Edit tour

Windows Analysis Report
iOS App Install Instructions - Santa Clara Public Safety - LH.eml

Overview

General Information

Sample name:	iOS App Install Instructions - Santa Clara Public Safety - LH.eml
Analysis ID:	1558884
MD5:	68ccf3c00e7517091e8a2ec25bb7cf73
SHA1:	a5c833a77af2f09ab50c9eb2d2977b5856be8e09
SHA256:	17336599f490564b3f39061f9de09f4a49816119913e9914afc81344ad839203
Infos:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Detected suspicious crossdomain redirect

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 6904 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\iOS App Install Instructions - Santa Clara Public Safety - LH.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 6936 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "8E1456D0-2B15-4836-83B6-1FBFB55BD00D" "70B0865D-C090-4BE7-AF9E-CF3B43E5EAE1" "6904" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 5868 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapps.apple.com%2Fredeem%3Fcode%3D3L3FHRKAYRYW%26ctx%3Dapps&data=05%7C02%7Ccmcdowell%40santaclaraca.gov%7C6e153ce680b940ac600808dd08ba7b7c%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638676319583058448%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=tQtWVhJkBQwd0r7gTpnCHzws245sXQj9NxHMJJPkG8Y%3D&reserved=0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6184 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=1940,i,472277037677389804,13362372691725064446,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4960 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapps.apple.com%2Fredeem%3Fcode%3D3L3FHRKAYRYW%26ctx%3Dapps&data=05%7C02%7Ccmcdowell%40santaclaraca.gov%7C6e153ce680b940ac600808dd08ba7b7c%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638676319583058448%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=tQtWVhJkBQwd0r7gTpnCHzws245sXQj9NxHMJJPkG8Y%3D&reserved=0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4152 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1988 --field-trial-handle=1956,i,4615083550077936862,14264789420345447439,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6904, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://buy.itunes.apple.com/WebObjects/MZFinance.woa/wa/redeemLandingPage?code=3L3FHRKAYRYW&ctx=apps&mt=12	HTTP Parser: No favicon
Source: https://www.apple.com/macos/macos-sequoia/	HTTP Parser: No favicon
Source: https://www.apple.com/macos/macos-sequoia/	HTTP Parser: No favicon
Source: https://www.apple.com/macos/macos-sequoia/	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49762 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: gcc02.safelinks.protection.outlook.com to https://apps.apple.com/redeem?code=3l3fhrkayryw&ctx=apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: gcc02.safelinks.protection.outlook.com to https://apps.apple.com/redeem?code=3l3fhrkayryw&ctx=apps

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 104.47.64.28 104.47.64.28

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Mm2fWrSKe2pTWeH&MD=CUnE4wkl HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /?url=https%3A%2F%2Fapps.apple.com%2Fredeem%3Fcode%3D3L3FHRKAYRYW%26ctx%3Dapps&data=05%7C02%7Ccmcdowell%40santaclaraca.gov%7C6e153ce680b940ac600808dd08ba7b7c%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638676319583058448%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=tQtWVhJkBQwd0r7gTpnCHzws245sXQj9NxHMJJPkG8Y%3D&reserved=0 HTTP/1.1Host: gcc02.safelinks.protection.outlook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Mm2fWrSKe2pTWeH&MD=CUnE4wkl HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /?url=https%3A%2F%2Fapps.apple.com%2Fredeem%3Fcode%3D3L3FHRKAYRYW%26ctx%3Dapps&data=05%7C02%7Ccmcdowell%40santaclaraca.gov%7C6e153ce680b940ac600808dd08ba7b7c%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638676319583058448%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=tQtWVhJkBQwd0r7gTpnCHzws245sXQj9NxHMJJPkG8Y%3D&reserved=0 HTTP/1.1Host: gcc02.safelinks.protection.outlook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_137.11.dr	String found in binary or memory: "https://www.facebook.com/Apple", equals www.facebook.com (Facebook)
Source: chromecache_137.11.dr	String found in binary or memory: "https://www.linkedin.com/company/apple", equals www.linkedin.com (Linkedin)
Source: chromecache_137.11.dr	String found in binary or memory: "https://www.twitter.com/Apple" equals www.twitter.com (Twitter)
Source: chromecache_137.11.dr	String found in binary or memory: "https://www.youtube.com/user/Apple", equals www.youtube.com (Youtube)
Source: chromecache_120.11.dr, chromecache_148.11.dr	String found in binary or memory: return r.indexOf("www.google.")>=0\|\|r.indexOf(".ask.com")>=0\|\|r=="www.bing.com"?i="q":r.indexOf(".yahoo.com")>=0&&(i="p"),i&&(s=its.url.queryParamValue(i,t),s&&(n.searchTerm=s)),n.hostname=r,n},ITSMetrics.metricsId=function(){return its.cookies.get(ITSMetrics.OMNITURE_COOKIE_NAME)},window.ITSMetrics\|\|(window.ITSMetrics={}),ITSMetrics._shouldFakeUserAgentVersion=function(){var t="MacAppStore/\|CastleSettings/\|iTunes Pre 9.",n=ITSMetrics.userAgentForMetrics(),r=n&&n.match(t); equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: gcc02.safelinks.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: s.mzstatic.com

