response-page-pro.chunk.utel.c1af5df.js?ring=UsGovGccProduction HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /Scripts/dists/response-page-pro.chunk.postsubmit.b7eca17.js?ring=UsGovGccProduction HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /Scripts/dists/response-page-pro.chunk.quiz.6dc4e0a.js?ring=UsGovGccProduction HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /cdn/scripts/dists/telemetry-worker.1.js HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /Pages/ResponsePage.aspx/GetResourceStrings HTTP/1.1Host: customervoice.microsoft.usConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /FormsPro/Images/CustomerVoice/CustomerVoice.ico HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /Scripts/dists/response-page-pro.chunk.638.3250f1d.js?ring=UsGovGccProduction HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /Scripts/dists/response-page-pro.chunk.vendors.e0d6b00.js?ring=UsGovGccProduction HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /FormsPro/Images/CustomerVoice/CustomerVoice.ico HTTP/1.1Host: customervoice.microsoft.usConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /formapi/api/f8c813f9-acbb-4b18-bb10-10729643538d/users/1b5da865-0b25-4d96-82dc-8362c1f0a3f3/light/runtimeForms('-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u')?$select=id,customCssFileName,customCSSInLineHeaderToggle,footerText HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-CorrelationId: c88ce182-a2e1-44cb-8902-572760b072bdX-UserSessionId: a3919d51-85c1-4c51-9e9d-a7542e522dd0x-ms-form-request-ring: formsprogccsec-ch-ua-mobile: ?0Authorization: OData-MaxVersion: 4.0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: application/jsonContextParams: {"First Name":"Chez "}__RequestVerificationToken: SIHUJP0J4jcJ9nI2RIqeMfX9-76tZexD-QfhSpl_0t2pxrn7apZX__XC5CfYVOTLLAY9MTwqW0ARoD2B7IxYziWSRm7Q0qghvZFzYscuh8c1x-ms-form-request-source: ms-formwebsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /formapi/api/f8c813f9-acbb-4b18-bb10-10729643538d/users/1b5da865-0b25-4d96-82dc-8362c1f0a3f3/light/runtimeForms('-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u')?$select=id,customCssFileName,customCSSInLineHeaderToggle,footerText HTTP/1.1Host: customervoice.microsoft.usConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /formapi/api/privacy?ownerTenantId=f8c813f9-acbb-4b18-bb10-10729643538d&currentUserTenantId=f8c813f9-acbb-4b18-bb10-10729643538d&isAnonymous=true HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-CorrelationId: d76d5655-a51f-4ca6-b68d-555bd3ba18dbX-UserSessionId: a3919d51-85c1-4c51-9e9d-a7542e522dd0x-ms-form-request-ring: formsprogccsec-ch-ua-mobile: ?0Authorization: OData-MaxVersion: 4.0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: application/jsonContextParams: {"First Name":"Chez "}__RequestVerificationToken: SIHUJP0J4jcJ9nI2RIqeMfX9-76tZexD-QfhSpl_0t2pxrn7apZX__XC5CfYVOTLLAY9MTwqW0ARoD2B7IxYziWSRm7Q0qghvZFzYscuh8c1x-ms-form-request-source: ms-formwebsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /Scripts/dists/response-page-pro.chunk.cvheadertheme.ce22c68.js?ring=UsGovGccProduction HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /Scripts/dists/response-page-pro.chunk.cvtitlerender.65b951b.js?ring=UsGovGccProduction HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /formapi/api/privacy?ownerTenantId=f8c813f9-acbb-4b18-bb10-10729643538d&currentUserTenantId=f8c813f9-acbb-4b18-bb10-10729643538d&isAnonymous=true HTTP/1.1Host: customervoice.microsoft.usConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=oKH7AKaDOEfh6P5&MD=PlelZS9N HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: 60X-DeviceID: 01000A41090080B6X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Search-TimeZone: Bias=-60; StandardBias=0; TimeZoneKeyName=W. Europe Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAW3qyTdwQuptWR9Ey%2B4YsPQCwEgYbIhQ5k%2BuSZMHY2RAPXgrB9S2QxDZ8JdvVzuO3U9YAQiTv7GSi2wL9GsIqgnhvhB3obPDRIz5FzmusEo0JzTqouYgoWI6ChC96B9lPF/CWvjDik/4T5gF8NkaJg7HcCap4YDmcojPWMPPQM6gE5ZM2cfQnrDQ1AOuB8wJmVokZ2be5EksJZ%2BFtY/7AkZFm9JN2wEvZ/XqIUHtTSBpMLDwp6htEB5Og0eEO2b5wVaEV0JeY%2BHYZ%2BCzZbxfaSFnsYALo9NGT/VQmtWM7KD7HLPZvjSo/HMhCaNK7YNpbamGF1txFr/LoBYEYD5HiYUDZgAACOJrP89Dvnm5qAG3orzwOexsxXp39x2y9YU6Voww%2BWWDmGNbG9gXRZUKQ6CPt3yNUSStKuvrX6P3nBsiVVydmlauGRm%2Bd4V0ptF8bijXl6doHUNgdSfa9tmZdxZOJVpIl/%2BlWoNJFD/waVHfrm4P2U8UX7l6QWd1fFIglHFyyv6X2DdQe12Mbs0H3H9KuTryHCEiVy31PBPz1ttpBqU4JnrI0cVPe4meYPrCbFm/s1HKyMgbICLeMI3g3%2Bv8Ad4oql2iqiWjojiMfM1JKuo6879mgMUE8REyE6inyzgZVTNvJZTgdz5hjqvepIk/89U8wyf6hrybnEHlF2WL02xZlDvN3/SzppJJVizO0oEDQ7QIHug4YgqQkwuJsxEwrHYdNdlba/x2bLuCBmCoe12NzYOarwhrffx8k8VmUtmcK/RZ4DGGJMArwmLnzpgbZmH0IEHMOPRl43ojFVnqD1ulXId/I1T8wdUwJi24%2BNu1J1dy6rcmujvdOadLzXgZNxHefmpA3V6Id3DqxTW4nKl9znii3r92O7e1KHucBwN6K4Xeja%2BdIDDyj6UoIfeJfXxwYWV72QE%3D%26p%3DX-Agent-DeviceId: 01000A41090080B6X-BM-CBT: 1711635269User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: 78167B19EE174DA3B1267413266BEA7DX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=oKH7AKaDOEfh6P5&MD=PlelZS9N HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: unknown

