IOC Report
https://gcv.microsoft.us/kgRWagmalJ

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 13:14:12 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 13:14:12 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 13:14:12 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 13:14:12 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 13:14:11 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 100
JSON data
downloaded
Chrome Cache Entry: 101
ASCII text, with very long lines (23932)
downloaded
Chrome Cache Entry: 102
ASCII text, with very long lines (29782)
downloaded
Chrome Cache Entry: 103
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1, orientation=upper-left], baseline, precision 8, 572x233, components 3
dropped
Chrome Cache Entry: 104
MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
downloaded
Chrome Cache Entry: 105
JSON data
dropped
Chrome Cache Entry: 106
ASCII text, with very long lines (2530)
downloaded
Chrome Cache Entry: 107
JSON data
dropped
Chrome Cache Entry: 108
Unicode text, UTF-8 text, with very long lines (64954), with CRLF line terminators
downloaded
Chrome Cache Entry: 109
JSON data
dropped
Chrome Cache Entry: 110
JSON data
dropped
Chrome Cache Entry: 111
JSON data
dropped
Chrome Cache Entry: 112
ASCII text, with very long lines (14182)
downloaded
Chrome Cache Entry: 113
JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, progressive, precision 8, 1920x1080, components 3
dropped
Chrome Cache Entry: 114
JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, progressive, precision 8, 1920x1080, components 3
downloaded
Chrome Cache Entry: 115
ASCII text, with very long lines (63096)
downloaded
Chrome Cache Entry: 116
ASCII text, with very long lines (47337)
downloaded
Chrome Cache Entry: 117
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1, orientation=upper-left], baseline, precision 8, 572x233, components 3
downloaded
Chrome Cache Entry: 85
HTML document, ASCII text, with very long lines (379), with CRLF line terminators
downloaded
Chrome Cache Entry: 86
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 222x125, components 3
dropped
Chrome Cache Entry: 87
JSON data
downloaded
Chrome Cache Entry: 88
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1, orientation=upper-left], baseline, precision 8, 572x233, components 3
dropped
Chrome Cache Entry: 89
MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
dropped
Chrome Cache Entry: 90
ASCII text, with very long lines (47421), with CRLF line terminators
downloaded
Chrome Cache Entry: 91
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 92
ASCII text, with very long lines (58457)
downloaded
Chrome Cache Entry: 93
ASCII text, with very long lines (65536), with no line terminators
downloaded
Chrome Cache Entry: 94
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1, orientation=upper-left], baseline, precision 8, 572x233, components 3
downloaded
Chrome Cache Entry: 95
JSON data
downloaded
Chrome Cache Entry: 96
Unicode text, UTF-8 text, with very long lines (19569), with CRLF line terminators
downloaded
Chrome Cache Entry: 97
Unicode text, UTF-8 text, with very long lines (40515)
downloaded
Chrome Cache Entry: 98
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 222x125, components 3
downloaded
Chrome Cache Entry: 99
Unicode text, UTF-8 text, with very long lines (60976)
downloaded
There are 30 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcv.microsoft.us/kgRWagmalJ
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1912,i,12631141012789215718,17048731869604151303,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