Source: chromecache_120.11.dr, chromecache_148.11.dr	String found in binary or memory: http://apple.com/itunes/download
Source: chromecache_166.11.dr, chromecache_125.11.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_128.11.dr, chromecache_141.11.dr	String found in binary or memory: http://r.mzstatic.com
Source: chromecache_137.11.dr	String found in binary or memory: http://schema.org
Source: chromecache_137.11.dr	String found in binary or memory: http://schema.org/
Source: chromecache_178.11.dr, chromecache_191.11.dr	String found in binary or memory: http://www.apple.com/legal/itunes/us/gifts.html
Source: chromecache_120.11.dr, chromecache_148.11.dr	String found in binary or memory: http://www.apple.com/mac/app-store/
Source: chromecache_148.11.dr	String found in binary or memory: http://www.apple.com/qtactivex/qtplugin.cab
Source: chromecache_120.11.dr, chromecache_148.11.dr	String found in binary or memory: http://www.apple.com/quicktime/download/
Source: chromecache_137.11.dr	String found in binary or memory: http://www.wikidata.org/entity/Q312
Source: chromecache_137.11.dr	String found in binary or memory: https://account.apple.com/
Source: iOS App Install Instructions - Santa Clara Public Safety - LH.eml, ~WRS{E84A351D-61A4-4574-973A-5D8E7EBD6636}.tmp.1.dr	String found in binary or memory: https://aka.ms/LearnAboutSenderIdentification
Source: chromecache_178.11.dr, chromecache_191.11.dr	String found in binary or memory: https://apple.news/magazines
Source: chromecache_178.11.dr, chromecache_191.11.dr	String found in binary or memory: https://apps.apple.com
Source: chromecache_178.11.dr, chromecache_191.11.dr	String found in binary or memory: https://apps.apple.com/arcade
Source: iOS App Install Instructions - Santa Clara Public Safety - LH.eml	String found in binary or memory: https://apps.apple.com/redeem?code=3L3FHRKAYRYW&ctx=apps
Source: chromecache_137.11.dr	String found in binary or memory: https://apps.apple.com/us/app/apple-store/id375380948
Source: chromecache_137.11.dr	String found in binary or memory: https://apps.apple.com/us/story/id1742662181
Source: chromecache_191.11.dr	String found in binary or memory: https://commerce.apple.com/cta/ce30176475f442409b9db3ec75954751
Source: chromecache_137.11.dr	String found in binary or memory: https://developer.apple.com/macos/
Source: chromecache_178.11.dr, chromecache_191.11.dr	String found in binary or memory: https://finance-app.itunes.apple.com/account/add-funds
Source: chromecache_178.11.dr, chromecache_191.11.dr	String found in binary or memory: https://finance-app.itunes.apple.com/redeem/subscription-success?adamId=960073716&type=Fuse&quantity
Source: chromecache_178.11.dr, chromecache_191.11.dr	String found in binary or memory: https://fitness.apple.com
Source: iOS App Install Instructions - Santa Clara Public Safety - LH.eml, ~WRS{E84A351D-61A4-4574-973A-5D8E7EBD6636}.tmp.1.dr	String found in binary or memory: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapps.apple.com%2Fredeem%3Fcode%3D3
Source: chromecache_137.11.dr	String found in binary or memory: https://investor.apple.com/
Source: chromecache_191.11.dr	String found in binary or memory: https://isq06.mzstatic.com/image/thumb/Features7/v4/07/5b/e9/075be994-3375-c8f4-0909-81739b94b85c/mz
Source: chromecache_137.11.dr	String found in binary or memory: https://locate.apple.com/
Source: chromecache_178.11.dr, chromecache_191.11.dr	String found in binary or memory: https://music.apple.com/deeplink?app=music&p=browse
Source: chromecache_120.11.dr, chromecache_148.11.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.apple.android.music&referrer=utm_source=
Source: chromecache_166.11.dr, chromecache_125.11.dr	String found in binary or memory: https://preactjs.com
Source: chromecache_128.11.dr, chromecache_141.11.dr	String found in binary or memory: https://s.mzstatic.com
Source: chromecache_178.11.dr, chromecache_191.11.dr	String found in binary or memory: https://setup.icloud.com/email/prefs/storage?path=ICLOUD_SERVICE
Source: chromecache_191.11.dr	String found in binary or memory: https://silverbullet-itms6.itunes.apple.com/content/cd1a49fb-b1ea-4a1b-be40-aa6d41cf2915/images/872a
Source: chromecache_191.11.dr	String found in binary or memory: https://silverbullet-itms6.itunes.apple.com/content/cd1a49fb-b1ea-4a1b-be40-aa6d41cf2915/images/add8
Source: chromecache_191.11.dr	String found in binary or memory: https://silverbullet-itms6.itunes.apple.com/content/cd1a49fb-b1ea-4a1b-be40-aa6d41cf2915/images/c10d
Source: chromecache_191.11.dr	String found in binary or memory: https://silverbullet-itms6.itunes.apple.com/content/cd1a49fb-b1ea-4a1b-be40-aa6d41cf2915/variant-b/e
Source: chromecache_137.11.dr	String found in binary or memory: https://support.apple.com
Source: chromecache_137.11.dr	String found in binary or memory: https://support.apple.com/#organization
Source: chromecache_137.11.dr	String found in binary or memory: https://support.apple.com/?cid=gn-ols-home-hp-tab
Source: chromecache_137.11.dr	String found in binary or memory: https://support.apple.com/HT201300
Source: chromecache_137.11.dr	String found in binary or memory: https://support.apple.com/HT201634
Source: chromecache_137.11.dr	String found in binary or memory: https://support.apple.com/HT201862
Source: chromecache_137.11.dr	String found in binary or memory: https://support.apple.com/HT201894
Source: chromecache_137.11.dr	String found in binary or memory: https://support.apple.com/HT202888
Source: chromecache_178.11.dr, chromecache_191.11.dr	String found in binary or memory: https://support.apple.com/en-us/HT203021
Source: chromecache_178.11.dr, chromecache_191.11.dr	String found in binary or memory: https://tv.apple.com/watch-now
Source: chromecache_137.11.dr	String found in binary or memory: https://www.apple.com/
Source: chromecache_137.11.dr	String found in binary or memory: https://www.apple.com/#organization
Source: chromecache_137.11.dr	String found in binary or memory: https://www.apple.com/ac/structured-data/images/knowledge_graph_logo.png?202410241440
Source: chromecache_192.11.dr, chromecache_186.11.dr	String found in binary or memory: https://www.apple.com/apple-vision-pro/
Source: chromecache_135.11.dr, chromecache_206.11.dr	String found in binary or memory: https://www.apple.com/choose-country-region/
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/cn/global/nav/images/globalnav_text.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/cn/global/nav/images/globalnav_text.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/cz/global/nav/images/globalnav_text.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/cz/global/nav/images/globalnav_text.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/ee/global/nav/images/globalnav_text.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/ee/global/nav/images/globalnav_text.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/es/global/nav/images/globalnav_text.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/es/global/nav/images/globalnav_text.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/fi/global/nav/images/globalnav_text.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/fi/global/nav/images/globalnav_text.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/fr/global/nav/images/globalnav_text.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/fr/global/nav/images/globalnav_text.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/arrows/lessarrow_big_08c.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/arrows/morearrow_08c.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/arrows/morearrow_big_08c.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/breadory/breadcrumb_bg.png)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/breadory/breadcrumb_home.png)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/breadory/breadcrumb_home.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/breadory/breadcrumb_home_over.png)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/breadory/breadcrumb_home_over.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/breadory/breadcrumb_sep.png)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/breadory/breadcrumb_sep_20080909.png)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/breadory/breadcrumb_separator.png)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/breadory/breadcrumb_separator.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/breadory/directory_bg.png)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/breadory/directory_capbg.png)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/buttons/browsewebappss.png);_background-image:url(https://www.
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/buttons/businessstores.png);_background-image:url(https://www.
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/buttons/buyiphones.png);_background-image:url(https://www.appl
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/buttons/buynows.png);_background-image:url(https://www.apple.c
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/buttons/buynows_arrow.png);_background-image:url(https://www.a
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/buttons/comingsoons.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/buttons/descargarahoras.png);_background-image:url(https://www
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/buttons/downloadituness.png);_background-image:url(https://www
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/buttons/downloadnows.png);_background-image:url(https://www.ap
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/buttons/finds.png);_background-image:url(https://www.apple.com
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/buttons/freetrials.png);_background-image:url(https://www.appl
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/buttons/getstarteds.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/buttons/gos.png);_background-image:url(https://www.apple.com/g
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/buttons/howtoapplys.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/buttons/howtobuys.png);_background-image:url(https://www.apple
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/buttons/joinnows.png);_background-image:url(https://www.apple.
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/buttons/learnmores.png);_background-image:url(https://www.appl
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/buttons/nikebuynows.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/buttons/notifymes.png);_background-image:url(https://www.apple
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/buttons/ordernows.png);_background-image:url(https://www.apple
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/buttons/preordernows.png);_background-image:url(https://www.ap
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/buttons/preorders.png);_background-image:url(https://www.apple
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/buttons/reserves.png);_background-image:url(https://www.apple.
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/buttons/startyoursearchs.png);_background-image:url(https://ww
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/buttons/submits.png);_background-image:url(https://www.apple.c
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/buttons/tryamacs.png);_background-image:url(https://www.apple.
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/elements/buttons/upgradenows.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/nav/images/globalnav_text.png);_background-image:url(https://www.apple.
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/global/nav/images/globalnav_text.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/gr/global/nav/images/globalnav_text.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/gr/global/nav/images/globalnav_text.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/hk/global/nav/images/globalnav_text.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/hk/global/nav/images/globalnav_text.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/hr/global/nav/images/globalnav_text.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/hr/global/nav/images/globalnav_text.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/hu/global/nav/images/globalnav_text.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/hu/global/nav/images/globalnav_text.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/ipod/images/content_top20100901.png)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/it/global/nav/images/globalnav_text.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/it/global/nav/images/globalnav_text.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/itunes/images/border_fbfan.gif)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/jp/global/nav/images/globalnav_text.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/jp/global/nav/images/globalnav_text.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/kr/global/nav/images/globalnav_text.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/kr/global/nav/images/globalnav_text.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/la/global/nav/images/globalnav_text.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/la/global/nav/images/globalnav_text.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/lae/global/nav/images/globalnav_text.png);_background-image:url(https://www.ap
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/lae/global/nav/images/globalnav_text.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/lt/global/nav/images/globalnav_text.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/lt/global/nav/images/globalnav_text.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/lv/global/nav/images/globalnav_text.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/lv/global/nav/images/globalnav_text.svg)
Source: chromecache_137.11.dr	String found in binary or memory: https://www.apple.com/macos/macos-sequoia/
Source: chromecache_137.11.dr	String found in binary or memory: https://www.apple.com/macos/macos-sequoia/#softwareapplication
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/mg/global/nav/images/globalnav_text.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/mg/global/nav/images/globalnav_text.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/mt/global/nav/images/globalnav_text.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/mt/global/nav/images/globalnav_text.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/pl/global/nav/images/globalnav_text.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/pl/global/nav/images/globalnav_text.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/pt/global/nav/images/globalnav_text.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/pt/global/nav/images/globalnav_text.svg)
Source: chromecache_192.11.dr, chromecache_186.11.dr	String found in binary or memory: https://www.apple.com/retail/
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/ro/global/nav/images/globalnav_text.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/ro/global/nav/images/globalnav_text.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/ru/global/nav/images/globalnav_text.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/ru/global/nav/images/globalnav_text.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/sa/global/nav/images/globalnav_text.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/sa/global/nav/images/globalnav_text.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/sk/global/nav/images/globalnav_text.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/sk/global/nav/images/globalnav_text.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/th/global/fonts/sukhumvitset-bold-webfont.eot);src:url(https://www.apple.com/t
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/th/global/fonts/sukhumvitset-bold-webfont.svg#sukhumvit_setbold)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/th/global/fonts/sukhumvitset-bold-webfont.ttf)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/th/global/fonts/sukhumvitset-bold-webfont.woff)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/th/global/fonts/sukhumvitset-medium-webfont.eot);src:url(https://www.apple.com
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/th/global/fonts/sukhumvitset-medium-webfont.svg#sukhumvit_setmedium)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/th/global/fonts/sukhumvitset-medium-webfont.ttf)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/th/global/fonts/sukhumvitset-medium-webfont.woff)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/th/global/nav/images/globalnav_text.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/th/global/nav/images/globalnav_text.svg)
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/tr/global/nav/images/globalnav_text.png);_background-image:url(https://www.app
Source: chromecache_171.11.dr	String found in binary or memory: https://www.apple.com/tr/global/nav/images/globalnav_text.svg)
Source: chromecache_192.11.dr, chromecache_186.11.dr	String found in binary or memory: https://www.apple.com/us/shop/goto/giftcards
Source: chromecache_192.11.dr, chromecache_186.11.dr	String found in binary or memory: https://www.apple.com/us/shop/goto/store
Source: chromecache_192.11.dr, chromecache_186.11.dr	String found in binary or memory: https://www.apple.com/us/shop/goto/trade_in
Source: chromecache_137.11.dr	String found in binary or memory: https://www.apple.com/v/macos/macos-sequoia/a/images/meta/macos-sequoia__qclpvh6m08ay_og.png
Source: chromecache_137.11.dr	String found in binary or memory: https://www.apple.com/v/macos/macos-sequoia/a/images/meta/macos-sequoia__qclpvh6m08ay_og.png?2024102
Source: chromecache_177.11.dr	String found in binary or memory: https://www.apple.com/wss/fonts?family=Apple
Source: chromecache_177.11.dr	String found in binary or memory: https://www.apple.com/wss/fonts?family=SF
Source: chromecache_178.11.dr, chromecache_191.11.dr	String found in binary or memory: https://www.apple.com/xc/shop?cid=amp-redemption-ty
Source: chromecache_137.11.dr	String found in binary or memory: https://www.icloud.com
Source: chromecache_137.11.dr	String found in binary or memory: https://www.linkedin.com/company/apple
Source: chromecache_137.11.dr	String found in binary or memory: https://www.twitter.com/Apple
Source: chromecache_137.11.dr	String found in binary or memory: https://www.youtube.com/user/Apple