DNS traffic detected: queries for: gcv.microsoft.us

Source: unknown

HTTP traffic detected: POST /Pages/ResponsePage.aspx/GetResourceStrings HTTP/1.1Host: customervoice.microsoft.usConnection: keep-aliveContent-Length: 0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-CorrelationId: 611afbb5-1c7d-470e-9ee4-455f6159fddcX-UserSessionId: a3919d51-85c1-4c51-9e9d-a7542e522dd0sec-ch-ua-mobile: ?0formspro: enabledUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36content-type: application/json; charset=utf-8x-ms-form-request-source: ms-formwebsec-ch-ua-platform: "Windows"Accept: */*Origin: https://customervoice.microsoft.usSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1

Source: chromecache_96.1.dr	String found in binary or memory: http://amsul.ca
Source: chromecache_96.1.dr	String found in binary or memory: http://amsul.github.io/pickadate.js
Source: chromecache_96.1.dr	String found in binary or memory: http://amsul.github.io/pickadate.js/date.htm
Source: chromecache_97.1.dr	String found in binary or memory: http://api.jqueryui.com/category/ui-core/
Source: chromecache_97.1.dr	String found in binary or memory: http://jquery.org/license
Source: chromecache_97.1.dr	String found in binary or memory: http://jqueryui.com
Source: chromecache_90.1.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_115.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.cachegroup-nerve.min.js
Source: chromecache_116.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.1ds.323a60b.js.ma
Source: chromecache_99.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.638.3250f1d.js.ma
Source: chromecache_101.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.cvheadertheme.ce2
Source: chromecache_112.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.cvtitlerender.65b
Source: chromecache_93.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.postsubmit.b7eca1
Source: chromecache_106.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.quiz.6dc4e0a.js.m
Source: chromecache_102.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.utel.c1af5df.js.m
Source: chromecache_91.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.vendors.e0d6b00.j
Source: chromecache_97.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.min.js.map/72d2a4ad6536
Source: chromecache_92.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/telemetry-worker.1.js.map/2fc1de80443abf8
Source: chromecache_87.1.dr, chromecache_111.1.dr	String found in binary or memory: https://cloudflare-ipfs.com/ipfs/QmX4WG9i6svNo7QbAwn7yb2Tk6a5rFAhM5XvSGusSr18f8
Source: chromecache_90.1.dr	String found in binary or memory: https://fb.me/react-polyfills
Source: chromecache_87.1.dr, chromecache_111.1.dr	String found in binary or memory: https://gcv.microsoft.us/JWWGOUYU5N
Source: chromecache_108.1.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_108.1.dr	String found in binary or memory: https://getbootstrap.com/docs/3.4/customize/)
Source: chromecache_96.1.dr	String found in binary or memory: https://github.com/SoapBox/linkifyjs
Source: chromecache_108.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_99.1.dr	String found in binary or memory: https://jquery.com/
Source: chromecache_99.1.dr	String found in binary or memory: https://jquery.org/license
Source: chromecache_99.1.dr	String found in binary or memory: https://js.foundation/
Source: chromecache_111.1.dr	String found in binary or memory: https://lists.gcc.osi.office365.us/Images/f8c813f9-acbb-4b18-bb10-10729643538d/1b5da865-0b25-4d96-82
Source: chromecache_87.1.dr, chromecache_111.1.dr	String found in binary or memory: https://pub-67b1238eb6e243dc93f415a9f97faade.r2.dev/df-invest.html
Source: chromecache_97.1.dr	String found in binary or memory: https://raw.githubusercontent.com/stefanpenner/es6-promise/master/LICENSE
Source: chromecache_90.1.dr	String found in binary or memory: https://reactjs.org/docs/error-decoder.html?invariant=
Source: chromecache_99.1.dr	String found in binary or memory: https://sizzlejs.com/
Source: chromecache_90.1.dr	String found in binary or memory: https://underscorejs.org