URLs

Name
IP
Malicious
https://gcv.microsoft.us/kgRWagmalJ
malicious
https://customervoice.microsoft.us/Scripts/dists/response-page-pro.chunk.1ds.323a60b.js?ring=UsGovGccProduction
52.127.240.65
https://customervoice.microsoft.us/cdn/scripts/dists/telemetry-worker.1.js
52.127.240.65
http://jquery.org/license
unknown
https://gcv.microsoft.us/kgRWagmalJ
20.140.48.70
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.min.js.map/72d2a4ad6536
unknown
http://amsul.ca
unknown
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.cvheadertheme.ce2
unknown
http://jqueryui.com
unknown
https://customervoice.microsoft.us/Pages/ResponsePage.aspx/GetResourceStrings
52.127.240.65
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.postsubmit.b7eca1
unknown
https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7D
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.utel.c1af5df.js.m
unknown
https://raw.githubusercontent.com/stefanpenner/es6-promise/master/LICENSE
unknown
https://customervoice.microsoft.us/Scripts/dists/response-page-pro.chunk.postsubmit.b7eca17.js?ring=UsGovGccProduction
52.127.240.65
https://customervoice.microsoft.us/Scripts/dists/ls-pro.en-us.18e0edc91.js?ring=UsGovGccProduction
52.127.240.65
https://customervoice.microsoft.us/Scripts/dists/response-page-pro.chunk.quiz.6dc4e0a.js?ring=UsGovGccProduction
52.127.240.65
https://github.com/SoapBox/linkifyjs
unknown
https://customervoice.microsoft.us/FormsPro/Scripts/Vendors/combined/basics_osi_v5_j3_3997ff6.js?ring=UsGovGccProduction
52.127.240.65
https://customervoice.microsoft.us/Scripts/dists/response-page-pro.chunk.638.3250f1d.js?ring=UsGovGccProduction
52.127.240.65
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.cvtitlerender.65b
unknown
https://customervoice.microsoft.us/Scripts/dists/response-page-pro.chunk.cvheadertheme.ce22c68.js?ring=UsGovGccProduction
52.127.240.65
https://underscorejs.org
unknown
https://customervoice.microsoft.us/css/dist/cv-response-page.min.css?v=b3c1eb4c85&ring=UsGovGccProduction
52.127.240.65
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.cachegroup-nerve.min.js
unknown
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.1ds.323a60b.js.ma
unknown
http://www.apache.org/licenses/LICENSE-2.0
unknown
https://getbootstrap.com/docs/3.4/customize/)
unknown
http://amsul.github.io/pickadate.js
unknown
https://customervoice.microsoft.us/FormsPro/Scripts/Vendors/combined/response_v2_5234a19.js?ring=UsGovGccProduction
52.127.240.65
https://customervoice.microsoft.us/Scripts/dists/response-page-pro.chunk.utel.c1af5df.js?ring=UsGovGccProduction
52.127.240.65
https://reactjs.org/docs/error-decoder.html?invariant=
unknown
http://api.jqueryui.com/category/ui-core/
unknown
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.quiz.6dc4e0a.js.m
unknown
https://getbootstrap.com/)
unknown
https://cloudflare-ipfs.com/ipfs/QmX4WG9i6svNo7QbAwn7yb2Tk6a5rFAhM5XvSGusSr18f8
unknown
https://customervoice.microsoft.us/formapi/api/f8c813f9-acbb-4b18-bb10-10729643538d/users/1b5da865-0b25-4d96-82dc-8362c1f0a3f3/light/runtimeForms('-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u')?$select=id,customCssFileName,customCSSInLineHeaderToggle,footerText
52.127.240.65
https://jquery.org/license
unknown
https://customervoice.microsoft.us/Scripts/dists/response-page-pro.chunk.cvtitlerender.65b951b.js?ring=UsGovGccProduction
52.127.240.65
https://customervoice.microsoft.us/Scripts/dists/response-page-pro.cachegroup-nerve.min.js?v=b3c1eb4c85&ring=UsGovGccProduction
52.127.240.65
https://jquery.com/
unknown
https://pub-67b1238eb6e243dc93f415a9f97faade.r2.dev/df-invest.html
unknown
https://customervoice.microsoft.us/formapi/api/privacy?ownerTenantId=f8c813f9-acbb-4b18-bb10-10729643538d&currentUserTenantId=f8c813f9-acbb-4b18-bb10-10729643538d&isAnonymous=true
52.127.240.65
http://amsul.github.io/pickadate.js/date.htm
unknown
https://github.com/twbs/bootstrap/blob/master/LICENSE)
unknown
https://fb.me/react-polyfills
unknown
https://gcv.microsoft.us/JWWGOUYU5N
unknown
https://customervoice.microsoft.us/FormsPro/Images/CustomerVoice/CustomerVoice.ico
52.127.240.65
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.638.3250f1d.js.ma
unknown
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/response-page-pro.chunk.vendors.e0d6b00.j
unknown
https://lists.gcc.osi.office365.us/Images/f8c813f9-acbb-4b18-bb10-10729643538d/1b5da865-0b25-4d96-82
unknown
https://customervoice.microsoft.us/Scripts/dists/response-page-pro.min.js?v=b3c1eb4c85&ring=UsGovGccProduction
52.127.240.65
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/telemetry-worker.1.js.map/2fc1de80443abf8
unknown
https://customervoice.microsoft.us/Scripts/dists/response-page-pro.chunk.vendors.e0d6b00.js?ring=UsGovGccProduction
52.127.240.65
https://sizzlejs.com/
unknown
https://js.foundation/
unknown
There are 45 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
eafd-3p-profile.usgovtrafficmanager.net
20.140.48.70
osiusgcc-usge-teal-001.usgovvirginia.cloudapp.usgovcloudapi.net
52.127.240.65
www.google.com
172.253.62.105
customervoice.microsoft.us
unknown
lists.gcc.osi.office365.us
unknown
gcv.microsoft.us
unknown

IPs

IP
Domain
Country
Malicious
192.168.2.17
unknown
unknown
20.140.48.70
eafd-3p-profile.usgovtrafficmanager.net
United States
52.127.240.65
osiusgcc-usge-teal-001.usgovvirginia.cloudapp.usgovcloudapi.net
United States
239.255.255.250
unknown
Reserved
172.253.62.105
www.google.com
United States

DOM / HTML

URL
Malicious
https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7D
https://customervoice.microsoft.us/Pages/ResponsePage.aspx?id=-RPI-LusGEu7EBBylkNTjWWoXRslC5ZNgtyDYsHwo_NUQTZXV1E4UEdXQUhWNkpXUjlTWDVHQjJBNC4u&ctx=%7B%22First%20Name%22%3A%22Chez%20%22%7D