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49762 version: TLS 1.2

Source: classification engine

Classification label: clean3.winEML@31/165@8/6

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241119T1634450779-6904.etl

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\iOS App Install Instructions - Santa Clara Public Safety - LH.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "8E1456D0-2B15-4836-83B6-1FBFB55BD00D" "70B0865D-C090-4BE7-AF9E-CF3B43E5EAE1" "6904" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapps.apple.com%2Fredeem%3Fcode%3D3L3FHRKAYRYW%26ctx%3Dapps&data=05%7C02%7Ccmcdowell%40santaclaraca.gov%7C6e153ce680b940ac600808dd08ba7b7c%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638676319583058448%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=tQtWVhJkBQwd0r7gTpnCHzws245sXQj9NxHMJJPkG8Y%3D&reserved=0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=1940,i,472277037677389804,13362372691725064446,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapps.apple.com%2Fredeem%3Fcode%3D3L3FHRKAYRYW%26ctx%3Dapps&data=05%7C02%7Ccmcdowell%40santaclaraca.gov%7C6e153ce680b940ac600808dd08ba7b7c%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638676319583058448%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=tQtWVhJkBQwd0r7gTpnCHzws245sXQj9NxHMJJPkG8Y%3D&reserved=0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1988 --field-trial-handle=1956,i,4615083550077936862,14264789420345447439,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "8E1456D0-2B15-4836-83B6-1FBFB55BD00D" "70B0865D-C090-4BE7-AF9E-CF3B43E5EAE1" "6904" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapps.apple.com%2Fredeem%3Fcode%3D3L3FHRKAYRYW%26ctx%3Dapps&data=05%7C02%7Ccmcdowell%40santaclaraca.gov%7C6e153ce680b940ac600808dd08ba7b7c%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638676319583058448%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=tQtWVhJkBQwd0r7gTpnCHzws245sXQj9NxHMJJPkG8Y%3D&reserved=0	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapps.apple.com%2Fredeem%3Fcode%3D3L3FHRKAYRYW%26ctx%3Dapps&data=05%7C02%7Ccmcdowell%40santaclaraca.gov%7C6e153ce680b940ac600808dd08ba7b7c%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638676319583058448%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=tQtWVhJkBQwd0r7gTpnCHzws245sXQj9NxHMJJPkG8Y%3D&reserved=0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=1940,i,472277037677389804,13362372691725064446,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1988 --field-trial-handle=1956,i,4615083550077936862,14264789420345447439,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Source: Google Drive.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Process Injection	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
gcc02.safelinks.eop-tm2.outlook.com	104.47.64.28	true	false	high
www.google.com	142.250.185.196	true	false	high
s.mzstatic.com	unknown	unknown	false	high
gcc02.safelinks.protection.outlook.com	unknown	unknown	false	high

Name	Source	Malicious	Antivirus Detection	Reputation
http://schema.org	chromecache_137.11.dr	false		high
https://www.linkedin.com/company/apple	chromecache_137.11.dr	false		high
http://schema.org/	chromecache_137.11.dr	false		high
http://r.mzstatic.com	chromecache_128.11.dr, chromecache_141.11.dr	false		high
https://setup.icloud.com/email/prefs/storage?path=ICLOUD_SERVICE	chromecache_178.11.dr, chromecache_191.11.dr	false		high
https://apple.news/magazines	chromecache_178.11.dr, chromecache_191.11.dr	false		high
http://www.wikidata.org/entity/Q312	chromecache_137.11.dr	false		high
https://isq06.mzstatic.com/image/thumb/Features7/v4/07/5b/e9/075be994-3375-c8f4-0909-81739b94b85c/mz	chromecache_191.11.dr	false	Avira URL Cloud: safe	unknown
https://play.google.com/store/apps/details?id=com.apple.android.music&referrer=utm_source=	chromecache_120.11.dr, chromecache_148.11.dr	false		high
https://www.youtube.com/user/Apple	chromecache_137.11.dr	false		high
https://preactjs.com	chromecache_166.11.dr, chromecache_125.11.dr	false		high
https://s.mzstatic.com	chromecache_128.11.dr, chromecache_141.11.dr	false		high
https://www.twitter.com/Apple	chromecache_137.11.dr	false		high
http://jedwatson.github.io/classnames	chromecache_166.11.dr, chromecache_125.11.dr	false		high
https://aka.ms/LearnAboutSenderIdentification	iOS App Install Instructions - Santa Clara Public Safety - LH.eml, ~WRS{E84A351D-61A4-4574-973A-5D8E7EBD6636}.tmp.1.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.196	www.google.com	United States	15169	GOOGLEUS	false
104.47.64.28	gcc02.safelinks.eop-tm2.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1558884
Start date and time:	2024-11-19 22:34:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	iOS App Install Instructions - Santa Clara Public Safety - LH.eml
Detection:	CLEAN
Classification:	clean3.winEML@31/165@8/6
Cookbook Comments:	Found application associated with file extension: .eml

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	https://file.privacy-shield.cc/prvcy/PrivacyShield.Msix	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	https://s.id/nelsi	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	https://www.google.ie/url?q=querymmjx(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2fsafrareal.com.br%2fyoya%2fgrcbea7q6lbvpmruhnx3bojhvb2k6ojxdnvuw/Y3doaXRlQHdvcmxkZHJ5ZXIuY29t$?	Get hash	malicious	Unknown	Browse
	https://www.google.ie/url?q=querymt5q(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2fsafrareal.com.br%2fyoya%2fc8q7nfjsjndnopi54zzthngxk6gdjcw1ayuhz/ZGUud2l0dGUuYm9ub0BkZW1lLWdyb3VwLmNvbQ==$?	Get hash	malicious	HTMLPhisher	Browse
	https://ledger-checks.s3.us-east-1.amazonaws.com/index.html	Get hash	malicious	Unknown	Browse
	https://u0i80kuuob1iy6zegcwamjpmstb0jwt7jfjtna3zvl06tsuf2wys.ndshalox.com/1761285889337624024ZjpLutFjNdSHEQXNOEGFUUDLOVMMVVDUPOUBAIDNHITCHNH	Get hash	malicious	Unknown	Browse
	https://www.google.ie/url?q=queryacab(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2ftranscabrera.com%2fyaya%2f3vmuo7x6xrz0vlffvqk7em63uwkgfnzludmr4/bWFyay5nbmlya0BkYW5zb25zLmNvbQ==$?	Get hash	malicious	HTMLPhisher	Browse
	https://t.ly/9nPyg	Get hash	malicious	Unknown	Browse
104.47.64.28	DOCUMENTS.msg	Get hash	malicious	HTMLPhisher	Browse
	(No subject) - 2024-10-31T090531.704.eml	Get hash	malicious	Unknown	Browse
	Access Audits -System #6878.msg	Get hash	malicious	HTMLPhisher	Browse
	(No subject) (100).eml	Get hash	malicious	Tycoon2FA	Browse
	(No subject) (93).eml	Get hash	malicious	HTMLPhisher	Browse
	(No subject) (92).eml	Get hash	malicious	Unknown	Browse
	(No subject) (89).eml	Get hash	malicious	HTMLPhisher	Browse
	(No subject) (87).eml	Get hash	malicious	HTMLPhisher	Browse
	https://memakers-my.sharepoint.com/:f:/p/saeed/EuiMdoZoPpVNthIaEwKAedkBDFKyUdriWNhHe2RDzQxMdQ?e=5hQMeB&xsdata=MDV8MDJ8cGhlcm1hbkBidXJiYW5rY2EuZ292fDU4NDFjYjVhMjQzNDQ2YjU2ODZmMDhkY2Q3ZjZlNzZlfDY0OGRhZTMxMTgyYjRkYTI5OWVmMjU4MWFiOGU4YmVhfDB8MHw2Mzg2MjI3MDI2NDY5MTMzMDB8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDQwMDAwfHx8&sdata=STFxSjJFWXZ2WnFoSWJsSml1L3V4emhPdHNVTmE5OWJmbjZsSDRKcjlyND0%3d	Get hash	malicious	HTMLPhisher	Browse
	(No subject) (82).eml	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gcc02.safelinks.eop-tm2.outlook.com	ACH invoice 4088-27271.msg	Get hash	malicious	Unknown	Browse	104.47.65.28
	Follow up - DoorDash Corporate Platform.msg	Get hash	malicious	Unknown	Browse	104.47.65.28
	DOCUMENTS.msg	Get hash	malicious	HTMLPhisher	Browse	104.47.64.28
	(No subject) - 2024-10-31T090531.704.eml	Get hash	malicious	Unknown	Browse	104.47.64.28
	Access Audits -System #6878.msg	Get hash	malicious	HTMLPhisher	Browse	104.47.64.28
	(No subject) (100).eml	Get hash	malicious	Tycoon2FA	Browse	104.47.64.28
	(No subject) (93).eml	Get hash	malicious	HTMLPhisher	Browse	104.47.64.28
	(No subject) (92).eml	Get hash	malicious	Unknown	Browse	104.47.64.28
	(No subject) (90).eml	Get hash	malicious	Unknown	Browse	104.47.65.28
	(No subject) (89).eml	Get hash	malicious	HTMLPhisher	Browse	104.47.65.28