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.17:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.54.46.90:443 -> 192.168.2.17:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.54.46.90:443 -> 192.168.2.17:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.190.194:443 -> 192.168.2.17:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.17:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.17:49765 version: TLS 1.2

Source: classification engine

Classification label: mal56.win@14/62@12/5

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcv.microsoft.us/kgRWagmalJ
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1912,i,12631141012789215718,17048731869604151303,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1912,i,12631141012789215718,17048731869604151303,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: chromecache_108.1.dr

Binary or memory string: '}.ms-Icon--ConnectVirtualMachine::before{content:'

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
20.140.48.70	eafd-3p-profile.usgovtrafficmanager.net	United States	8070	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.127.240.65	osiusgcc-usge-teal-001.usgovvirginia.cloudapp.usgovcloudapi.net	United States	8070	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.253.62.105	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17

Contacted Domains

Name	IP	Active
eafd-3p-profile.usgovtrafficmanager.net	20.140.48.70	true
osiusgcc-usge-teal-001.usgovvirginia.cloudapp.usgovcloudapi.net	52.127.240.65	true
www.google.com	172.253.62.105	true
customervoice.microsoft.us	unknown	unknown
lists.gcc.osi.office365.us	unknown	unknown
gcv.microsoft.us	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://customervoice.microsoft.us/Scripts/dists/response-page-pro.chunk.1ds.323a60b.js?ring=UsGovGccProduction	false	Avira URL Cloud: safe	unknown
https://customervoice.microsoft.us/cdn/scripts/dists/telemetry-worker.1.js	false	Avira URL Cloud: safe	unknown
https://gcv.microsoft.us/kgRWagmalJ	false		unknown
https://customervoice.microsoft.us/Pages/ResponsePage.aspx/GetResourceStrings	false	Avira URL Cloud: safe	unknown
https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7D	false		unknown
https://customervoice.microsoft.us/Scripts/dists/response-page-pro.chunk.postsubmit.b7eca17.js?ring=UsGovGccProduction	false	Avira URL Cloud: safe	unknown
https://customervoice.microsoft.us/Scripts/dists/ls-pro.en-us.18e0edc91.js?ring=UsGovGccProduction	false	Avira URL Cloud: safe	unknown
https://customervoice.microsoft.us/Scripts/dists/response-page-pro.chunk.quiz.6dc4e0a.js?ring=UsGovGccProduction	false	Avira URL Cloud: safe	unknown
https://customervoice.microsoft.us/FormsPro/Scripts/Vendors/combined/basics_osi_v5_j3_3997ff6.js?ring=UsGovGccProduction	false	Avira URL Cloud: safe	unknown
https://customervoice.microsoft.us/Scripts/dists/response-page-pro.chunk.638.3250f1d.js?ring=UsGovGccProduction	false	Avira URL Cloud: safe	unknown
https://customervoice.microsoft.us/Scripts/dists/response-page-pro.chunk.cvheadertheme.ce22c68.js?ring=UsGovGccProduction	false	Avira URL Cloud: safe	unknown
https://customervoice.microsoft.us/css/dist/cv-response-page.min.css?v=b3c1eb4c85&ring=UsGovGccProduction	false	Avira URL Cloud: safe	unknown
https://customervoice.microsoft.us/FormsPro/Scripts/Vendors/combined/response_v2_5234a19.js?ring=UsGovGccProduction	false	Avira URL Cloud: safe	unknown
https://customervoice.microsoft.us/Scripts/dists/response-page-pro.chunk.utel.c1af5df.js?ring=UsGovGccProduction	false	Avira URL Cloud: safe	unknown
https://customervoice.microsoft.us/formapi/api/f8c813f9-acbb-4b18-bb10-10729643538d/users/1b5da865-0b25-4d96-82dc-8362c1f0a3f3/light/runtimeForms('-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u')?$select=id,customCssFileName,customCSSInLineHeaderToggle,footerText	false	Avira URL Cloud: safe	unknown
https://customervoice.microsoft.us/Scripts/dists/response-page-pro.chunk.cvtitlerender.65b951b.js?ring=UsGovGccProduction	false	Avira URL Cloud: safe	unknown
https://customervoice.microsoft.us/Scripts/dists/response-page-pro.cachegroup-nerve.min.js?v=b3c1eb4c85&ring=UsGovGccProduction	false	Avira URL Cloud: safe	unknown
https://customervoice.microsoft.us/formapi/api/privacy?ownerTenantId=f8c813f9-acbb-4b18-bb10-10729643538d&currentUserTenantId=f8c813f9-acbb-4b18-bb10-10729643538d&isAnonymous=true	false	Avira URL Cloud: safe	unknown
https://customervoice.microsoft.us/FormsPro/Images/CustomerVoice/CustomerVoice.ico	false	Avira URL Cloud: safe	unknown