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	4.175.87.197 184.28.90.27
	https://s.id/nelsi	Get hash	malicious	HTMLPhisher	Browse	4.175.87.197 184.28.90.27
	file.exe	Get hash	malicious	LummaC	Browse	4.175.87.197 184.28.90.27
	https://www.google.ie/url?q=querymmjx(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2fsafrareal.com.br%2fyoya%2fgrcbea7q6lbvpmruhnx3bojhvb2k6ojxdnvuw/Y3doaXRlQHdvcmxkZHJ5ZXIuY29t$?	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27
	https://ledger-checks.s3.us-east-1.amazonaws.com/index.html	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27
	Document-v20-19-06.js	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27
	https://u0i80kuuob1iy6zegcwamjpmstb0jwt7jfjtna3zvl06tsuf2wys.ndshalox.com/1761285889337624024ZjpLutFjNdSHEQXNOEGFUUDLOVMMVVDUPOUBAIDNHITCHNH	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27
	Document-v20-19-06.js	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27
	https://www.google.ie/url?q=queryacab(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2ftranscabrera.com%2fyaya%2f3vmuo7x6xrz0vlffvqk7em63uwkgfnzludmr4/bWFyay5nbmlya0BkYW5zb25zLmNvbQ==$?	Get hash	malicious	HTMLPhisher	Browse	4.175.87.197 184.28.90.27
	https://t.ly/9nPyg	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.380763597400998
Encrypted:	false
SSDEEP:	1536:RHYL5+gsjtoCpkCFNDgsABNcAz79ysQqt25CbfqoQhqrcm0Fvb/myFZ+4CJcIO4x:GggeOugvmiGu2YqoQcrt0FvRG/qjEE2
MD5:	D74F0D82F267D870059F80EB44567610
SHA1:	7B06977531BD53B57AA196D200EEDE725ADB53DC
SHA-256:	72FB97C01C21648C24AFD6540F65D66F5B11ED6C8D6BD285F67696AF26F9A6B5
SHA-512:	9BBCCCADB6AC5429B287E59603E79BDDFF40D2E9FF9795E730709EE950BFE704788FFBEB17BE586B1513BEBBA8F9348A91D31022E29AE3F4293C8FE8E3649428
Malicious:	false
Reputation:	low
Preview:	TH02...... ......:......SM01X...,...0v...:..........IPM.Activity...........h...............h............H..h...............h............H..h\cal ...pDat...h....0........h...............h........_`Pk...h....@...I.lw...h....H...8.Uk...0....T...............d.........2h...............k..............!h.............. h...q..........#h....8.........$h........8....."h.g.......g....'h..............1h....<.........0h....4....Uk../h....h.....UkH..h....p.........-h .......,.....+hy.................. ...... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 19 20:35:04 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.980019830204255
Encrypted:	false
SSDEEP:	48:8pdsTQQIH0idAKZdA1FehwiZUklqehuy+3:8QvfFy
MD5:	799BECA185833253413BA243184FE885
SHA1:	61DF518DB194E81D5AD9A2E383B13F6A29C7A182
SHA-256:	36FBBD528F65CD9D53ABB2403C271003F360BFD387732E1A290548F723CDF178
SHA-512:	E8191B2376EB72DD7E2EC513F63F746F5BC87E1C442C8B5AF895D5E2847AE9A50BF839818B7026214F935E10F40630614912CC54C3821F0A7453E17ABFF240AE
Malicious:	false
Preview:	L..................F.@.. ...$+.,.........:..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IsYL.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VsYa.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VsYa.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VsYa............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VsYc............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............y.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

File type:	RFC 822 mail, ASCII text, with very long lines (1869), with CRLF line terminators
Entropy (8bit):	5.458868300454099
TrID:
File name:	iOS App Install Instructions - Santa Clara Public Safety - LH.eml
File size:	21'690 bytes
MD5:	68ccf3c00e7517091e8a2ec25bb7cf73
SHA1:	a5c833a77af2f09ab50c9eb2d2977b5856be8e09
SHA256:	17336599f490564b3f39061f9de09f4a49816119913e9914afc81344ad839203
SHA512:	ffcd7abab6419ffa4fa061f15fec464759d306182333ffdca9a8fda2f4502e0e544b311b5c4bce5a648c508a04260837434c4ddf1c57a97ff5e34fe8fe944877
SSDEEP:	384:02rZkYebHXoe9+mKVmbBTWo7BmOTcnOTYIc/j:0+ZkDYe9FKVmNTj7BmOTcnOTYIwj
TLSH:	F0A22907F7D01925DE9F59A428037B7E3B3990DA9F724C70698A6B3E074DCE386C124A
File Content Preview:	Received: from SJ0PR09MB8918.namprd09.prod.outlook.com (2603:10b6:a03:46b::12).. by SJ0PR09MB7151.namprd09.prod.outlook.com with HTTPS; Tue, 19 Nov 2024.. 16:52:38 +0000..Received: from CY5PR09CA0011.namprd09.prod.outlook.com (2603:10b6:930:1::14).. by SJ

Subject:	iOS App Install Instructions - Santa Clara Public Safety - LH
From:	"codes@apexmobile.net" <codes@apexmobile.net>
To:	Carolyn McDowell <CMcDowell@SantaClaraCA.gov>
Cc:
BCC:
Date:	Tue, 19 Nov 2024 16:51:57 +0000
Communications:	You don't often get email from codes@apexmobile.net. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification> Click the link below from your iOS device to install the application. You will need to sign in to your App Store account to complete the installation. YOUR CODE<https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapps.apple.com%2Fredeem%3Fcode%3D3L3FHRKAYRYW%26ctx%3Dapps&data=05%7C02%7Ccmcdowell%40santaclaraca.gov%7C6e153ce680b940ac600808dd08ba7b7c%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638676319583058448%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=tQtWVhJkBQwd0r7gTpnCHzws245sXQj9NxHMJJPkG8Y%3D&reserved=0>
Attachments:

Key	Value
Received	from cards.lighthouse4ps.org (unknown) by geopod-ismtpd-16 (SG) with ESMTP id rRbvKtgqS9qkxZ2pbguboQ for <cmcdowell@santaclaraca.gov>; Tue, 19 Nov 2024 16:51:57.738 +0000 (UTC)
From	"codes@apexmobile.net" <codes@apexmobile.net>
To	Carolyn McDowell <CMcDowell@SantaClaraCA.gov>
Subject	iOS App Install Instructions - Santa Clara Public Safety - LH
Thread-Topic	iOS App Install Instructions - Santa Clara Public Safety - LH
Thread-Index	AQHbOqNwB7MQK+yKu0GaAi5cmXElVg==
X-MS-Exchange-MessageSentRepresentingType	1
Date	Tue, 19 Nov 2024 16:51:57 +0000
Message-ID	<673cc22dae91b@apexmobile.net>
Reply-To	"codes@apexmobile.net" <codes@apexmobile.net>
Content-Language	en-US
X-MS-Exchange-Organization-AuthSource	SA2PEPF00002252.namprd09.prod.outlook.com
X-MS-Exchange-Organization-ComplianceLabelId	0d2e4d9f-7f6c-4f33-8ea6-20d1a585561f
X-MS-Has-Attach
X-MS-Exchange-Organization-Network-Message-Id	6e153ce6-80b9-40ac-6008-08dd08ba7b7c
X-MS-TNEF-Correlator
X-MS-Exchange-Organization-RecordReviewCfmType	0
x-ms-publictraffictype	Email
received-spf	Pass (protection.outlook.com: domain of em8520.lighthouseforpublicsafety.com designates 159.183.203.71 as permitted sender) receiver=protection.outlook.com; client-ip=159.183.203.71; helo=wfbtcbqt.outbound-mail.sendgrid.net; pr=C
authentication-results	spf=pass (sender IP is 159.183.203.71) smtp.mailfrom=em8520.lighthouseforpublicsafety.com; dkim=pass (signature was verified) header.d=lighthouseforpublicsafety.com;dmarc=permerror action=none header.from=apexmobile.net;compauth=pass reason=101
x-ms-office365-filtering-correlation-id	6e153ce6-80b9-40ac-6008-08dd08ba7b7c
x-ms-traffictypediagnostic	SA2PEPF00002252:EE_\|SJ0PR09MB8918:EE_\|SJ0PR09MB7151:EE_
x-ms-exchange-transport-crosstenantheadersstamped	SJ0PR09MB8918
x-forefront-antispam-report	CIP:159.183.203.71;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:wfbtcbqt.outbound-mail.sendgrid.net;PTR:wfbtcbqt.outbound-mail.sendgrid.net;CAT:NONE;SFTY:9.25;SFS:(13230040)(29132699027)(8096899003);DIR:INB;SFTY:9.25;
x-microsoft-antispam	BCL:0;ARA:13230040\|29132699027\|8096899003;
x-ms-exchange-crosstenant-originalarrivaltime	19 Nov 2024 16:51:58.3603 (UTC)
x-ms-exchange-crosstenant-network-message-id	6e153ce6-80b9-40ac-6008-08dd08ba7b7c
x-ms-exchange-crosstenant-id	28ea3548-1069-4e81-aa0b-6e4b3271a5cb
x-ms-exchange-crosstenant-fromentityheader	Internet
x-ms-exchange-transport-endtoendlatency	00:00:39.8424095
x-ms-exchange-processed-by-bccfoldering	15.20.8158.023
x-ms-exchange-atpmessageproperties	SA\|SL
x-ms-exchange-crosstenant-authsource	SA2PEPF00002252.namprd09.prod.outlook.com
x-ms-exchange-crosstenant-authas	Anonymous
x-eopattributedmessage	0
x-eoptenantattributedmessage	28ea3548-1069-4e81-aa0b-6e4b3271a5cb:0
x-mailer	CodeIgniter
dkim-signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=lighthouseforpublicsafety.com; h=from:subject:mime-version:reply-to:to:content-type:cc:content-type: from:subject:to; s=s1; bh=SkQpw8zGwIB1wl+iA6PQ4eroTcydiz5ckbxPj80rmEc=; b=Hqr87O1NGQ2r02ZYtStO/GVPWX8pM1krrBueJlT7DwYFtz0iZZr6skfB/4SdBRc+cTkb 7OahvLkGH2rZoLXLa9yNe0SV7ASu+eaJVoBFKwb48ue81ncM6UOokI/Pzk5ax25odcBDyC gxPZr0nCVHo6YMpQD9xgwfYt7FH4ZYmGszBI01b68xNzlDSxwtq7nG1vChUIX2hIVM8kG1 yLaRkB8/8o/k/eC2Y+AIed9etv/tzB96X5SIZmfIYxH/V7tPLWuA+/u6eWUHNObN3fUav9 m8RmtwmhJrz+AbKtksRiWmRclPwSI3V4sm8Hd9nuA1kKCQ9FiahQfEVRAZP4HaVA==
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003)(1420198);
X-Microsoft-Antispam-Message-Info	83mXE3TQVz/FH49g5xCkYhBmuwNTeItbkE4gvO6i3L3ShdkyGwZyKfVf0n6C9YR1418oTQGmXLDrZvrk8e2wiFNS2fZ7PWbz2d8BlVA4ugU3mVoc9g69BqroX6HAn9vy1XJxbqe2JFuGQXvWUzRCh9tmbzFpxP79rhGZfFm+2MwneVYTs+vEzBFdpYi9ppTeyFMtlD4WthWwfRIpEnBQ5ueAyakat2K1TY4gAi99tMVJDLz5rWd+7wk+ZSEn4x2ioT49O6X5qeNq/hqzkXUGjav1fGEkubNcrwieFSLM7VhUllp8yeUq47NB4lvzG2NWwXQ7Uceg8cLBxLtuwchUVkIkTKaHJMA4a+wNEZP4HQbLArkuWzOLmFkAHRRWggCMNVD4xeTOoSnZLTB682O7UBmeg3fX52EW0flLxuRLyocBCkdVaPJdUYpwx/Us615DPnFFPKjhzEwqqWwlx+UDh1l/F4ZfPNI3/IahDrtSAPjknqq6mGDigFf4l/Cmyc38spClucDlGYg+bDI2wBXiK8M4p+Pptmw6eYRuG6UM0j0K//mozJCaBGFqOG00OrAaM35bXyTIDOEMGo4Gn2liaZgFXvIbAZW+7+DqGYYkvWuqKQA500ckfyzBLh1POwIO2WyFOYk7T5A/gBMyvKFtaSGfKyq/dAwnPnzta2WcxGYk48j66k976c0CA/YQNGWq/S+R+HlkTHD71NuPEHu7WPmnny97QW90w0xChAy+WKsiJoG0/l8TKNthZEg17AfI3Z5rL+xw+FbiINgoyJ0R8HykeJvMziP+aGDEL1LA8vVrw2fl5x6uatehTeWG6Uhnumb9yVdxKv5waM3tB0+x8eRyUyeUJ5EBo5Lei5umqwXxxSeXebi+WQTlnvMaNL83GMcjkezhJcW29Z6omspuAQ6O+PEw5WpJEKpPFs/wry6fRY3dFn6PqIi0BylVlWrCrDh9CoQo8SXzx8hSulYR1HGXMMWpjF3ZGSMdGwoKdZiYxnwDijPPSu/4QG58E5MmPlIFLEBw7jDdNlJf2dOh41k/1d7VNbV20QuvARA4Ll+FYxRRpqvfh8XQyqcw6wGaR+oo9kNzznaUnsQf1IhrWSTF0p0MYcHVLz3EnTBu+poe34VPiqu5Fivom7CAdCF3lB/CosvKi/oK/CvH0NfgffJpIHIksDm5PqrW/DdChXrE0Ha3IJD0mjWufkdHnkMqiBAYO+wuKsnafYHc5cxQCg0N7GTVzAZOvzfe3dvpr2KjG5UhbBl11DXBVzZ3U9/xBMCKocmBpr7QxqR/ipCcVkr6shNp9j/VbtIVfyh8TKLlJ13YCdyrrulCak4WG0rDE02L66YIYdxm490ZlQPpt3YKq0TSDRrTg28T4zBEgYunN+lQ4lqVl3cmDNd/OKYvAuehBPQxvBHh8XDGLSnPjRdNxiRSxPa45Cqb3ZkxntlVJ0hAa+zk/AJCoTpNwKXeRyrXvuoNPPTGrO2LTG6pVByI7DfhrkYTJjONE/a7CDl536TajlI7QzACU+4vYoBJl0mMnnVRDjPCM5EYhiJNZEf5CYlT+oja0stTC8NCvHFXKokP0snqxOBqKhtoV3j+AwiPM1WluZliPO1ppuZCzGWptlUYF81mQfnnZrMvsXnTIF9lyf+U/yvxpSEqZw7OlCw3Jk4PWx51Pu17FcJ/ByVYm6Z/pRJ7E+pCyZGpIAhxXcj8DPLnRcLUUBSxTWpdUuTUjVFvpeR2ASHB51B91XXL1QxrSnLngi8GKm7WFqHOJVwgyZ2t7GpqgTSxxofAcsv/ALdJWXrzkWAIzhJ2JEYFAIBZety+JadOcGkm3yHLFF+nPCtf1LQClMdpHmVJna5VL0tlk11W7xpspDSckolVgAzNHuoKjTMqMuwxgM00Mn/40/hCuKPOaugmwemnzsZn+zu8ttCDYO7e6gJ4Kv77bny+ufRyHWf8ISPwagVkoOG6405k3C10HSwuqOk8hQ1r/jz4uHVVTt0NWl+z9zo0kWwVW7LnXFqd+/ccqwbRI6zl1+lvlJmdN7q4ilzLgIBvzy+9hP+rkZKPfXTdyGoWcSGhiUO2qZ0YCKTTUEblgt3SSSVz20BrB1nuobzPVClij6yIdeB372X/fae9MbuDNehX9uD2y7pAIv0UsWSG/Ws+CSEy8V2Et0DgJ+XK
Content-Type	multipart/alternative; boundary="_000_673cc22dae91bapexmobilenet_"
MIME-Version	1.0

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 22:34:44.178340912 CET	49673	443	192.168.2.16	204.79.197.203
Nov 19, 2024 22:34:44.481075048 CET	49673	443	192.168.2.16	204.79.197.203
Nov 19, 2024 22:34:45.088051081 CET	49673	443	192.168.2.16	204.79.197.203
Nov 19, 2024 22:34:46.296050072 CET	49673	443	192.168.2.16	204.79.197.203
Nov 19, 2024 22:34:46.985292912 CET	49689	80	192.168.2.16	192.229.211.108
Nov 19, 2024 22:34:48.706058979 CET	49673	443	192.168.2.16	204.79.197.203
Nov 19, 2024 22:34:50.436295033 CET	49706	443	192.168.2.16	184.28.90.27
Nov 19, 2024 22:34:50.436413050 CET	443	49706	184.28.90.27	192.168.2.16
Nov 19, 2024 22:34:50.436496973 CET	49706	443	192.168.2.16	184.28.90.27
Nov 19, 2024 22:34:50.438240051 CET	49706	443	192.168.2.16	184.28.90.27
Nov 19, 2024 22:34:50.438275099 CET	443	49706	184.28.90.27	192.168.2.16
Nov 19, 2024 22:34:51.151599884 CET	443	49706	184.28.90.27	192.168.2.16
Nov 19, 2024 22:34:51.151690960 CET	49706	443	192.168.2.16	184.28.90.27
Nov 19, 2024 22:34:51.154372931 CET	49706	443	192.168.2.16	184.28.90.27
Nov 19, 2024 22:34:51.154386997 CET	443	49706	184.28.90.27	192.168.2.16
Nov 19, 2024 22:34:51.154874086 CET	443	49706	184.28.90.27	192.168.2.16
Nov 19, 2024 22:34:51.191365004 CET	49706	443	192.168.2.16	184.28.90.27
Nov 19, 2024 22:34:51.235373974 CET	443	49706	184.28.90.27	192.168.2.16
Nov 19, 2024 22:34:51.476721048 CET	443	49706	184.28.90.27	192.168.2.16
Nov 19, 2024 22:34:51.476882935 CET	443	49706	184.28.90.27	192.168.2.16
Nov 19, 2024 22:34:51.477005005 CET	49706	443	192.168.2.16	184.28.90.27
Nov 19, 2024 22:34:51.477005005 CET	49706	443	192.168.2.16	184.28.90.27
Nov 19, 2024 22:34:51.477056026 CET	443	49706	184.28.90.27	192.168.2.16
Nov 19, 2024 22:34:51.477075100 CET	49706	443	192.168.2.16	184.28.90.27
Nov 19, 2024 22:34:51.477091074 CET	443	49706	184.28.90.27	192.168.2.16
Nov 19, 2024 22:34:51.520488024 CET	49707	443	192.168.2.16	184.28.90.27
Nov 19, 2024 22:34:51.520525932 CET	443	49707	184.28.90.27	192.168.2.16
Nov 19, 2024 22:34:51.520606995 CET	49707	443	192.168.2.16	184.28.90.27
Nov 19, 2024 22:34:51.520989895 CET	49707	443	192.168.2.16	184.28.90.27
Nov 19, 2024 22:34:51.521002054 CET	443	49707	184.28.90.27	192.168.2.16
Nov 19, 2024 22:34:51.529659033 CET	49699	443	192.168.2.16	40.126.32.74
Nov 19, 2024 22:34:51.529757023 CET	49699	443	192.168.2.16	40.126.32.74
Nov 19, 2024 22:34:51.534554958 CET	443	49699	40.126.32.74	192.168.2.16
Nov 19, 2024 22:34:51.534648895 CET	443	49699	40.126.32.74	192.168.2.16
Nov 19, 2024 22:34:51.534674883 CET	443	49699	40.126.32.74	192.168.2.16
Nov 19, 2024 22:34:51.534687042 CET	443	49699	40.126.32.74	192.168.2.16
Nov 19, 2024 22:34:51.534745932 CET	443	49699	40.126.32.74	192.168.2.16
Nov 19, 2024 22:34:51.884691000 CET	443	49699	40.126.32.74	192.168.2.16
Nov 19, 2024 22:34:51.884713888 CET	443	49699	40.126.32.74	192.168.2.16
Nov 19, 2024 22:34:51.884803057 CET	443	49699	40.126.32.74	192.168.2.16
Nov 19, 2024 22:34:51.884812117 CET	49699	443	192.168.2.16	40.126.32.74
Nov 19, 2024 22:34:51.884819031 CET	443	49699	40.126.32.74	192.168.2.16
Nov 19, 2024 22:34:51.884835005 CET	443	49699	40.126.32.74	192.168.2.16
Nov 19, 2024 22:34:51.884850025 CET	443	49699	40.126.32.74	192.168.2.16
Nov 19, 2024 22:34:51.884876966 CET	443	49699	40.126.32.74	192.168.2.16
Nov 19, 2024 22:34:51.884921074 CET	49699	443	192.168.2.16	40.126.32.74
Nov 19, 2024 22:34:51.885543108 CET	443	49699	40.126.32.74	192.168.2.16
Nov 19, 2024 22:34:51.885557890 CET	443	49699	40.126.32.74	192.168.2.16
Nov 19, 2024 22:34:51.885575056 CET	443	49699	40.126.32.74	192.168.2.16
Nov 19, 2024 22:34:51.885616064 CET	49699	443	192.168.2.16	40.126.32.74
Nov 19, 2024 22:34:51.885658026 CET	49699	443	192.168.2.16	40.126.32.74
Nov 19, 2024 22:34:52.243933916 CET	443	49707	184.28.90.27	192.168.2.16
Nov 19, 2024 22:34:52.244055033 CET	49707	443	192.168.2.16	184.28.90.27
Nov 19, 2024 22:34:52.245182991 CET	49707	443	192.168.2.16	184.28.90.27
Nov 19, 2024 22:34:52.245192051 CET	443	49707	184.28.90.27	192.168.2.16
Nov 19, 2024 22:34:52.245671988 CET	443	49707	184.28.90.27	192.168.2.16
Nov 19, 2024 22:34:52.247209072 CET	49707	443	192.168.2.16	184.28.90.27
Nov 19, 2024 22:34:52.291333914 CET	443	49707	184.28.90.27	192.168.2.16
Nov 19, 2024 22:34:52.348422050 CET	49678	443	192.168.2.16	20.189.173.10
Nov 19, 2024 22:34:52.574194908 CET	443	49707	184.28.90.27	192.168.2.16
Nov 19, 2024 22:34:52.574307919 CET	443	49707	184.28.90.27	192.168.2.16
Nov 19, 2024 22:34:52.574383974 CET	49707	443	192.168.2.16	184.28.90.27
Nov 19, 2024 22:34:52.575135946 CET	49707	443	192.168.2.16	184.28.90.27
Nov 19, 2024 22:34:52.575154066 CET	443	49707	184.28.90.27	192.168.2.16
Nov 19, 2024 22:34:52.575211048 CET	49707	443	192.168.2.16	184.28.90.27
Nov 19, 2024 22:34:52.575221062 CET	443	49707	184.28.90.27	192.168.2.16
Nov 19, 2024 22:34:52.651093006 CET	49678	443	192.168.2.16	20.189.173.10
Nov 19, 2024 22:34:53.112900019 CET	49708	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:34:53.112953901 CET	443	49708	4.175.87.197	192.168.2.16
Nov 19, 2024 22:34:53.113063097 CET	49708	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:34:53.114026070 CET	49708	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:34:53.114053965 CET	443	49708	4.175.87.197	192.168.2.16
Nov 19, 2024 22:34:53.255101919 CET	49678	443	192.168.2.16	20.189.173.10
Nov 19, 2024 22:34:53.511080027 CET	49673	443	192.168.2.16	204.79.197.203
Nov 19, 2024 22:34:53.920321941 CET	443	49708	4.175.87.197	192.168.2.16
Nov 19, 2024 22:34:53.920433998 CET	49708	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:34:53.921917915 CET	49708	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:34:53.921948910 CET	443	49708	4.175.87.197	192.168.2.16
Nov 19, 2024 22:34:53.922311068 CET	443	49708	4.175.87.197	192.168.2.16
Nov 19, 2024 22:34:53.975090027 CET	49708	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:34:53.975203991 CET	49708	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:34:54.019341946 CET	443	49708	4.175.87.197	192.168.2.16
Nov 19, 2024 22:34:54.253426075 CET	443	49708	4.175.87.197	192.168.2.16
Nov 19, 2024 22:34:54.253503084 CET	443	49708	4.175.87.197	192.168.2.16
Nov 19, 2024 22:34:54.253523111 CET	443	49708	4.175.87.197	192.168.2.16
Nov 19, 2024 22:34:54.253540993 CET	443	49708	4.175.87.197	192.168.2.16
Nov 19, 2024 22:34:54.253580093 CET	443	49708	4.175.87.197	192.168.2.16
Nov 19, 2024 22:34:54.253578901 CET	49708	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:34:54.253598928 CET	443	49708	4.175.87.197	192.168.2.16
Nov 19, 2024 22:34:54.253628016 CET	49708	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:34:54.253664017 CET	443	49708	4.175.87.197	192.168.2.16
Nov 19, 2024 22:34:54.253696918 CET	49708	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:34:54.253726006 CET	49708	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:34:54.253760099 CET	443	49708	4.175.87.197	192.168.2.16
Nov 19, 2024 22:34:54.253839016 CET	49708	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:34:54.253851891 CET	443	49708	4.175.87.197	192.168.2.16
Nov 19, 2024 22:34:54.253968000 CET	443	49708	4.175.87.197	192.168.2.16
Nov 19, 2024 22:34:54.254069090 CET	49708	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:34:54.264238119 CET	49708	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:34:54.264276028 CET	443	49708	4.175.87.197	192.168.2.16
Nov 19, 2024 22:34:54.264302969 CET	49708	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:34:54.264317036 CET	443	49708	4.175.87.197	192.168.2.16
Nov 19, 2024 22:34:54.470197916 CET	49678	443	192.168.2.16	20.189.173.10
Nov 19, 2024 22:34:56.803284883 CET	49680	80	192.168.2.16	192.229.211.108
Nov 19, 2024 22:34:56.883090973 CET	49678	443	192.168.2.16	20.189.173.10
Nov 19, 2024 22:34:57.107100964 CET	49680	80	192.168.2.16	192.229.211.108
Nov 19, 2024 22:34:57.714102030 CET	49680	80	192.168.2.16	192.229.211.108
Nov 19, 2024 22:34:58.926095009 CET	49680	80	192.168.2.16	192.229.211.108
Nov 19, 2024 22:35:01.333108902 CET	49680	80	192.168.2.16	192.229.211.108
Nov 19, 2024 22:35:01.698120117 CET	49678	443	192.168.2.16	20.189.173.10
Nov 19, 2024 22:35:03.018099070 CET	49713	443	192.168.2.16	104.47.64.28
Nov 19, 2024 22:35:03.018183947 CET	443	49713	104.47.64.28	192.168.2.16
Nov 19, 2024 22:35:03.018328905 CET	49713	443	192.168.2.16	104.47.64.28
Nov 19, 2024 22:35:03.018673897 CET	49713	443	192.168.2.16	104.47.64.28
Nov 19, 2024 22:35:03.018712044 CET	443	49713	104.47.64.28	192.168.2.16
Nov 19, 2024 22:35:03.116125107 CET	49673	443	192.168.2.16	204.79.197.203
Nov 19, 2024 22:35:03.634321928 CET	443	49713	104.47.64.28	192.168.2.16
Nov 19, 2024 22:35:03.634589911 CET	49713	443	192.168.2.16	104.47.64.28
Nov 19, 2024 22:35:03.634619951 CET	443	49713	104.47.64.28	192.168.2.16
Nov 19, 2024 22:35:03.636564016 CET	443	49713	104.47.64.28	192.168.2.16
Nov 19, 2024 22:35:03.636634111 CET	49713	443	192.168.2.16	104.47.64.28
Nov 19, 2024 22:35:03.637506008 CET	49713	443	192.168.2.16	104.47.64.28
Nov 19, 2024 22:35:03.637593985 CET	443	49713	104.47.64.28	192.168.2.16
Nov 19, 2024 22:35:03.637676954 CET	49713	443	192.168.2.16	104.47.64.28