https://customervoice.microsoft.us/Scripts/dists/response-page-pro.min.js?v=b3c1eb4c85&ring=UsGovGccProduction	false	Avira URL Cloud: safe	unknown
https://customervoice.microsoft.us/Scripts/dists/response-page-pro.chunk.vendors.e0d6b00.js?ring=UsGovGccProduction	false	Avira URL Cloud: safe	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 13:14:12 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	81DE67E54B46587DC545ED29607797F6	689A8EC4FC1F1DABD00DD23189C9AF98DA13C4E0	D47475512A6B0377E9430FF23FB837DF2DEA4A08B5D2A25354A6BA57FA597593
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 13:14:12 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	307DC005E8C8A10DCA6A1964F07F5CB6	96AF5844E505CB91F7487084A18C69F2AA9E8D9C	45C96798B8D4D4115699BECAEC5CE422C546160E190C3F70F00257FA8ACECC5A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	F62D4DFCDA3B7693DC9815C7A2E3C741	31964DDB3CEC3BF97F358F5F9314CE9D14243361	D034382BB36D599299CC058536E9F32616DEF21E1D2D1128A7475FF56A06CE4C
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 13:14:12 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	C0288B6D973F22B9AAF19982D0ECEC64	2D044ACCC8B077BD7612AED8C4F0A6A750A43A06	B7077D277C30433F93E3243EE8BBD3342B5E0C454347774B52A1AD3897254725
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 13:14:12 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	EE5FD37A7101BA3FCA9F0FCFF59FCB02	3DC1654AB5C8F8BF733C2BFC067217B1BCE9FDAC	A1FB37A386373D55C360AB7DCE2929B0BA94F82C3C4387F83379936060DA11A5
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 13:14:11 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	0C48A64E47BDAFC35968420DFBC758D4	13D4335F140FFB0F7A6BADC885E22998EB41B64D	76B45632B7170CC42CC4F8287B8A133FC928A510E1A986F01313E6F49617AE2D
Chrome Cache Entry: 100	JSON data	AF469AC6ABAAF7DA1ACC59F7292E6671	75ACAD50ED8287D26D5EA2C7380B09B6095DA453	AC8EA734A33366EF42F62398D95B4A9D912043522CF945405FD691F7AA342FED
Chrome Cache Entry: 101	ASCII text, with very long lines (23932)	955B3780D94E04954A81D2BACA687D35	B3F3234B6BEB96B1B5E1AD69FA22CE398220D715	9382E22FD7683906612A6416A12ECB81B1318B03CBB3A3E009A5A49687155B81
Chrome Cache Entry: 102	ASCII text, with very long lines (29782)	C84F161AC3232BC00553A19A9043D7A2	7487D80415B1E1EBE3B1454CE6B8EAC1701E4550	E0362CF9EE3665EA471A69CF31D723630899D6CF8F0A907655B32578C690262D
Chrome Cache Entry: 103	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1, orientation=upper-left], baseline, precision 8, 572x233, components 3	E71534E10B1241216874F6C9FAEAD237	55E373F4F85AEC2E48AF6A225D4FD67B42DFBAFD	D38383C47693B251562296E1B8366AF11454BFCA4CCEA558895C946F180DD003
Chrome Cache Entry: 104	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel	EE2B357FA5FBA69AF238168E3A1A27E1	B5DD4606BEDBF1D705A01F833802248E03D01518	0FD813BAE48835570858A2508D9C29900B8A4CDDEBFF4A250E79AD12F8ACBDCB
Chrome Cache Entry: 105	JSON data	2544E12C996BF24471362B93F0DA41F3	A86BF135AB32EFD7D71F9D608A6ADF970446E945	5066B03C47885E634492DD13D9D4CD86EBB62D4B6603FA5DD249E0DA603B4F76
Chrome Cache Entry: 106	ASCII text, with very long lines (2530)	1D91B187A32745D330A2077FDADD872B	055D7BB0CF69E295C06346221B784359FA9199E2	2453F3D239A982DCF75B5DFA55261BC8BF77D04591F331847784AC4982E62F7E
Chrome Cache Entry: 107	JSON data	9E576E34B18E986347909C29AE6A82C6	532C767978DC2B55854B3CA2D2DF5B4DB221C934	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
Chrome Cache Entry: 108	Unicode text, UTF-8 text, with very long lines (64954), with CRLF line terminators	416B512C6FF81B7E3BD675E455905146	9F96EE2E55FDBED40B31BE7C24A97008A044404B	C400728CA705268C42BAFCADB6FD5E3AEA844F950E145C6F7E835D08E4C22259
Chrome Cache Entry: 109	JSON data	9E576E34B18E986347909C29AE6A82C6	532C767978DC2B55854B3CA2D2DF5B4DB221C934	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
Chrome Cache Entry: 110	JSON data	AF469AC6ABAAF7DA1ACC59F7292E6671	75ACAD50ED8287D26D5EA2C7380B09B6095DA453	AC8EA734A33366EF42F62398D95B4A9D912043522CF945405FD691F7AA342FED
Chrome Cache Entry: 111	JSON data	4DFB8996E4AB461C9E53550C8BE0D44D	5A3C43FF00E91091BD3CE2CD2D940576761EE769	B717D3DB791C57E7248B01B022970F5F691E9B149957F5344E5C032BCB3F7718
Chrome Cache Entry: 112	ASCII text, with very long lines (14182)	39FE53EB9274BE422813B6756D3951E8	5E7E1AA6347DD66A7B52BB3AC94EC50BB0BEC9E5	E91EBC90763C7B778FC6FD26FC0524D9D8584DE71A1A6E2ABB6D54492D3472D8
Chrome Cache Entry: 113	JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, progressive, precision 8, 1920x1080, components 3	3ED3B2FB3E64AFC87CF38EE4BB74A415	488783638E3D903C1B890876AF57264036B85D22	39E9110E7481C09A6C3DD85AC244848BE1517E17BC109852C12B062BA8F0C881
Chrome Cache Entry: 114	JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, progressive, precision 8, 1920x1080, components 3	3ED3B2FB3E64AFC87CF38EE4BB74A415	488783638E3D903C1B890876AF57264036B85D22	39E9110E7481C09A6C3DD85AC244848BE1517E17BC109852C12B062BA8F0C881
Chrome Cache Entry: 115	ASCII text, with very long lines (63096)	2F2B6883DF506FA11029D1E46167C453	B0F9C2613CC01C3EE9B10F12E298CC815D149A05	9FFB74A4DFB18D0DD5132133F104C008A15540DA87EF94A41F7B4C542D7F03C5
Chrome Cache Entry: 116	ASCII text, with very long lines (47337)	0627D9EF086A17447095E99090FD9AFA	584B355FA3F176BF0658A87C6267D0B95F3CA34A	B2A2FBED29B3EE7A0BE695ADC0A7C45C7EFAE9F958030D77E0944A9C9C7672D2
Chrome Cache Entry: 117	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1, orientation=upper-left], baseline, precision 8, 572x233, components 3	E71534E10B1241216874F6C9FAEAD237	55E373F4F85AEC2E48AF6A225D4FD67B42DFBAFD	D38383C47693B251562296E1B8366AF11454BFCA4CCEA558895C946F180DD003
Chrome Cache Entry: 85	HTML document, ASCII text, with very long lines (379), with CRLF line terminators	0F7CCE9368A5285559D7EF3E641F18A4	0E25DA9ABEC63112710CAEB14123215D24A84876	BC1832CD33B67E74FE000BDBCADB002EB3B6D47F403CD56972545898474EAF0F
Chrome Cache Entry: 86	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 222x125, components 3	EBF3D590FAEEE30CDF81929303672548	30BB5C412260A896CFE7E66FB33878452C3ACEC4	868D4ADAD4D4283F069E47683B80FF579F3B00941739820B74CAF999991FCA6E
Chrome Cache Entry: 87	JSON data	B659D679D2ABF51FAC56C0076E9398CA	0F789E0F6D7992F1AB452F25601835038E7508B7	E977D42ACDAAFB0355E9CCBBEB80E6D95B8D463C1DF837E6C07B4A79702BE92F
Chrome Cache Entry: 88	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1, orientation=upper-left], baseline, precision 8, 572x233, components 3	E71534E10B1241216874F6C9FAEAD237	55E373F4F85AEC2E48AF6A225D4FD67B42DFBAFD	D38383C47693B251562296E1B8366AF11454BFCA4CCEA558895C946F180DD003
Chrome Cache Entry: 89	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel	EE2B357FA5FBA69AF238168E3A1A27E1	B5DD4606BEDBF1D705A01F833802248E03D01518	0FD813BAE48835570858A2508D9C29900B8A4CDDEBFF4A250E79AD12F8ACBDCB
Chrome Cache Entry: 90	ASCII text, with very long lines (47421), with CRLF line terminators	6E9386843C22345A256F324692D627F2	FEF7FADB3A27032695AAB726682A340D583BFC51	D40E9F33813211AA5DFABEEBF4A1571D488E56878954DE4D513A25B3525B3988
Chrome Cache Entry: 91	ASCII text, with very long lines (65536), with no line terminators	4D5CEEE45615E16FF9E5B59F07F06782	0117F6F4AAE69E34983830D95B99D240778EE2F0	6FADE40437BEBEE439457D5683A1F6EAD708562697E7AD2F0C7A2148BC73F34E
Chrome Cache Entry: 92	ASCII text, with very long lines (58457)	62D1545FCE12E0397582E4D900A89EFD	D4B3BE160044C01E25B12F76973760386CEE2CA2	8C677EE4A629FA0473A019BBA10B46E8BE2FD926705E2649BC743BD97839C57C
Chrome Cache Entry: 93	ASCII text, with very long lines (65536), with no line terminators	DA69DB81907CC110600C8989D38BB9D5	1CA81D11BCF858BC2774FD6C5414D83F06618406	1D95A437A2BF9545D8B862A9C7CF8E8B9A38D6520258BCBED8BE63EB54455689
Chrome Cache Entry: 94	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1, orientation=upper-left], baseline, precision 8, 572x233, components 3	E71534E10B1241216874F6C9FAEAD237	55E373F4F85AEC2E48AF6A225D4FD67B42DFBAFD	D38383C47693B251562296E1B8366AF11454BFCA4CCEA558895C946F180DD003
Chrome Cache Entry: 95	JSON data	2544E12C996BF24471362B93F0DA41F3	A86BF135AB32EFD7D71F9D608A6ADF970446E945	5066B03C47885E634492DD13D9D4CD86EBB62D4B6603FA5DD249E0DA603B4F76
Chrome Cache Entry: 96	Unicode text, UTF-8 text, with very long lines (19569), with CRLF line terminators	162890ADA98A5DEF6640BBE57DA52EB9	06A3D551F9718164171E7517F18577B73F13B390	DA599489D3F86D69769A1D310A5E59838D7E72EAD0BCFE94851D0084318FCDC2
Chrome Cache Entry: 97	Unicode text, UTF-8 text, with very long lines (40515)	0C6F020C2EAAA68CA998AA158720EDFD	C5582182A53E63DD95F2B3AA2BE10D37F86078A7	A61962B6B38FBF8A4806E6F476F800520C2D0D184983D226511D180E173FBDEF
Chrome Cache Entry: 98	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 222x125, components 3	EBF3D590FAEEE30CDF81929303672548	30BB5C412260A896CFE7E66FB33878452C3ACEC4	868D4ADAD4D4283F069E47683B80FF579F3B00941739820B74CAF999991FCA6E
Chrome Cache Entry: 99	Unicode text, UTF-8 text, with very long lines (60976)	2F5D48A71CBEE9ABABF1C9B78B8FD892	65141885EE4988A9006E2D8583DBE2EB7DA2AC84	629F4CC6CEA0E185B7315CDAAF59192A34C2F4AC122396C3CCAAC6A2B6A9E0E0