Nov 19, 2024 22:35:03.637686968 CET	443	49713	104.47.64.28	192.168.2.16
Nov 19, 2024 22:35:03.690113068 CET	49713	443	192.168.2.16	104.47.64.28
Nov 19, 2024 22:35:04.277932882 CET	443	49713	104.47.64.28	192.168.2.16
Nov 19, 2024 22:35:04.278007030 CET	443	49713	104.47.64.28	192.168.2.16
Nov 19, 2024 22:35:04.278120995 CET	49713	443	192.168.2.16	104.47.64.28
Nov 19, 2024 22:35:04.279263973 CET	49713	443	192.168.2.16	104.47.64.28
Nov 19, 2024 22:35:04.279298067 CET	443	49713	104.47.64.28	192.168.2.16
Nov 19, 2024 22:35:06.144179106 CET	49680	80	192.168.2.16	192.229.211.108
Nov 19, 2024 22:35:07.820602894 CET	49721	443	192.168.2.16	142.250.185.196
Nov 19, 2024 22:35:07.820641994 CET	443	49721	142.250.185.196	192.168.2.16
Nov 19, 2024 22:35:07.820735931 CET	49721	443	192.168.2.16	142.250.185.196
Nov 19, 2024 22:35:07.820938110 CET	49721	443	192.168.2.16	142.250.185.196
Nov 19, 2024 22:35:07.820952892 CET	443	49721	142.250.185.196	192.168.2.16
Nov 19, 2024 22:35:08.488142014 CET	443	49721	142.250.185.196	192.168.2.16
Nov 19, 2024 22:35:08.489712000 CET	49721	443	192.168.2.16	142.250.185.196
Nov 19, 2024 22:35:08.489732981 CET	443	49721	142.250.185.196	192.168.2.16
Nov 19, 2024 22:35:08.493918896 CET	443	49721	142.250.185.196	192.168.2.16
Nov 19, 2024 22:35:08.494091988 CET	49721	443	192.168.2.16	142.250.185.196
Nov 19, 2024 22:35:08.495002031 CET	49721	443	192.168.2.16	142.250.185.196
Nov 19, 2024 22:35:08.495222092 CET	443	49721	142.250.185.196	192.168.2.16
Nov 19, 2024 22:35:08.551197052 CET	49721	443	192.168.2.16	142.250.185.196
Nov 19, 2024 22:35:08.551203012 CET	443	49721	142.250.185.196	192.168.2.16
Nov 19, 2024 22:35:08.599196911 CET	49721	443	192.168.2.16	142.250.185.196
Nov 19, 2024 22:35:11.313168049 CET	49678	443	192.168.2.16	20.189.173.10
Nov 19, 2024 22:35:15.744275093 CET	49680	80	192.168.2.16	192.229.211.108
Nov 19, 2024 22:35:18.388910055 CET	443	49721	142.250.185.196	192.168.2.16
Nov 19, 2024 22:35:18.389081955 CET	443	49721	142.250.185.196	192.168.2.16
Nov 19, 2024 22:35:18.389153004 CET	49721	443	192.168.2.16	142.250.185.196
Nov 19, 2024 22:35:19.229273081 CET	49721	443	192.168.2.16	142.250.185.196
Nov 19, 2024 22:35:19.229321957 CET	443	49721	142.250.185.196	192.168.2.16
Nov 19, 2024 22:35:30.788297892 CET	49762	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:35:30.788342953 CET	443	49762	4.175.87.197	192.168.2.16
Nov 19, 2024 22:35:30.788434982 CET	49762	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:35:30.788841009 CET	49762	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:35:30.788858891 CET	443	49762	4.175.87.197	192.168.2.16
Nov 19, 2024 22:35:31.245393991 CET	49697	80	192.168.2.16	199.232.210.172
Nov 19, 2024 22:35:31.245505095 CET	49698	80	192.168.2.16	199.232.210.172
Nov 19, 2024 22:35:31.250735998 CET	80	49697	199.232.210.172	192.168.2.16
Nov 19, 2024 22:35:31.250828981 CET	49697	80	192.168.2.16	199.232.210.172
Nov 19, 2024 22:35:31.251068115 CET	80	49698	199.232.210.172	192.168.2.16
Nov 19, 2024 22:35:31.251127005 CET	49698	80	192.168.2.16	199.232.210.172
Nov 19, 2024 22:35:31.613718033 CET	443	49762	4.175.87.197	192.168.2.16
Nov 19, 2024 22:35:31.613815069 CET	49762	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:35:31.615926981 CET	49762	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:35:31.615941048 CET	443	49762	4.175.87.197	192.168.2.16
Nov 19, 2024 22:35:31.616233110 CET	443	49762	4.175.87.197	192.168.2.16
Nov 19, 2024 22:35:31.617608070 CET	49762	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:35:31.659331083 CET	443	49762	4.175.87.197	192.168.2.16
Nov 19, 2024 22:35:31.954338074 CET	443	49762	4.175.87.197	192.168.2.16
Nov 19, 2024 22:35:31.954369068 CET	443	49762	4.175.87.197	192.168.2.16
Nov 19, 2024 22:35:31.954389095 CET	443	49762	4.175.87.197	192.168.2.16
Nov 19, 2024 22:35:31.954440117 CET	49762	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:35:31.954453945 CET	443	49762	4.175.87.197	192.168.2.16
Nov 19, 2024 22:35:31.954468966 CET	49762	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:35:31.954499960 CET	49762	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:35:31.955419064 CET	443	49762	4.175.87.197	192.168.2.16
Nov 19, 2024 22:35:31.955468893 CET	443	49762	4.175.87.197	192.168.2.16
Nov 19, 2024 22:35:31.955512047 CET	49762	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:35:31.955519915 CET	443	49762	4.175.87.197	192.168.2.16
Nov 19, 2024 22:35:31.955550909 CET	443	49762	4.175.87.197	192.168.2.16
Nov 19, 2024 22:35:31.955558062 CET	49762	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:35:31.955596924 CET	49762	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:35:31.964569092 CET	49762	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:35:31.964586020 CET	443	49762	4.175.87.197	192.168.2.16
Nov 19, 2024 22:35:31.964627981 CET	49762	443	192.168.2.16	4.175.87.197
Nov 19, 2024 22:35:31.964633942 CET	443	49762	4.175.87.197	192.168.2.16
Nov 19, 2024 22:36:07.871448994 CET	49825	443	192.168.2.16	142.250.185.196
Nov 19, 2024 22:36:07.871483088 CET	443	49825	142.250.185.196	192.168.2.16
Nov 19, 2024 22:36:07.871609926 CET	49825	443	192.168.2.16	142.250.185.196
Nov 19, 2024 22:36:07.871881962 CET	49825	443	192.168.2.16	142.250.185.196
Nov 19, 2024 22:36:07.871902943 CET	443	49825	142.250.185.196	192.168.2.16
Nov 19, 2024 22:36:08.522556067 CET	443	49825	142.250.185.196	192.168.2.16
Nov 19, 2024 22:36:08.522881985 CET	49825	443	192.168.2.16	142.250.185.196
Nov 19, 2024 22:36:08.522891998 CET	443	49825	142.250.185.196	192.168.2.16
Nov 19, 2024 22:36:08.523371935 CET	443	49825	142.250.185.196	192.168.2.16
Nov 19, 2024 22:36:08.523680925 CET	49825	443	192.168.2.16	142.250.185.196
Nov 19, 2024 22:36:08.523762941 CET	443	49825	142.250.185.196	192.168.2.16
Nov 19, 2024 22:36:08.573327065 CET	49825	443	192.168.2.16	142.250.185.196
Nov 19, 2024 22:36:18.427241087 CET	443	49825	142.250.185.196	192.168.2.16
Nov 19, 2024 22:36:18.427450895 CET	443	49825	142.250.185.196	192.168.2.16
Nov 19, 2024 22:36:18.427535057 CET	49825	443	192.168.2.16	142.250.185.196
Nov 19, 2024 22:36:19.230272055 CET	49825	443	192.168.2.16	142.250.185.196
Nov 19, 2024 22:36:19.230328083 CET	443	49825	142.250.185.196	192.168.2.16
Nov 19, 2024 22:36:20.218074083 CET	49826	443	192.168.2.16	104.47.64.28
Nov 19, 2024 22:36:20.218107939 CET	443	49826	104.47.64.28	192.168.2.16
Nov 19, 2024 22:36:20.218197107 CET	49826	443	192.168.2.16	104.47.64.28
Nov 19, 2024 22:36:20.218617916 CET	49827	443	192.168.2.16	104.47.64.28
Nov 19, 2024 22:36:20.218667030 CET	443	49827	104.47.64.28	192.168.2.16
Nov 19, 2024 22:36:20.218751907 CET	49827	443	192.168.2.16	104.47.64.28
Nov 19, 2024 22:36:20.218880892 CET	49826	443	192.168.2.16	104.47.64.28
Nov 19, 2024 22:36:20.218894958 CET	443	49826	104.47.64.28	192.168.2.16
Nov 19, 2024 22:36:20.219217062 CET	49827	443	192.168.2.16	104.47.64.28
Nov 19, 2024 22:36:20.219234943 CET	443	49827	104.47.64.28	192.168.2.16
Nov 19, 2024 22:36:20.826684952 CET	443	49826	104.47.64.28	192.168.2.16
Nov 19, 2024 22:36:20.826729059 CET	443	49827	104.47.64.28	192.168.2.16
Nov 19, 2024 22:36:20.826986074 CET	49826	443	192.168.2.16	104.47.64.28
Nov 19, 2024 22:36:20.827003002 CET	443	49826	104.47.64.28	192.168.2.16
Nov 19, 2024 22:36:20.827101946 CET	49827	443	192.168.2.16	104.47.64.28
Nov 19, 2024 22:36:20.827126980 CET	443	49827	104.47.64.28	192.168.2.16
Nov 19, 2024 22:36:20.827537060 CET	443	49826	104.47.64.28	192.168.2.16
Nov 19, 2024 22:36:20.827903986 CET	49826	443	192.168.2.16	104.47.64.28
Nov 19, 2024 22:36:20.827991962 CET	443	49826	104.47.64.28	192.168.2.16
Nov 19, 2024 22:36:20.828125000 CET	49826	443	192.168.2.16	104.47.64.28
Nov 19, 2024 22:36:20.828422070 CET	443	49827	104.47.64.28	192.168.2.16
Nov 19, 2024 22:36:20.828766108 CET	49827	443	192.168.2.16	104.47.64.28
Nov 19, 2024 22:36:20.828943014 CET	443	49827	104.47.64.28	192.168.2.16
Nov 19, 2024 22:36:20.872350931 CET	49827	443	192.168.2.16	104.47.64.28
Nov 19, 2024 22:36:20.875375986 CET	443	49826	104.47.64.28	192.168.2.16
Nov 19, 2024 22:36:20.988979101 CET	443	49826	104.47.64.28	192.168.2.16
Nov 19, 2024 22:36:20.989207029 CET	443	49826	104.47.64.28	192.168.2.16
Nov 19, 2024 22:36:20.989284992 CET	49826	443	192.168.2.16	104.47.64.28
Nov 19, 2024 22:36:20.989475012 CET	49826	443	192.168.2.16	104.47.64.28
Nov 19, 2024 22:36:20.989492893 CET	443	49826	104.47.64.28	192.168.2.16
Nov 19, 2024 22:36:20.989500999 CET	49826	443	192.168.2.16	104.47.64.28
Nov 19, 2024 22:36:20.989543915 CET	49826	443	192.168.2.16	104.47.64.28
Nov 19, 2024 22:36:22.176526070 CET	49699	443	192.168.2.16	40.126.32.74
Nov 19, 2024 22:36:22.176587105 CET	49700	80	192.168.2.16	192.229.221.95
Nov 19, 2024 22:36:22.181509018 CET	443	49699	40.126.32.74	192.168.2.16
Nov 19, 2024 22:36:22.181571007 CET	49699	443	192.168.2.16	40.126.32.74
Nov 19, 2024 22:36:22.181889057 CET	80	49700	192.229.221.95	192.168.2.16
Nov 19, 2024 22:36:22.181948900 CET	49700	80	192.168.2.16	192.229.221.95
Nov 19, 2024 22:36:24.488214016 CET	49701	443	192.168.2.16	40.126.32.74
Nov 19, 2024 22:36:24.493460894 CET	443	49701	40.126.32.74	192.168.2.16
Nov 19, 2024 22:36:24.493534088 CET	49701	443	192.168.2.16	40.126.32.74