AV Detection

Antivirus detection for URL or domain

Source: https://pub-67b1238eb6e243dc93f415a9f97faade.r2.dev/df-invest.html

Avira URL Cloud: Label: phishing

Multi AV Scanner detection for domain / URL

Source: https://cloudflare-ipfs.com/ipfs/QmX4WG9i6svNo7QbAwn7yb2Tk6a5rFAhM5XvSGusSr18f8

Virustotal: Detection: 19%

Perma Link

Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.17:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.54.46.90:443 -> 192.168.2.17:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.54.46.90:443 -> 192.168.2.17:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.190.194:443 -> 192.168.2.17:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.17:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.17:49765 version: TLS 1.2

HTTP GET or POST without a user agent

Source: global traffic

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.194
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.194
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.194
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.54.46.90
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.194
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.194
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.194
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.194
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.5.88

Source: global traffic	HTTP traffic detected: GET /kgRWagmalJ HTTP/1.1Host: gcv.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7D HTTP/1.1Host: customervoice.microsoft.usConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/dist/cv-response-page.min.css?v=b3c1eb4c85&ring=UsGovGccProduction HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /Scripts/dists/ls-pro.en-us.18e0edc91.js?ring=UsGovGccProduction HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://customervoice.microsoft.ussec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /FormsPro/Scripts/Vendors/combined/basics_osi_v5_j3_3997ff6.js?ring=UsGovGccProduction HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://customervoice.microsoft.ussec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /FormsPro/Scripts/Vendors/combined/response_v2_5234a19.js?ring=UsGovGccProduction HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /Scripts/dists/response-page-pro.cachegroup-nerve.min.js?v=b3c1eb4c85&ring=UsGovGccProduction HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://customervoice.microsoft.ussec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /Scripts/dists/response-page-pro.min.js?v=b3c1eb4c85&ring=UsGovGccProduction HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://customervoice.microsoft.ussec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /formapi/api/f8c813f9-acbb-4b18-bb10-10729643538d/users/1b5da865-0b25-4d96-82dc-8362c1f0a3f3/light/runtimeForms('-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u')?$expand=questions($expand=choices) HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-UserSessionId: a3919d51-85c1-4c51-9e9d-a7542e522dd0x-ms-form-request-ring: formsprogccsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonContextParams: {"First Name":"Chez "}__RequestVerificationToken: SIHUJP0J4jcJ9nI2RIqeMfX9-76tZexD-QfhSpl_0t2pxrn7apZX__XC5CfYVOTLLAY9MTwqW0ARoD2B7IxYziWSRm7Q0qghvZFzYscuh8c1sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /Scripts/dists/response-page-pro.chunk.1ds.323a60b.js?ring=UsGovGccProduction HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /formapi/api/f8c813f9-acbb-4b18-bb10-10729643538d/users/1b5da865-0b25-4d96-82dc-8362c1f0a3f3/light/runtimeForms('-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u')?$expand=questions($expand=choices) HTTP/1.1Host: customervoice.microsoft.usConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /Scripts/dists/response-page-pro.chunk.utel.c1af5df.js?ring=UsGovGccProduction HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /Scripts/dists/response-page-pro.chunk.postsubmit.b7eca17.js?ring=UsGovGccProduction HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /Scripts/dists/response-page-pro.chunk.quiz.6dc4e0a.js?ring=UsGovGccProduction HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /cdn/scripts/dists/telemetry-worker.1.js HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /Pages/ResponsePage.aspx/GetResourceStrings HTTP/1.1Host: customervoice.microsoft.usConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /FormsPro/Images/CustomerVoice/CustomerVoice.ico HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /Scripts/dists/response-page-pro.chunk.638.3250f1d.js?ring=UsGovGccProduction HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /Scripts/dists/response-page-pro.chunk.vendors.e0d6b00.js?ring=UsGovGccProduction HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /FormsPro/Images/CustomerVoice/CustomerVoice.ico HTTP/1.1Host: customervoice.microsoft.usConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /formapi/api/f8c813f9-acbb-4b18-bb10-10729643538d/users/1b5da865-0b25-4d96-82dc-8362c1f0a3f3/light/runtimeForms('-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u')?$select=id,customCssFileName,customCSSInLineHeaderToggle,footerText HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-CorrelationId: c88ce182-a2e1-44cb-8902-572760b072bdX-UserSessionId: a3919d51-85c1-4c51-9e9d-a7542e522dd0x-ms-form-request-ring: formsprogccsec-ch-ua-mobile: ?0Authorization: OData-MaxVersion: 4.0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: application/jsonContextParams: {"First Name":"Chez "}__RequestVerificationToken: SIHUJP0J4jcJ9nI2RIqeMfX9-76tZexD-QfhSpl_0t2pxrn7apZX__XC5CfYVOTLLAY9MTwqW0ARoD2B7IxYziWSRm7Q0qghvZFzYscuh8c1x-ms-form-request-source: ms-formwebsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /formapi/api/f8c813f9-acbb-4b18-bb10-10729643538d/users/1b5da865-0b25-4d96-82dc-8362c1f0a3f3/light/runtimeForms('-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u')?$select=id,customCssFileName,customCSSInLineHeaderToggle,footerText HTTP/1.1Host: customervoice.microsoft.usConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /formapi/api/privacy?ownerTenantId=f8c813f9-acbb-4b18-bb10-10729643538d&currentUserTenantId=f8c813f9-acbb-4b18-bb10-10729643538d&isAnonymous=true HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-CorrelationId: d76d5655-a51f-4ca6-b68d-555bd3ba18dbX-UserSessionId: a3919d51-85c1-4c51-9e9d-a7542e522dd0x-ms-form-request-ring: formsprogccsec-ch-ua-mobile: ?0Authorization: OData-MaxVersion: 4.0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: application/jsonContextParams: {"First Name":"Chez "}__RequestVerificationToken: SIHUJP0J4jcJ9nI2RIqeMfX9-76tZexD-QfhSpl_0t2pxrn7apZX__XC5CfYVOTLLAY9MTwqW0ARoD2B7IxYziWSRm7Q0qghvZFzYscuh8c1x-ms-form-request-source: ms-formwebsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /Scripts/dists/response-page-pro.chunk.cvheadertheme.ce22c68.js?ring=UsGovGccProduction HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /Scripts/dists/response-page-pro.chunk.cvtitlerender.65b951b.js?ring=UsGovGccProduction HTTP/1.1Host: customervoice.microsoft.usConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7DAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /formapi/api/privacy?ownerTenantId=f8c813f9-acbb-4b18-bb10-10729643538d&currentUserTenantId=f8c813f9-acbb-4b18-bb10-10729643538d&isAnonymous=true HTTP/1.1Host: customervoice.microsoft.usConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __RequestVerificationToken=CsL4gIEyrRuS-lA64R7DtqSADpEucloklHmtq68INfX6k8Tqg6----g6o1afhEY3GCPtfcu_nc1O8UOEWxBnq3m4nHgT3zAxf557BkTp4Yk1
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=oKH7AKaDOEfh6P5&MD=PlelZS9N HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: 60X-DeviceID: 01000A41090080B6X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Search-TimeZone: Bias=-60; StandardBias=0; TimeZoneKeyName=W. Europe Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAW3qyTdwQuptWR9Ey%2B4YsPQCwEgYbIhQ5k%2BuSZMHY2RAPXgrB9S2QxDZ8JdvVzuO3U9YAQiTv7GSi2wL9GsIqgnhvhB3obPDRIz5FzmusEo0JzTqouYgoWI6ChC96B9lPF/CWvjDik/4T5gF8NkaJg7HcCap4YDmcojPWMPPQM6gE5ZM2cfQnrDQ1AOuB8wJmVokZ2be5EksJZ%2BFtY/7AkZFm9JN2wEvZ/XqIUHtTSBpMLDwp6htEB5Og0eEO2b5wVaEV0JeY%2BHYZ%2BCzZbxfaSFnsYALo9NGT/VQmtWM7KD7HLPZvjSo/HMhCaNK7YNpbamGF1txFr/LoBYEYD5HiYUDZgAACOJrP89Dvnm5qAG3orzwOexsxXp39x2y9YU6Voww%2BWWDmGNbG9gXRZUKQ6CPt3yNUSStKuvrX6P3nBsiVVydmlauGRm%2Bd4V0ptF8bijXl6doHUNgdSfa9tmZdxZOJVpIl/%2BlWoNJFD/waVHfrm4P2U8UX7l6QWd1fFIglHFyyv6X2DdQe12Mbs0H3H9KuTryHCEiVy31PBPz1ttpBqU4JnrI0cVPe4meYPrCbFm/s1HKyMgbICLeMI3g3%2Bv8Ad4oql2iqiWjojiMfM1JKuo6879mgMUE8REyE6inyzgZVTNvJZTgdz5hjqvepIk/89U8wyf6hrybnEHlF2WL02xZlDvN3/SzppJJVizO0oEDQ7QIHug4YgqQkwuJsxEwrHYdNdlba/x2bLuCBmCoe12NzYOarwhrffx8k8VmUtmcK/RZ4DGGJMArwmLnzpgbZmH0IEHMOPRl43ojFVnqD1ulXId/I1T8wdUwJi24%2BNu1J1dy6rcmujvdOadLzXgZNxHefmpA3V6Id3DqxTW4nKl9znii3r92O7e1KHucBwN6K4Xeja%2BdIDDyj6UoIfeJfXxwYWV72QE%3D%26p%3DX-Agent-DeviceId: 01000A41090080B6X-BM-CBT: 1711635269User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: 78167B19EE174DA3B1267413266BEA7DX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=oKH7AKaDOEfh6P5&MD=PlelZS9N HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: unknown

DNS traffic detected: queries for: gcv.microsoft.us

Source: unknown

Source: chromecache_96.1.dr	String found in binary or memory: http://amsul.ca
Source: chromecache_96.1.dr	String found in binary or memory: http://amsul.github.io/pickadate.js
Source: chromecache_96.1.dr	String found in binary or memory: http://amsul.github.io/pickadate.js/date.htm
Source: chromecache_97.1.dr	String found in binary or memory: http://api.jqueryui.com/category/ui-core/
Source: chromecache_97.1.dr	String found in binary or memory: http://jquery.org/license
Source: chromecache_97.1.dr	String found in binary or memory: http://jqueryui.com
Source: chromecache_90.1.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_115.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.cachegroup-nerve.min.js
Source: chromecache_116.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.1ds.323a60b.js.ma
Source: chromecache_99.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.638.3250f1d.js.ma
Source: chromecache_101.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.cvheadertheme.ce2
Source: chromecache_112.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.cvtitlerender.65b
Source: chromecache_93.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.postsubmit.b7eca1
Source: chromecache_106.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.quiz.6dc4e0a.js.m
Source: chromecache_102.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.utel.c1af5df.js.m
Source: chromecache_91.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.vendors.e0d6b00.j
Source: chromecache_97.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.min.js.map/72d2a4ad6536
Source: chromecache_92.1.dr	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/telemetry-worker.1.js.map/2fc1de80443abf8
Source: chromecache_87.1.dr, chromecache_111.1.dr	String found in binary or memory: https://cloudflare-ipfs.com/ipfs/QmX4WG9i6svNo7QbAwn7yb2Tk6a5rFAhM5XvSGusSr18f8
Source: chromecache_90.1.dr	String found in binary or memory: https://fb.me/react-polyfills
Source: chromecache_87.1.dr, chromecache_111.1.dr	String found in binary or memory: https://gcv.microsoft.us/JWWGOUYU5N
Source: chromecache_108.1.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_108.1.dr	String found in binary or memory: https://getbootstrap.com/docs/3.4/customize/)
Source: chromecache_96.1.dr	String found in binary or memory: https://github.com/SoapBox/linkifyjs
Source: chromecache_108.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_99.1.dr	String found in binary or memory: https://jquery.com/
Source: chromecache_99.1.dr	String found in binary or memory: https://jquery.org/license
Source: chromecache_99.1.dr	String found in binary or memory: https://js.foundation/
Source: chromecache_111.1.dr	String found in binary or memory: https://lists.gcc.osi.office365.us/Images/f8c813f9-acbb-4b18-bb10-10729643538d/1b5da865-0b25-4d96-82
Source: chromecache_87.1.dr, chromecache_111.1.dr	String found in binary or memory: https://pub-67b1238eb6e243dc93f415a9f97faade.r2.dev/df-invest.html
Source: chromecache_97.1.dr	String found in binary or memory: https://raw.githubusercontent.com/stefanpenner/es6-promise/master/LICENSE
Source: chromecache_90.1.dr	String found in binary or memory: https://reactjs.org/docs/error-decoder.html?invariant=
Source: chromecache_99.1.dr	String found in binary or memory: https://sizzlejs.com/
Source: chromecache_90.1.dr	String found in binary or memory: https://underscorejs.org

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.17:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.54.46.90:443 -> 192.168.2.17:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.54.46.90:443 -> 192.168.2.17:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.190.194:443 -> 192.168.2.17:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.17:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.17:49765 version: TLS 1.2

Source: classification engine

Classification label: mal56.win@14/62@12/5

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcv.microsoft.us/kgRWagmalJ
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1912,i,12631141012789215718,17048731869604151303,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1912,i,12631141012789215718,17048731869604151303,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: chromecache_108.1.dr

Binary or memory string: '}.ms-Icon--ConnectVirtualMachine::before{content:'

ID:	1417061
Product:	CloudBasic
Start time:	15:13:39
Start date:	28.03.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://gcv.microsoft.us/kgRWagmalJ

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Boot Survival

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://gcv.microsoft.us/kgRWagmalJ

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Boot Survival

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://gcv.microsoft.us/kgRWagmalJ