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 22:35:02.956654072 CET	53	60653	1.1.1.1	192.168.2.16
Nov 19, 2024 22:35:02.984772921 CET	52088	53	192.168.2.16	1.1.1.1
Nov 19, 2024 22:35:02.984993935 CET	53922	53	192.168.2.16	1.1.1.1
Nov 19, 2024 22:35:03.007632971 CET	53	57277	1.1.1.1	192.168.2.16
Nov 19, 2024 22:35:03.012383938 CET	53	52088	1.1.1.1	192.168.2.16
Nov 19, 2024 22:35:03.017498016 CET	53	53922	1.1.1.1	192.168.2.16
Nov 19, 2024 22:35:03.999536037 CET	53	63616	1.1.1.1	192.168.2.16
Nov 19, 2024 22:35:07.812189102 CET	51019	53	192.168.2.16	1.1.1.1
Nov 19, 2024 22:35:07.812371969 CET	49459	53	192.168.2.16	1.1.1.1
Nov 19, 2024 22:35:07.818844080 CET	53	49459	1.1.1.1	192.168.2.16
Nov 19, 2024 22:35:07.818866014 CET	53	51019	1.1.1.1	192.168.2.16
Nov 19, 2024 22:35:09.806859970 CET	50847	53	192.168.2.16	1.1.1.1
Nov 19, 2024 22:35:09.807192087 CET	61930	53	192.168.2.16	1.1.1.1
Nov 19, 2024 22:35:21.002114058 CET	53	57271	1.1.1.1	192.168.2.16
Nov 19, 2024 22:35:39.734025955 CET	53	49154	1.1.1.1	192.168.2.16
Nov 19, 2024 22:35:48.521475077 CET	138	138	192.168.2.16	192.168.2.255
Nov 19, 2024 22:36:02.239932060 CET	53	61764	1.1.1.1	192.168.2.16
Nov 19, 2024 22:36:02.961818933 CET	53	51198	1.1.1.1	192.168.2.16
Nov 19, 2024 22:36:20.178894997 CET	64343	53	192.168.2.16	1.1.1.1
Nov 19, 2024 22:36:20.179157972 CET	64667	53	192.168.2.16	1.1.1.1
Nov 19, 2024 22:36:20.214119911 CET	53	64667	1.1.1.1	192.168.2.16
Nov 19, 2024 22:36:20.217204094 CET	53	64343	1.1.1.1	192.168.2.16
Nov 19, 2024 22:36:31.377580881 CET	53	54106	1.1.1.1	192.168.2.16

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:34:51 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-19 21:34:51 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=69033 Date: Tue, 19 Nov 2024 21:34:51 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:34:52 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-19 21:34:52 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=68993 Date: Tue, 19 Nov 2024 21:34:52 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-19 21:34:52 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report iOS App Install Instructions - Santa Clara Public Safety - LH.eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{E84A351D-61A4-4574-973A-5D8E7EBD6636}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1732052086002936200_7197AAE2-865C-4F33-8D0D-A5B519405488.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1732052086003765700_7197AAE2-865C-4F33-8D0D-A5B519405488.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241119T1634450779-6904.etl

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Windows Analysis Report
iOS App Install Instructions - Santa Clara Public Safety - LH.eml

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:34:53 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Mm2fWrSKe2pTWeH&MD=CUnE4wkl HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-19 21:34:54 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: f5fedc7b-0ea5-44b9-b876-35f1cd1cdc42 MS-RequestId: fdb30272-8ea0-4ef7-ace3-917372c7bb3c MS-CV: 1cMlYvYJ4kOo/KCU.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 19 Nov 2024 21:34:53 GMT Connection: close Content-Length: 24490
2024-11-19 21:34:54 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-19 21:34:54 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:35:03 UTC	1099	OUT	GET /?url=https%3A%2F%2Fapps.apple.com%2Fredeem%3Fcode%3D3L3FHRKAYRYW%26ctx%3Dapps&data=05%7C02%7Ccmcdowell%40santaclaraca.gov%7C6e153ce680b940ac600808dd08ba7b7c%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638676319583058448%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=tQtWVhJkBQwd0r7gTpnCHzws245sXQj9NxHMJJPkG8Y%3D&reserved=0 HTTP/1.1 Host: gcc02.safelinks.protection.outlook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-19 21:35:04 UTC	675	IN	HTTP/1.1 302 Found Cache-Control: private Content-Type: text/html; charset=utf-8 Location: https://apps.apple.com/redeem?code=3L3FHRKAYRYW&ctx=apps Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 4.0 X-SL-GetUrlReputation-Verdict: Good X-Robots-Tag: noindex, nofollow X-AspNet-Version: 4.0.30319 X-ServerName: BL0GCC02WS010 X-ServerVersion: 15.20.8182.014 X-ServerLat: 503 X-SafeLinks-Tracking-Id: 82563b52-a332-4180-491d-08dd08e20772 X-Powered-By: ASP.NET X-Content-Type-Options: nosniff X-UA-Compatible: IE=Edge Strict-Transport-Security: max-age=0; includeSubDomains; preload Date: Tue, 19 Nov 2024 21:35:04 GMT Connection: close Content-Length: 177
2024-11-19 21:35:04 UTC	177	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 70 70 73 2e 61 70 70 6c 65 2e 63 6f 6d 2f 72 65 64 65 65 6d 3f 63 6f 64 65 3d 33 4c 33 46 48 52 4b 41 59 52 59 57 26 61 6d 70 3b 63 74 78 3d 61 70 70 73 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://apps.apple.com/redeem?code=3L3FHRKAYRYW&ctx=apps">here</a>.</h2></body></html>

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:35:31 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Mm2fWrSKe2pTWeH&MD=CUnE4wkl HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-19 21:35:31 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 1f92bd78-90ba-4628-a7b7-629b4b73958c MS-RequestId: cc87188c-ba11-40ca-b9cb-d821aa27f1d7 MS-CV: 8odHSLo3kUmaBkCD.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 19 Nov 2024 21:35:31 GMT Connection: close Content-Length: 30005
2024-11-19 21:35:31 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-19 21:35:31 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Timestamp	Bytes transferred	Direction	Data
2024-11-19 21:36:20 UTC	1099	OUT	GET /?url=https%3A%2F%2Fapps.apple.com%2Fredeem%3Fcode%3D3L3FHRKAYRYW%26ctx%3Dapps&data=05%7C02%7Ccmcdowell%40santaclaraca.gov%7C6e153ce680b940ac600808dd08ba7b7c%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638676319583058448%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=tQtWVhJkBQwd0r7gTpnCHzws245sXQj9NxHMJJPkG8Y%3D&reserved=0 HTTP/1.1 Host: gcc02.safelinks.protection.outlook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-19 21:36:20 UTC	674	IN	HTTP/1.1 302 Found Cache-Control: private Content-Type: text/html; charset=utf-8 Location: https://apps.apple.com/redeem?code=3L3FHRKAYRYW&ctx=apps Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 4.0 X-SL-GetUrlReputation-Verdict: Good X-Robots-Tag: noindex, nofollow X-AspNet-Version: 4.0.30319 X-ServerName: BL0GCC02WS010 X-ServerVersion: 15.20.8182.014 X-ServerLat: 27 X-SafeLinks-Tracking-Id: c4627e82-ecb6-43ba-6710-08dd08e23574 X-Powered-By: ASP.NET X-Content-Type-Options: nosniff X-UA-Compatible: IE=Edge Strict-Transport-Security: max-age=0; includeSubDomains; preload Date: Tue, 19 Nov 2024 21:36:20 GMT Connection: close Content-Length: 177
2024-11-19 21:36:20 UTC	177	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 70 70 73 2e 61 70 70 6c 65 2e 63 6f 6d 2f 72 65 64 65 65 6d 3f 63 6f 64 65 3d 33 4c 33 46 48 52 4b 41 59 52 59 57 26 61 6d 70 3b 63 74 78 3d 61 70 70 73 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://apps.apple.com/redeem?code=3L3FHRKAYRYW&ctx=apps">here</a>.</h2></body></html>

Target ID:	1
Start time:	16:34:45
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\iOS App Install Instructions - Santa Clara Public Safety - LH.eml"
Imagebase:	0xf70000
File size:	34'446'744 bytes
MD5 hash:	91A5292942864110ED734005B7E005C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	3
Start time:	16:34:46
Start date:	19/11/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "8E1456D0-2B15-4836-83B6-1FBFB55BD00D" "70B0865D-C090-4BE7-AF9E-CF3B43E5EAE1" "6904" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Imagebase:	0x7ff65a0e0000
File size:	710'048 bytes
MD5 hash:	EC652BEDD90E089D9406AFED89A8A8BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	10
Start time:	16:35:01
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapps.apple.com%2Fredeem%3Fcode%3D3L3FHRKAYRYW%26ctx%3Dapps&data=05%7C02%7Ccmcdowell%40santaclaraca.gov%7C6e153ce680b940ac600808dd08ba7b7c%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638676319583058448%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=tQtWVhJkBQwd0r7gTpnCHzws245sXQj9NxHMJJPkG8Y%3D&reserved=0
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	15
Start time:	16:36:19
Start date:	19/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapps.apple.com%2Fredeem%3Fcode%3D3L3FHRKAYRYW%26ctx%3Dapps&data=05%7C02%7Ccmcdowell%40santaclaraca.gov%7C6e153ce680b940ac600808dd08ba7b7c%7C28ea354810694e81aa0b6e4b3271a5cb%7C0%7C0%7C638676319583058448%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C60000%7C%7C%7C&sdata=tQtWVhJkBQwd0r7gTpnCHzws245sXQj9NxHMJJPkG8Y%3D&reserved=0
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre