Play interactive tourEdit tour

Windows Analysis Report
https://outlook.office365.com/Encryption/retrieve.ashx?recipientemailaddress=mclary%40statenational.com&senderemailaddress=rmcbride%40chambless-math.com&senderorganization=AwGEAAAAAoAAAAADAQAAANPu52tb0WpLrMi8HJFYSWFPVT1jaGFtYmxlc3NtYXRoLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9y

Overview

General Information

Sample URL:	https://outlook.office365.com/Encryption/retrieve.ashx?recipientemailaddress=mclary%40statenational.com&senderemailaddress=rmcbride%40chambless-math.com&senderorganization=AwGEAAAAAoAAAAADAQAAANPu52tb
Analysis ID:	863386
Infos:

Detection

HTMLPhisher

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish54

HTML page contains hidden URLs or javascript code

Yara signature match

HTML body contains low number of good links

HTML title does not match URL

HTML page is missing a favicon

Classification

×

Joe Sandbox Signatures

• • Phishing
• • Compliance
• • Networking
• • System Summary

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected HtmlPhish54

Source: Yara match

File source: 8.pages.csv, type: HTML

HTML page contains hidden URLs or javascript code

Source: https://mymax.mycumax.us/?n6=iyqI

HTTP Parser: Base64 decoded: a[href^="https://xltube.nl/click/"]

HTML body contains low number of good links

Source: https://outlook.office365.com/Encryption/OTPSigninPage.aspx?itemID=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375&OTPMessageId=07a29f9e-2737-4828-b9a8-20967eb5f72d%40PH8PR14MB5850.namprd14.prod.outlook.com&OTPReferenceId=1739

HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://outlook.office365.com/Encryption/OTPSigninPage.aspx?itemID=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375&OTPMessageId=07a29f9e-2737-4828-b9a8-20967eb5f72d%40PH8PR14MB5850.namprd14.prod.outlook.com&OTPReferenceId=1739

HTTP Parser: Title: Encrypted Message OTP Sign in does not match URL

HTML page is missing a favicon

Source: https://indd.adobe.com/contentHandler/contentHandler.html?basepath=https://indd.adobe.com&relativepath=/view/publication/f01290b3-e6da-4be6-bd56-03690b124393/1/publication.html&parentorigin=https://indd.adobe.com&maxPageDimensions={%22width%22:612,%22height%22:792}&transition=false	HTTP Parser: No favicon
Source: https://indd.adobe.com/contentHandler/contentHandler.html?basepath=https://indd.adobe.com&relativepath=/view/publication/f01290b3-e6da-4be6-bd56-03690b124393/1/publication.html&parentorigin=https://indd.adobe.com&maxPageDimensions={%22width%22:612,%22height%22:792}&transition=false	HTTP Parser: No favicon
Source: https://indd.adobe.com/view/publication/f01290b3-e6da-4be6-bd56-03690b124393/1/publication.html	HTTP Parser: No favicon
Source: https://indd.adobe.com/view/publication/f01290b3-e6da-4be6-bd56-03690b124393/1/publication.html	HTTP Parser: No favicon

META author tag missing

Source: https://outlook.office365.com/Encryption/OTPSigninPage.aspx?itemID=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375&OTPMessageId=07a29f9e-2737-4828-b9a8-20967eb5f72d%40PH8PR14MB5850.namprd14.prod.outlook.com&OTPReferenceId=1739	HTTP Parser: No <meta name="author".. found
Source: https://outlook.office365.com/Encryption/OTPSigninPage.aspx?itemID=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375&OTPMessageId=07a29f9e-2737-4828-b9a8-20967eb5f72d%40PH8PR14MB5850.namprd14.prod.outlook.com&OTPReferenceId=1739	HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://outlook.office365.com/Encryption/OTPSigninPage.aspx?itemID=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375&OTPMessageId=07a29f9e-2737-4828-b9a8-20967eb5f72d%40PH8PR14MB5850.namprd14.prod.outlook.com&OTPReferenceId=1739	HTTP Parser: No <meta name="copyright".. found
Source: https://outlook.office365.com/Encryption/OTPSigninPage.aspx?itemID=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375&OTPMessageId=07a29f9e-2737-4828-b9a8-20967eb5f72d%40PH8PR14MB5850.namprd14.prod.outlook.com&OTPReferenceId=1739	HTTP Parser: No <meta name="copyright".. found

Compliance

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Networking

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: accounts.google.com

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Connects to IPs without corresponding DNS lookups

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /Encryption/retrieve.ashx?recipientemailaddress=mclary%40statenational.com&senderemailaddress=rmcbride%40chambless-math.com&senderorganization=AwGEAAAAAoAAAAADAQAAANPu52tb0WpLrMi8HJFYSWFPVT1jaGFtYmxlc3NtYXRoLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIxNEEwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTRAVEmk%2fx2JNil9Bqbi8411DTj1Db25maWd1cmF0aW9uLENOPWNoYW1ibGVzc21hdGgub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjE0QTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ%3d%3d&messageid=%3cPH7PR17MB6002566397FFB29FD58C31DDB8769%40PH7PR17MB6002.namprd17.prod.outlook.com%3e&cfmRecipient=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40chamblessmath.onmicrosoft.com&consumerEncryption=false&senderorgid=5526729b-5da8-4878-b9f5-96944d3c71c6&urldecoded=1&e4e_sdata=jyim%2fW3gAMDBa%2brcP5Vl4VcGKK4mqRbBKJdjMnFb43C5DDnaGHhsT2x5RsPsKAJ%2f%2fI1XttYjYpXGHsGxF9YlyI1W7NVZ1MEq%2b6jCPzMNfHUO15MH8axO8XWj58uYLkf07h2orr2fT2ODSh7u6vIen%2f0dfFO3Pjg2Eok09sg%2flUOqF1C7hbuPsDtUTJv3HywYmuqJMar2QFySAPZD1Lg56A5y2DOkXXMPuAq9AKyYfnDMjBV8R3KuoQRB0akyU%2bsF0uuVkmdtBvIC6uruSTA708%2fSRcOXwtY%2b2lszMqUVfW6fyRD5bxFBUmHAH1FhNqhWrlBEbEEjoaVP2W99gTiISg%3d%3d HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.102&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-104.0.5112.102Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Encryption/default.aspx?itemID=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375 HTTP/1.1Host: outlook.office365.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: X-E4E-CorrelationId=5c2bedbb-ed91-4fab-855b-f25101461f96; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40chamblessmath.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}@chamblessmath.onmicrosoft.com; X-RecipientEmailAddress=mclary@statenational.com|O03zb7R7WIUoDgchIDCN9p4F1jlu8CcKb9jVDqZ6ckHMyMWAZOsBj0Tl%2f%2bS%2fWx99d8U%2b5tdCBIg3RCWzPg3OROfXh2zTHh28B9oD4QPAK9zf3Alt6jMQTCts0sSyeREFLk5ZIStfdDF0eL4EQ1gltrTt7OVweA%2fZ0qdf2vU8RprzwYPiloe3s6YUh0QjijnPiZpvYGuFcMZcb2U1tkvVBjr5B6Mj88bfG5rAzKQOQvMWMzsUmihP4zVjg6YB69F4oQbZRl%2ftlKdWHTwecOlc5Xx%2bN%2fy0F5OLlVJx7ULoxGfij7eF0IUt8h2Ly%2fKqLQAv8f1Onn51kX88p4ggHt%2fQfA%3d%3d; X-SenderEmailAddress=rmcbride@chambless-math.com; X-SenderOrganization=AwGEAAAAAoAAAAADAQAAANPu52tb0WpLrMi8HJFYSWFPVT1jaGFtYmxlc3NtYXRoLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIxNEEwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTRAVEmk/x2JNil9Bqbi8411DTj1Db25maWd1cmF0aW9uLENOPWNoYW1ibGVzc21hdGgub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjE0QTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ==; X-MessageId=%3cPH7PR17MB6002566397FFB29FD58C31DDB8769%40PH7PR17MB6002.namprd17.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375=PH8PR14MB5850; X-OTPItemId=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375; X-SenderExternalOrganizationId=5526729b-5da8-4878-b9f5-96944d3c71c6
Source: global traffic	HTTP traffic detected: GET /Encryption/authenticationpage.aspx?st=Microsoft&ru=https%3a%2f%2foutlook.office365.com%2fEncryption%2fdefault.aspx%3fitemID%3dE4E_M_ba176c9b-d685-4da8-964e-1f47e3197375&e4e_sdata=f5t%2b8N82ca80zin7A5OCY1nbwvkq%2fJXXQ2z8S8tXEouBWi1uagEp38uNqPmpsYaRbGS7cWaCM728m8F805M%2fsaP9D2JHydyIPyNgAy1Ea7yJVt2W1Dkbb0OehuO4TX7X%2bB8KLhdSRbv2dLILQXr9VrCkhQF7trM2k6echkgXwGH8HlgdGyj7bbYxbAK4mGPy6Ndu9EUCm2SCzG0JbUQYAdARg9qUz4qHLcGjIguvok3og4Gn4lGI%2bwtyt193MqJyVh5NovjN4YwPZtxk7ltQf7OJs250GvvnNxX2%2b%2fholmoDyvD39amuNvugHd%2bYNs2csmvCA74KEo1JGGy7NEd4Dw%3d%3d HTTP/1.1Host: outlook.office365.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: X-E4E-CorrelationId=5c2bedbb-ed91-4fab-855b-f25101461f96; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40chamblessmath.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}@chamblessmath.onmicrosoft.com; X-RecipientEmailAddress=mclary@statenational.com|O03zb7R7WIUoDgchIDCN9p4F1jlu8CcKb9jVDqZ6ckHMyMWAZOsBj0Tl%2f%2bS%2fWx99d8U%2b5tdCBIg3RCWzPg3OROfXh2zTHh28B9oD4QPAK9zf3Alt6jMQTCts0sSyeREFLk5ZIStfdDF0eL4EQ1gltrTt7OVweA%2fZ0qdf2vU8RprzwYPiloe3s6YUh0QjijnPiZpvYGuFcMZcb2U1tkvVBjr5B6Mj88bfG5rAzKQOQvMWMzsUmihP4zVjg6YB69F4oQbZRl%2ftlKdWHTwecOlc5Xx%2bN%2fy0F5OLlVJx7ULoxGfij7eF0IUt8h2Ly%2fKqLQAv8f1Onn51kX88p4ggHt%2fQfA%3d%3d; X-SenderEmailAddress=rmcbride@chambless-math.com; X-SenderOrganization=AwGEAAAAAoAAAAADAQAAANPu52tb0WpLrMi8HJFYSWFPVT1jaGFtYmxlc3NtYXRoLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIxNEEwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTRAVEmk/x2JNil9Bqbi8411DTj1Db25maWd1cmF0aW9uLENOPWNoYW1ibGVzc21hdGgub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjE0QTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ==; X-MessageId=%3cPH7PR17MB6002566397FFB29FD58C31DDB8769%40PH7PR17MB6002.namprd17.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375=PH8PR14MB5850; X-OTPItemId=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375; X-SenderExternalOrganizationId=5526729b-5da8-4878-b9f5-96944d3c71c6
Source: global traffic	HTTP traffic detected: GET /Encryption/authentication.css HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://outlook.office365.com/Encryption/authenticationpage.aspx?st=Microsoft&ru=https%3a%2f%2foutlook.office365.com%2fEncryption%2fdefault.aspx%3fitemID%3dE4E_M_ba176c9b-d685-4da8-964e-1f47e3197375&e4e_sdata=f5t%2b8N82ca80zin7A5OCY1nbwvkq%2fJXXQ2z8S8tXEouBWi1uagEp38uNqPmpsYaRbGS7cWaCM728m8F805M%2fsaP9D2JHydyIPyNgAy1Ea7yJVt2W1Dkbb0OehuO4TX7X%2bB8KLhdSRbv2dLILQXr9VrCkhQF7trM2k6echkgXwGH8HlgdGyj7bbYxbAK4mGPy6Ndu9EUCm2SCzG0JbUQYAdARg9qUz4qHLcGjIguvok3og4Gn4lGI%2bwtyt193MqJyVh5NovjN4YwPZtxk7ltQf7OJs250GvvnNxX2%2b%2fholmoDyvD39amuNvugHd%2bYNs2csmvCA74KEo1JGGy7NEd4Dw%3d%3dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: X-E4E-CorrelationId=5c2bedbb-ed91-4fab-855b-f25101461f96; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40chamblessmath.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}@chamblessmath.onmicrosoft.com; X-RecipientEmailAddress=mclary@statenational.com|O03zb7R7WIUoDgchIDCN9p4F1jlu8CcKb9jVDqZ6ckHMyMWAZOsBj0Tl%2f%2bS%2fWx99d8U%2b5tdCBIg3RCWzPg3OROfXh2zTHh28B9oD4QPAK9zf3Alt6jMQTCts0sSyeREFLk5ZIStfdDF0eL4EQ1gltrTt7OVweA%2fZ0qdf2vU8RprzwYPiloe3s6YUh0QjijnPiZpvYGuFcMZcb2U1tkvVBjr5B6Mj88bfG5rAzKQOQvMWMzsUmihP4zVjg6YB69F4oQbZRl%2ftlKdWHTwecOlc5Xx%2bN%2fy0F5OLlVJx7ULoxGfij7eF0IUt8h2Ly%2fKqLQAv8f1Onn51kX88p4ggHt%2fQfA%3d%3d; X-SenderEmailAddress=rmcbride@chambless-math.com; X-SenderOrganization=AwGEAAAAAoAAAAADAQAAANPu52tb0WpLrMi8HJFYSWFPVT1jaGFtYmxlc3NtYXRoLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIxNEEwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTRAVEmk/x2JNil9Bqbi8411DTj1Db25maWd1cmF0aW9uLENOPWNoYW1ibGVzc21hdGgub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjE0QTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ==; X-MessageId=%3cPH7PR17MB6002566397FFB29FD58C31DDB8769%40PH7PR17MB6002.namprd17.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375=PH8PR14MB5850; X-OTPItemId=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375; X-SenderExternalOrganizationId=5526729b-5da8-4878-b9f5-96944d3c71c6; X-AnonResource=true
Source: global traffic	HTTP traffic detected: GET /Encryption/lock.png HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://outlook.office365.com/Encryption/authenticationpage.aspx?st=Microsoft&ru=https%3a%2f%2foutlook.office365.com%2fEncryption%2fdefault.aspx%3fitemID%3dE4E_M_ba176c9b-d685-4da8-964e-1f47e3197375&e4e_sdata=f5t%2b8N82ca80zin7A5OCY1nbwvkq%2fJXXQ2z8S8tXEouBWi1uagEp38uNqPmpsYaRbGS7cWaCM728m8F805M%2fsaP9D2JHydyIPyNgAy1Ea7yJVt2W1Dkbb0OehuO4TX7X%2bB8KLhdSRbv2dLILQXr9VrCkhQF7trM2k6echkgXwGH8HlgdGyj7bbYxbAK4mGPy6Ndu9EUCm2SCzG0JbUQYAdARg9qUz4qHLcGjIguvok3og4Gn4lGI%2bwtyt193MqJyVh5NovjN4YwPZtxk7ltQf7OJs250GvvnNxX2%2b%2fholmoDyvD39amuNvugHd%2bYNs2csmvCA74KEo1JGGy7NEd4Dw%3d%3dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: X-E4E-CorrelationId=5c2bedbb-ed91-4fab-855b-f25101461f96; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40chamblessmath.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}@chamblessmath.onmicrosoft.com; X-RecipientEmailAddress=mclary@statenational.com|O03zb7R7WIUoDgchIDCN9p4F1jlu8CcKb9jVDqZ6ckHMyMWAZOsBj0Tl%2f%2bS%2fWx99d8U%2b5tdCBIg3RCWzPg3OROfXh2zTHh28B9oD4QPAK9zf3Alt6jMQTCts0sSyeREFLk5ZIStfdDF0eL4EQ1gltrTt7OVweA%2fZ0qdf2vU8RprzwYPiloe3s6YUh0QjijnPiZpvYGuFcMZcb2U1tkvVBjr5B6Mj88bfG5rAzKQOQvMWMzsUmihP4zVjg6YB69F4oQbZRl%2ftlKdWHTwecOlc5Xx%2bN%2fy0F5OLlVJx7ULoxGfij7eF0IUt8h2Ly%2fKqLQAv8f1Onn51kX88p4ggHt%2fQfA%3d%3d; X-SenderEmailAddress=rmcbride@chambless-math.com; X-SenderOrganization=AwGEAAAAAoAAAAADAQAAANPu52tb0WpLrMi8HJFYSWFPVT1jaGFtYmxlc3NtYXRoLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIxNEEwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTRAVEmk/x2JNil9Bqbi8411DTj1Db25maWd1cmF0aW9uLENOPWNoYW1ibGVzc21hdGgub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjE0QTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ==; X-MessageId=%3cPH7PR17MB6002566397FFB29FD58C31DDB8769%40PH7PR17MB6002.namprd17.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375=PH8PR14MB5850; X-OTPItemId=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375; X-SenderExternalOrganizationId=5526729b-5da8-4878-b9f5-96944d3c71c6; X-AnonResource=true
Source: global traffic	HTTP traffic detected: GET /Encryption/liveid.png HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://outlook.office365.com/Encryption/authenticationpage.aspx?st=Microsoft&ru=https%3a%2f%2foutlook.office365.com%2fEncryption%2fdefault.aspx%3fitemID%3dE4E_M_ba176c9b-d685-4da8-964e-1f47e3197375&e4e_sdata=f5t%2b8N82ca80zin7A5OCY1nbwvkq%2fJXXQ2z8S8tXEouBWi1uagEp38uNqPmpsYaRbGS7cWaCM728m8F805M%2fsaP9D2JHydyIPyNgAy1Ea7yJVt2W1Dkbb0OehuO4TX7X%2bB8KLhdSRbv2dLILQXr9VrCkhQF7trM2k6echkgXwGH8HlgdGyj7bbYxbAK4mGPy6Ndu9EUCm2SCzG0JbUQYAdARg9qUz4qHLcGjIguvok3og4Gn4lGI%2bwtyt193MqJyVh5NovjN4YwPZtxk7ltQf7OJs250GvvnNxX2%2b%2fholmoDyvD39amuNvugHd%2bYNs2csmvCA74KEo1JGGy7NEd4Dw%3d%3dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: X-E4E-CorrelationId=5c2bedbb-ed91-4fab-855b-f25101461f96; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40chamblessmath.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}@chamblessmath.onmicrosoft.com; X-RecipientEmailAddress=mclary@statenational.com|O03zb7R7WIUoDgchIDCN9p4F1jlu8CcKb9jVDqZ6ckHMyMWAZOsBj0Tl%2f%2bS%2fWx99d8U%2b5tdCBIg3RCWzPg3OROfXh2zTHh28B9oD4QPAK9zf3Alt6jMQTCts0sSyeREFLk5ZIStfdDF0eL4EQ1gltrTt7OVweA%2fZ0qdf2vU8RprzwYPiloe3s6YUh0QjijnPiZpvYGuFcMZcb2U1tkvVBjr5B6Mj88bfG5rAzKQOQvMWMzsUmihP4zVjg6YB69F4oQbZRl%2ftlKdWHTwecOlc5Xx%2bN%2fy0F5OLlVJx7ULoxGfij7eF0IUt8h2Ly%2fKqLQAv8f1Onn51kX88p4ggHt%2fQfA%3d%3d; X-SenderEmailAddress=rmcbride@chambless-math.com; X-SenderOrganization=AwGEAAAAAoAAAAADAQAAANPu52tb0WpLrMi8HJFYSWFPVT1jaGFtYmxlc3NtYXRoLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIxNEEwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTRAVEmk/x2JNil9Bqbi8411DTj1Db25maWd1cmF0aW9uLENOPWNoYW1ibGVzc21hdGgub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjE0QTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ==; X-MessageId=%3cPH7PR17MB6002566397FFB29FD58C31DDB8769%40PH7PR17MB6002.namprd17.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375=PH8PR14MB5850; X-OTPItemId=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375; X-SenderExternalOrganizationId=5526729b-5da8-4878-b9f5-96944d3c71c6; X-AnonResource=true
Source: global traffic	HTTP traffic detected: GET /Encryption/lock.png HTTP/1.1Host: outlook.office365.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: X-E4E-CorrelationId=5c2bedbb-ed91-4fab-855b-f25101461f96; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40chamblessmath.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}@chamblessmath.onmicrosoft.com; X-RecipientEmailAddress=mclary@statenational.com|O03zb7R7WIUoDgchIDCN9p4F1jlu8CcKb9jVDqZ6ckHMyMWAZOsBj0Tl%2f%2bS%2fWx99d8U%2b5tdCBIg3RCWzPg3OROfXh2zTHh28B9oD4QPAK9zf3Alt6jMQTCts0sSyeREFLk5ZIStfdDF0eL4EQ1gltrTt7OVweA%2fZ0qdf2vU8RprzwYPiloe3s6YUh0QjijnPiZpvYGuFcMZcb2U1tkvVBjr5B6Mj88bfG5rAzKQOQvMWMzsUmihP4zVjg6YB69F4oQbZRl%2ftlKdWHTwecOlc5Xx%2bN%2fy0F5OLlVJx7ULoxGfij7eF0IUt8h2Ly%2fKqLQAv8f1Onn51kX88p4ggHt%2fQfA%3d%3d; X-SenderEmailAddress=rmcbride@chambless-math.com; X-SenderOrganization=AwGEAAAAAoAAAAADAQAAANPu52tb0WpLrMi8HJFYSWFPVT1jaGFtYmxlc3NtYXRoLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIxNEEwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTRAVEmk/x2JNil9Bqbi8411DTj1Db25maWd1cmF0aW9uLENOPWNoYW1ibGVzc21hdGgub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjE0QTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ==; X-MessageId=%3cPH7PR17MB6002566397FFB29FD58C31DDB8769%40PH7PR17MB6002.namprd17.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375=PH8PR14MB5850; X-OTPItemId=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375; X-SenderExternalOrganizationId=5526729b-5da8-4878-b9f5-96944d3c71c6; X-AnonResource=true
Source: global traffic	HTTP traffic detected: GET /Encryption/liveid.png HTTP/1.1Host: outlook.office365.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: X-E4E-CorrelationId=5c2bedbb-ed91-4fab-855b-f25101461f96; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40chamblessmath.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}@chamblessmath.onmicrosoft.com; X-RecipientEmailAddress=mclary@statenational.com|O03zb7R7WIUoDgchIDCN9p4F1jlu8CcKb9jVDqZ6ckHMyMWAZOsBj0Tl%2f%2bS%2fWx99d8U%2b5tdCBIg3RCWzPg3OROfXh2zTHh28B9oD4QPAK9zf3Alt6jMQTCts0sSyeREFLk5ZIStfdDF0eL4EQ1gltrTt7OVweA%2fZ0qdf2vU8RprzwYPiloe3s6YUh0QjijnPiZpvYGuFcMZcb2U1tkvVBjr5B6Mj88bfG5rAzKQOQvMWMzsUmihP4zVjg6YB69F4oQbZRl%2ftlKdWHTwecOlc5Xx%2bN%2fy0F5OLlVJx7ULoxGfij7eF0IUt8h2Ly%2fKqLQAv8f1Onn51kX88p4ggHt%2fQfA%3d%3d; X-SenderEmailAddress=rmcbride@chambless-math.com; X-SenderOrganization=AwGEAAAAAoAAAAADAQAAANPu52tb0WpLrMi8HJFYSWFPVT1jaGFtYmxlc3NtYXRoLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIxNEEwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTRAVEmk/x2JNil9Bqbi8411DTj1Db25maWd1cmF0aW9uLENOPWNoYW1ibGVzc21hdGgub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjE0QTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ==; X-MessageId=%3cPH7PR17MB6002566397FFB29FD58C31DDB8769%40PH7PR17MB6002.namprd17.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375=PH8PR14MB5850; X-OTPItemId=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375; X-SenderExternalOrganizationId=5526729b-5da8-4878-b9f5-96944d3c71c6; X-AnonResource=true
Source: global traffic	HTTP traffic detected: GET /Encryption/OTPSend.ashx?itemID=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375&OTPRef=SigninPage HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://outlook.office365.com/Encryption/authenticationpage.aspx?st=Microsoft&ru=https%3a%2f%2foutlook.office365.com%2fEncryption%2fdefault.aspx%3fitemID%3dE4E_M_ba176c9b-d685-4da8-964e-1f47e3197375&e4e_sdata=f5t%2b8N82ca80zin7A5OCY1nbwvkq%2fJXXQ2z8S8tXEouBWi1uagEp38uNqPmpsYaRbGS7cWaCM728m8F805M%2fsaP9D2JHydyIPyNgAy1Ea7yJVt2W1Dkbb0OehuO4TX7X%2bB8KLhdSRbv2dLILQXr9VrCkhQF7trM2k6echkgXwGH8HlgdGyj7bbYxbAK4mGPy6Ndu9EUCm2SCzG0JbUQYAdARg9qUz4qHLcGjIguvok3og4Gn4lGI%2bwtyt193MqJyVh5NovjN4YwPZtxk7ltQf7OJs250GvvnNxX2%2b%2fholmoDyvD39amuNvugHd%2bYNs2csmvCA74KEo1JGGy7NEd4Dw%3d%3dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: X-E4E-CorrelationId=5c2bedbb-ed91-4fab-855b-f25101461f96; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40chamblessmath.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}@chamblessmath.onmicrosoft.com; X-RecipientEmailAddress=mclary@statenational.com|O03zb7R7WIUoDgchIDCN9p4F1jlu8CcKb9jVDqZ6ckHMyMWAZOsBj0Tl%2f%2bS%2fWx99d8U%2b5tdCBIg3RCWzPg3OROfXh2zTHh28B9oD4QPAK9zf3Alt6jMQTCts0sSyeREFLk5ZIStfdDF0eL4EQ1gltrTt7OVweA%2fZ0qdf2vU8RprzwYPiloe3s6YUh0QjijnPiZpvYGuFcMZcb2U1tkvVBjr5B6Mj88bfG5rAzKQOQvMWMzsUmihP4zVjg6YB69F4oQbZRl%2ftlKdWHTwecOlc5Xx%2bN%2fy0F5OLlVJx7ULoxGfij7eF0IUt8h2Ly%2fKqLQAv8f1Onn51kX88p4ggHt%2fQfA%3d%3d; X-SenderEmailAddress=rmcbride@chambless-math.com; X-SenderOrganization=AwGEAAAAAoAAAAADAQAAANPu52tb0WpLrMi8HJFYSWFPVT1jaGFtYmxlc3NtYXRoLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIxNEEwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTRAVEmk/x2JNil9Bqbi8411DTj1Db25maWd1cmF0aW9uLENOPWNoYW1ibGVzc21hdGgub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjE0QTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ==; X-MessageId=%3cPH7PR17MB6002566397FFB29FD58C31DDB8769%40PH7PR17MB6002.namprd17.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375=PH8PR14MB5850; X-OTPItemId=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375; X-SenderExternalOrganizationId=5526729b-5da8-4878-b9f5-96944d3c71c6; X-AnonResource=true
Source: global traffic	HTTP traffic detected: GET /Encryption/OTPSigninPage.aspx?itemID=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375&OTPMessageId=07a29f9e-2737-4828-b9a8-20967eb5f72d%40PH8PR14MB5850.namprd14.prod.outlook.com&OTPReferenceId=1739 HTTP/1.1Host: outlook.office365.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://outlook.office365.com/Encryption/authenticationpage.aspx?st=Microsoft&ru=https%3a%2f%2foutlook.office365.com%2fEncryption%2fdefault.aspx%3fitemID%3dE4E_M_ba176c9b-d685-4da8-964e-1f47e3197375&e4e_sdata=f5t%2b8N82ca80zin7A5OCY1nbwvkq%2fJXXQ2z8S8tXEouBWi1uagEp38uNqPmpsYaRbGS7cWaCM728m8F805M%2fsaP9D2JHydyIPyNgAy1Ea7yJVt2W1Dkbb0OehuO4TX7X%2bB8KLhdSRbv2dLILQXr9VrCkhQF7trM2k6echkgXwGH8HlgdGyj7bbYxbAK4mGPy6Ndu9EUCm2SCzG0JbUQYAdARg9qUz4qHLcGjIguvok3og4Gn4lGI%2bwtyt193MqJyVh5NovjN4YwPZtxk7ltQf7OJs250GvvnNxX2%2b%2fholmoDyvD39amuNvugHd%2bYNs2csmvCA74KEo1JGGy7NEd4Dw%3d%3dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: X-E4E-CorrelationId=5c2bedbb-ed91-4fab-855b-f25101461f96; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40chamblessmath.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}@chamblessmath.onmicrosoft.com; X-RecipientEmailAddress=mclary@statenational.com|O03zb7R7WIUoDgchIDCN9p4F1jlu8CcKb9jVDqZ6ckHMyMWAZOsBj0Tl%2f%2bS%2fWx99d8U%2b5tdCBIg3RCWzPg3OROfXh2zTHh28B9oD4QPAK9zf3Alt6jMQTCts0sSyeREFLk5ZIStfdDF0eL4EQ1gltrTt7OVweA%2fZ0qdf2vU8RprzwYPiloe3s6YUh0QjijnPiZpvYGuFcMZcb2U1tkvVBjr5B6Mj88bfG5rAzKQOQvMWMzsUmihP4zVjg6YB69F4oQbZRl%2ftlKdWHTwecOlc5Xx%2bN%2fy0F5OLlVJx7ULoxGfij7eF0IUt8h2Ly%2fKqLQAv8f1Onn51kX88p4ggHt%2fQfA%3d%3d; X-SenderEmailAddress=rmcbride@chambless-math.com; X-SenderOrganization=AwGEAAAAAoAAAAADAQAAANPu52tb0WpLrMi8HJFYSWFPVT1jaGFtYmxlc3NtYXRoLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIxNEEwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTRAVEmk/x2JNil9Bqbi8411DTj1Db25maWd1cmF0aW9uLENOPWNoYW1ibGVzc21hdGgub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjE0QTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ==; X-MessageId=%3cPH7PR17MB6002566397FFB29FD58C31DDB8769%40PH7PR17MB6002.namprd17.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375=PH8PR14MB5850; X-OTPItemId=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375; X-SenderExternalOrganizationId=5526729b-5da8-4878-b9f5-96944d3c71c6; X-AnonResource=true
Source: global traffic	HTTP traffic detected: GET /Encryption/base.css HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://outlook.office365.com/Encryption/OTPSigninPage.aspx?itemID=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375&OTPMessageId=07a29f9e-2737-4828-b9a8-20967eb5f72d%40PH8PR14MB5850.namprd14.prod.outlook.com&OTPReferenceId=1739Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: X-E4E-CorrelationId=5c2bedbb-ed91-4fab-855b-f25101461f96; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40chamblessmath.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}@chamblessmath.onmicrosoft.com; X-RecipientEmailAddress=mclary@statenational.com|O03zb7R7WIUoDgchIDCN9p4F1jlu8CcKb9jVDqZ6ckHMyMWAZOsBj0Tl%2f%2bS%2fWx99d8U%2b5tdCBIg3RCWzPg3OROfXh2zTHh28B9oD4QPAK9zf3Alt6jMQTCts0sSyeREFLk5ZIStfdDF0eL4EQ1gltrTt7OVweA%2fZ0qdf2vU8RprzwYPiloe3s6YUh0QjijnPiZpvYGuFcMZcb2U1tkvVBjr5B6Mj88bfG5rAzKQOQvMWMzsUmihP4zVjg6YB69F4oQbZRl%2ftlKdWHTwecOlc5Xx%2bN%2fy0F5OLlVJx7ULoxGfij7eF0IUt8h2Ly%2fKqLQAv8f1Onn51kX88p4ggHt%2fQfA%3d%3d; X-SenderEmailAddress=rmcbride@chambless-math.com; X-SenderOrganization=AwGEAAAAAoAAAAADAQAAANPu52tb0WpLrMi8HJFYSWFPVT1jaGFtYmxlc3NtYXRoLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIxNEEwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTRAVEmk/x2JNil9Bqbi8411DTj1Db25maWd1cmF0aW9uLENOPWNoYW1ibGVzc21hdGgub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjE0QTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ==; X-MessageId=%3cPH7PR17MB6002566397FFB29FD58C31DDB8769%40PH7PR17MB6002.namprd17.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375=PH8PR14MB5850; X-OTPItemId=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375; X-SenderExternalOrganizationId=5526729b-5da8-4878-b9f5-96944d3c71c6; X-AnonResource=true
Source: global traffic	HTTP traffic detected: GET /Encryption/help.png HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://outlook.office365.com/Encryption/OTPSigninPage.aspx?itemID=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375&OTPMessageId=07a29f9e-2737-4828-b9a8-20967eb5f72d%40PH8PR14MB5850.namprd14.prod.outlook.com&OTPReferenceId=1739Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: X-E4E-CorrelationId=5c2bedbb-ed91-4fab-855b-f25101461f96; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40chamblessmath.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}@chamblessmath.onmicrosoft.com; X-RecipientEmailAddress=mclary@statenational.com|O03zb7R7WIUoDgchIDCN9p4F1jlu8CcKb9jVDqZ6ckHMyMWAZOsBj0Tl%2f%2bS%2fWx99d8U%2b5tdCBIg3RCWzPg3OROfXh2zTHh28B9oD4QPAK9zf3Alt6jMQTCts0sSyeREFLk5ZIStfdDF0eL4EQ1gltrTt7OVweA%2fZ0qdf2vU8RprzwYPiloe3s6YUh0QjijnPiZpvYGuFcMZcb2U1tkvVBjr5B6Mj88bfG5rAzKQOQvMWMzsUmihP4zVjg6YB69F4oQbZRl%2ftlKdWHTwecOlc5Xx%2bN%2fy0F5OLlVJx7ULoxGfij7eF0IUt8h2Ly%2fKqLQAv8f1Onn51kX88p4ggHt%2fQfA%3d%3d; X-SenderEmailAddress=rmcbride@chambless-math.com; X-SenderOrganization=AwGEAAAAAoAAAAADAQAAANPu52tb0WpLrMi8HJFYSWFPVT1jaGFtYmxlc3NtYXRoLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIxNEEwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTRAVEmk/x2JNil9Bqbi8411DTj1Db25maWd1cmF0aW9uLENOPWNoYW1ibGVzc21hdGgub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjE0QTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ==; X-MessageId=%3cPH7PR17MB6002566397FFB29FD58C31DDB8769%40PH7PR17MB6002.namprd17.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375=PH8PR14MB5850; X-OTPItemId=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375; X-SenderExternalOrganizationId=5526729b-5da8-4878-b9f5-96944d3c71c6; X-AnonResource=true
Source: global traffic	HTTP traffic detected: GET /Encryption/arrow.png HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://outlook.office365.com/Encryption/OTPSigninPage.aspx?itemID=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375&OTPMessageId=07a29f9e-2737-4828-b9a8-20967eb5f72d%40PH8PR14MB5850.namprd14.prod.outlook.com&OTPReferenceId=1739Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: X-E4E-CorrelationId=5c2bedbb-ed91-4fab-855b-f25101461f96; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40chamblessmath.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}@chamblessmath.onmicrosoft.com; X-RecipientEmailAddress=mclary@statenational.com|O03zb7R7WIUoDgchIDCN9p4F1jlu8CcKb9jVDqZ6ckHMyMWAZOsBj0Tl%2f%2bS%2fWx99d8U%2b5tdCBIg3RCWzPg3OROfXh2zTHh28B9oD4QPAK9zf3Alt6jMQTCts0sSyeREFLk5ZIStfdDF0eL4EQ1gltrTt7OVweA%2fZ0qdf2vU8RprzwYPiloe3s6YUh0QjijnPiZpvYGuFcMZcb2U1tkvVBjr5B6Mj88bfG5rAzKQOQvMWMzsUmihP4zVjg6YB69F4oQbZRl%2ftlKdWHTwecOlc5Xx%2bN%2fy0F5OLlVJx7ULoxGfij7eF0IUt8h2Ly%2fKqLQAv8f1Onn51kX88p4ggHt%2fQfA%3d%3d; X-SenderEmailAddress=rmcbride@chambless-math.com; X-SenderOrganization=AwGEAAAAAoAAAAADAQAAANPu52tb0WpLrMi8HJFYSWFPVT1jaGFtYmxlc3NtYXRoLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIxNEEwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTRAVEmk/x2JNil9Bqbi8411DTj1Db25maWd1cmF0aW9uLENOPWNoYW1ibGVzc21hdGgub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjE0QTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ==; X-MessageId=%3cPH7PR17MB6002566397FFB29FD58C31DDB8769%40PH7PR17MB6002.namprd17.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375=PH8PR14MB5850; X-OTPItemId=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375; X-SenderExternalOrganizationId=5526729b-5da8-4878-b9f5-96944d3c71c6; X-AnonResource=true
Source: global traffic	HTTP traffic detected: GET /Encryption/arrow.png HTTP/1.1Host: outlook.office365.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: X-E4E-CorrelationId=5c2bedbb-ed91-4fab-855b-f25101461f96; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40chamblessmath.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}@chamblessmath.onmicrosoft.com; X-RecipientEmailAddress=mclary@statenational.com|O03zb7R7WIUoDgchIDCN9p4F1jlu8CcKb9jVDqZ6ckHMyMWAZOsBj0Tl%2f%2bS%2fWx99d8U%2b5tdCBIg3RCWzPg3OROfXh2zTHh28B9oD4QPAK9zf3Alt6jMQTCts0sSyeREFLk5ZIStfdDF0eL4EQ1gltrTt7OVweA%2fZ0qdf2vU8RprzwYPiloe3s6YUh0QjijnPiZpvYGuFcMZcb2U1tkvVBjr5B6Mj88bfG5rAzKQOQvMWMzsUmihP4zVjg6YB69F4oQbZRl%2ftlKdWHTwecOlc5Xx%2bN%2fy0F5OLlVJx7ULoxGfij7eF0IUt8h2Ly%2fKqLQAv8f1Onn51kX88p4ggHt%2fQfA%3d%3d; X-SenderEmailAddress=rmcbride@chambless-math.com; X-SenderOrganization=AwGEAAAAAoAAAAADAQAAANPu52tb0WpLrMi8HJFYSWFPVT1jaGFtYmxlc3NtYXRoLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIxNEEwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTRAVEmk/x2JNil9Bqbi8411DTj1Db25maWd1cmF0aW9uLENOPWNoYW1ibGVzc21hdGgub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjE0QTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ==; X-MessageId=%3cPH7PR17MB6002566397FFB29FD58C31DDB8769%40PH7PR17MB6002.namprd17.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375=PH8PR14MB5850; X-OTPItemId=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375; X-SenderExternalOrganizationId=5526729b-5da8-4878-b9f5-96944d3c71c6; X-AnonResource=true
Source: global traffic	HTTP traffic detected: GET /Encryption/help.png HTTP/1.1Host: outlook.office365.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: X-E4E-CorrelationId=5c2bedbb-ed91-4fab-855b-f25101461f96; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40chamblessmath.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}@chamblessmath.onmicrosoft.com; X-RecipientEmailAddress=mclary@statenational.com|O03zb7R7WIUoDgchIDCN9p4F1jlu8CcKb9jVDqZ6ckHMyMWAZOsBj0Tl%2f%2bS%2fWx99d8U%2b5tdCBIg3RCWzPg3OROfXh2zTHh28B9oD4QPAK9zf3Alt6jMQTCts0sSyeREFLk5ZIStfdDF0eL4EQ1gltrTt7OVweA%2fZ0qdf2vU8RprzwYPiloe3s6YUh0QjijnPiZpvYGuFcMZcb2U1tkvVBjr5B6Mj88bfG5rAzKQOQvMWMzsUmihP4zVjg6YB69F4oQbZRl%2ftlKdWHTwecOlc5Xx%2bN%2fy0F5OLlVJx7ULoxGfij7eF0IUt8h2Ly%2fKqLQAv8f1Onn51kX88p4ggHt%2fQfA%3d%3d; X-SenderEmailAddress=rmcbride@chambless-math.com; X-SenderOrganization=AwGEAAAAAoAAAAADAQAAANPu52tb0WpLrMi8HJFYSWFPVT1jaGFtYmxlc3NtYXRoLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIxNEEwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTRAVEmk/x2JNil9Bqbi8411DTj1Db25maWd1cmF0aW9uLENOPWNoYW1ibGVzc21hdGgub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjE0QTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ==; X-MessageId=%3cPH7PR17MB6002566397FFB29FD58C31DDB8769%40PH7PR17MB6002.namprd17.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375=PH8PR14MB5850; X-OTPItemId=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375; X-SenderExternalOrganizationId=5526729b-5da8-4878-b9f5-96944d3c71c6; X-AnonResource=true
Source: global traffic	HTTP traffic detected: GET /Encryption/default.aspx?itemID=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375 HTTP/1.1Host: outlook.office365.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://outlook.office365.com/Encryption/OTPSigninPage.aspx?itemID=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375&OTPMessageId=07a29f9e-2737-4828-b9a8-20967eb5f72d%40PH8PR14MB5850.namprd14.prod.outlook.com&OTPReferenceId=1739Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: X-E4E-CorrelationId=5c2bedbb-ed91-4fab-855b-f25101461f96; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40chamblessmath.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}@chamblessmath.onmicrosoft.com; X-RecipientEmailAddress=mclary@statenational.com|O03zb7R7WIUoDgchIDCN9p4F1jlu8CcKb9jVDqZ6ckHMyMWAZOsBj0Tl%2f%2bS%2fWx99d8U%2b5tdCBIg3RCWzPg3OROfXh2zTHh28B9oD4QPAK9zf3Alt6jMQTCts0sSyeREFLk5ZIStfdDF0eL4EQ1gltrTt7OVweA%2fZ0qdf2vU8RprzwYPiloe3s6YUh0QjijnPiZpvYGuFcMZcb2U1tkvVBjr5B6Mj88bfG5rAzKQOQvMWMzsUmihP4zVjg6YB69F4oQbZRl%2ftlKdWHTwecOlc5Xx%2bN%2fy0F5OLlVJx7ULoxGfij7eF0IUt8h2Ly%2fKqLQAv8f1Onn51kX88p4ggHt%2fQfA%3d%3d; X-SenderEmailAddress=rmcbride@chambless-math.com; X-SenderOrganization=AwGEAAAAAoAAAAADAQAAANPu52tb0WpLrMi8HJFYSWFPVT1jaGFtYmxlc3NtYXRoLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIxNEEwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTRAVEmk/x2JNil9Bqbi8411DTj1Db25maWd1cmF0aW9uLENOPWNoYW1ibGVzc21hdGgub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjE0QTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ==; X-MessageId=%3cPH7PR17MB6002566397FFB29FD58C31DDB8769%40PH7PR17MB6002.namprd17.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375=PH8PR14MB5850; X-OTPItemId=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375; X-SenderExternalOrganizationId=5526729b-5da8-4878-b9f5-96944d3c71c6; X-AnonResource=true; X-OTPAuth=886dbfe5-2b22-45f6-b0c4-8ad70e770dee
Source: global traffic	HTTP traffic detected: GET /Encryption/E4EView.aspx?loc=en-US&itemID=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375 HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://outlook.office365.com/Encryption/default.aspx?itemID=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: clientTimeZoneOffset=120; X-E4E-CorrelationId=5c2bedbb-ed91-4fab-855b-f25101461f96; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40chamblessmath.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}@chamblessmath.onmicrosoft.com; X-RecipientEmailAddress=mclary@statenational.com|O03zb7R7WIUoDgchIDCN9p4F1jlu8CcKb9jVDqZ6ckHMyMWAZOsBj0Tl%2f%2bS%2fWx99d8U%2b5tdCBIg3RCWzPg3OROfXh2zTHh28B9oD4QPAK9zf3Alt6jMQTCts0sSyeREFLk5ZIStfdDF0eL4EQ1gltrTt7OVweA%2fZ0qdf2vU8RprzwYPiloe3s6YUh0QjijnPiZpvYGuFcMZcb2U1tkvVBjr5B6Mj88bfG5rAzKQOQvMWMzsUmihP4zVjg6YB69F4oQbZRl%2ftlKdWHTwecOlc5Xx%2bN%2fy0F5OLlVJx7ULoxGfij7eF0IUt8h2Ly%2fKqLQAv8f1Onn51kX88p4ggHt%2fQfA%3d%3d; X-SenderEmailAddress=rmcbride@chambless-math.com; X-SenderOrganization=AwGEAAAAAoAAAAADAQAAANPu52tb0WpLrMi8HJFYSWFPVT1jaGFtYmxlc3NtYXRoLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIxNEEwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTRAVEmk/x2JNil9Bqbi8411DTj1Db25maWd1cmF0aW9uLENOPWNoYW1ibGVzc21hdGgub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjE0QTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ==; X-MessageId=%3cPH7PR17MB6002566397FFB29FD58C31DDB8769%40PH7PR17MB6002.namprd17.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375=PH8PR14MB5850; X-OTPItemId=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375; X-SenderExternalOrganizationId=5526729b-5da8-4878-b9f5-96944d3c71c6; X-AnonResource=true; X-OTPAuth=886dbfe5-2b22-45f6-b0c4-8ad70e770dee; X-E4E-CANARY=IxwA5hRuUE6GXi9cGlgg9WB_H3icUdsYYRZoPp6Yjxtl6DoKzOiZZvb_00imNwaxH3cRsPvc25M.
Source: global traffic	HTTP traffic detected: GET /Encryption/zoomOverride.css HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: clientTimeZoneOffset=120; X-E4E-CorrelationId=5c2bedbb-ed91-4fab-855b-f25101461f96; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40chamblessmath.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}@chamblessmath.onmicrosoft.com; X-RecipientEmailAddress=mclary@statenational.com|O03zb7R7WIUoDgchIDCN9p4F1jlu8CcKb9jVDqZ6ckHMyMWAZOsBj0Tl%2f%2bS%2fWx99d8U%2b5tdCBIg3RCWzPg3OROfXh2zTHh28B9oD4QPAK9zf3Alt6jMQTCts0sSyeREFLk5ZIStfdDF0eL4EQ1gltrTt7OVweA%2fZ0qdf2vU8RprzwYPiloe3s6YUh0QjijnPiZpvYGuFcMZcb2U1tkvVBjr5B6Mj88bfG5rAzKQOQvMWMzsUmihP4zVjg6YB69F4oQbZRl%2ftlKdWHTwecOlc5Xx%2bN%2fy0F5OLlVJx7ULoxGfij7eF0IUt8h2Ly%2fKqLQAv8f1Onn51kX88p4ggHt%2fQfA%3d%3d; X-SenderEmailAddress=rmcbride@chambless-math.com; X-SenderOrganization=AwGEAAAAAoAAAAADAQAAANPu52tb0WpLrMi8HJFYSWFPVT1jaGFtYmxlc3NtYXRoLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIxNEEwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTRAVEmk/x2JNil9Bqbi8411DTj1Db25maWd1cmF0aW9uLENOPWNoYW1ibGVzc21hdGgub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjE0QTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ==; X-MessageId=%3cPH7PR17MB6002566397FFB29FD58C31DDB8769%40PH7PR17MB6002.namprd17.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375=PH8PR14MB5850; X-OTPItemId=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375; X-SenderExternalOrganizationId=5526729b-5da8-4878-b9f5-96944d3c71c6; X-AnonResource=true; X-OTPAuth=886dbfe5-2b22-45f6-b0c4-8ad70e770dee; X-E4E-CANARY=IxwA5hRuUE6GXi9cGlgg9WB_H3icUdsYYRZoPp6Yjxtl6DoKzOiZZvb_00imNwaxH3cRsPvc25M.
Source: global traffic	HTTP traffic detected: GET /Encryption/ping.e4e?itemID=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375&UA=0 HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"X-Requested-With: XMLHttpRequestsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: clientTimeZoneOffset=120; X-E4E-CorrelationId=5c2bedbb-ed91-4fab-855b-f25101461f96; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40chamblessmath.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}@chamblessmath.onmicrosoft.com; X-RecipientEmailAddress=mclary@statenational.com|O03zb7R7WIUoDgchIDCN9p4F1jlu8CcKb9jVDqZ6ckHMyMWAZOsBj0Tl%2f%2bS%2fWx99d8U%2b5tdCBIg3RCWzPg3OROfXh2zTHh28B9oD4QPAK9zf3Alt6jMQTCts0sSyeREFLk5ZIStfdDF0eL4EQ1gltrTt7OVweA%2fZ0qdf2vU8RprzwYPiloe3s6YUh0QjijnPiZpvYGuFcMZcb2U1tkvVBjr5B6Mj88bfG5rAzKQOQvMWMzsUmihP4zVjg6YB69F4oQbZRl%2ftlKdWHTwecOlc5Xx%2bN%2fy0F5OLlVJx7ULoxGfij7eF0IUt8h2Ly%2fKqLQAv8f1Onn51kX88p4ggHt%2fQfA%3d%3d; X-SenderEmailAddress=rmcbride@chambless-math.com; X-SenderOrganization=AwGEAAAAAoAAAAADAQAAANPu52tb0WpLrMi8HJFYSWFPVT1jaGFtYmxlc3NtYXRoLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIxNEEwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTRAVEmk/x2JNil9Bqbi8411DTj1Db25maWd1cmF0aW9uLENOPWNoYW1ibGVzc21hdGgub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjE0QTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ==; X-MessageId=%3cPH7PR17MB6002566397FFB29FD58C31DDB8769%40PH7PR17MB6002.namprd17.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375=PH8PR14MB5850; X-OTPItemId=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375; X-SenderExternalOrganizationId=5526729b-5da8-4878-b9f5-96944d3c71c6; X-AnonResource=true; X-OTPAuth=886dbfe5-2b22-45f6-b0c4-8ad70e770dee; X-E4E-CANARY=IxwA5hRuUE6GXi9cGlgg9WB_H3icUdsYYRZoPp6Yjxtl6DoKzOiZZvb_00imNwaxH3cRsPvc25M.
Source: global traffic	HTTP traffic detected: GET /Encryption/service.svc/s/GetFileAttachment?id=Y2E0MzRkMzYtYTY2Yy00ODA4LTkzYWItNGRiYzcyMGVkOTkx_E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375&X-E4E-CANARY=IxwA5hRuUE6GXi9cGlgg9WB_H3icUdsYYRZoPp6Yjxtl6DoKzOiZZvb_00imNwaxH3cRsPvc25M.&isImagePreview=True HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: clientTimeZoneOffset=120; MicrosoftApplicationsTelemetryDeviceId=af3618a9-f995-4e59-b5d6-6043b6305d19; MicrosoftApplicationsTelemetryFirstLaunchTime=2023-05-10T21:21:11.052Z; X-E4E-CorrelationId=5c2bedbb-ed91-4fab-855b-f25101461f96; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40chamblessmath.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}@chamblessmath.onmicrosoft.com; X-RecipientEmailAddress=mclary@statenational.com|O03zb7R7WIUoDgchIDCN9p4F1jlu8CcKb9jVDqZ6ckHMyMWAZOsBj0Tl%2f%2bS%2fWx99d8U%2b5tdCBIg3RCWzPg3OROfXh2zTHh28B9oD4QPAK9zf3Alt6jMQTCts0sSyeREFLk5ZIStfdDF0eL4EQ1gltrTt7OVweA%2fZ0qdf2vU8RprzwYPiloe3s6YUh0QjijnPiZpvYGuFcMZcb2U1tkvVBjr5B6Mj88bfG5rAzKQOQvMWMzsUmihP4zVjg6YB69F4oQbZRl%2ftlKdWHTwecOlc5Xx%2bN%2fy0F5OLlVJx7ULoxGfij7eF0IUt8h2Ly%2fKqLQAv8f1Onn51kX88p4ggHt%2fQfA%3d%3d; X-SenderEmailAddress=rmcbride@chambless-math.com; X-SenderOrganization=AwGEAAAAAoAAAAADAQAAANPu52tb0WpLrMi8HJFYSWFPVT1jaGFtYmxlc3NtYXRoLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIxNEEwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTRAVEmk/x2JNil9Bqbi8411DTj1Db25maWd1cmF0aW9uLENOPWNoYW1ibGVzc21hdGgub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjE0QTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ==; X-MessageId=%3cPH7PR17MB6002566397FFB29FD58C31DDB8769%40PH7PR17MB6002.namprd17.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375=PH8PR14MB5850; X-OTPItemId=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375; X-SenderExternalOrganizationId=5526729b-5da8-4878-b9f5-96944d3c71c6; X-AnonResource=true; X-OTPAuth=886dbfe5-2b22-45f6-b0c4-8ad70e770dee; X-E4E-CANARY=IxwA5hRuUE6GXi9cGlgg9WB_H3icUdsYYRZoPp6Yjxtl6DoKzOiZZvb_00imNwaxH3cRsPvc25M.; ClientId=5C488F42EA3B40D0B682387E548FEC66
Source: global traffic	HTTP traffic detected: GET /Encryption/service.svc/s/GetFileAttachment?id=MmZkMjdhMWEtZDQzMy00ZTViLTk5NDQtNzRmOWVmODVhMjVk_E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375&X-E4E-CANARY=IxwA5hRuUE6GXi9cGlgg9WB_H3icUdsYYRZoPp6Yjxtl6DoKzOiZZvb_00imNwaxH3cRsPvc25M.&isImagePreview=True HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: clientTimeZoneOffset=120; MicrosoftApplicationsTelemetryDeviceId=af3618a9-f995-4e59-b5d6-6043b6305d19; MicrosoftApplicationsTelemetryFirstLaunchTime=2023-05-10T21:21:11.052Z; X-E4E-CorrelationId=5c2bedbb-ed91-4fab-855b-f25101461f96; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40chamblessmath.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}@chamblessmath.onmicrosoft.com; X-RecipientEmailAddress=mclary@statenational.com|O03zb7R7WIUoDgchIDCN9p4F1jlu8CcKb9jVDqZ6ckHMyMWAZOsBj0Tl%2f%2bS%2fWx99d8U%2b5tdCBIg3RCWzPg3OROfXh2zTHh28B9oD4QPAK9zf3Alt6jMQTCts0sSyeREFLk5ZIStfdDF0eL4EQ1gltrTt7OVweA%2fZ0qdf2vU8RprzwYPiloe3s6YUh0QjijnPiZpvYGuFcMZcb2U1tkvVBjr5B6Mj88bfG5rAzKQOQvMWMzsUmihP4zVjg6YB69F4oQbZRl%2ftlKdWHTwecOlc5Xx%2bN%2fy0F5OLlVJx7ULoxGfij7eF0IUt8h2Ly%2fKqLQAv8f1Onn51kX88p4ggHt%2fQfA%3d%3d; X-SenderEmailAddress=rmcbride@chambless-math.com; X-SenderOrganization=AwGEAAAAAoAAAAADAQAAANPu52tb0WpLrMi8HJFYSWFPVT1jaGFtYmxlc3NtYXRoLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIxNEEwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTRAVEmk/x2JNil9Bqbi8411DTj1Db25maWd1cmF0aW9uLENOPWNoYW1ibGVzc21hdGgub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjE0QTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ==; X-MessageId=%3cPH7PR17MB6002566397FFB29FD58C31DDB8769%40PH7PR17MB6002.namprd17.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375=PH8PR14MB5850; X-OTPItemId=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375; X-SenderExternalOrganizationId=5526729b-5da8-4878-b9f5-96944d3c71c6; X-AnonResource=true; X-OTPAuth=886dbfe5-2b22-45f6-b0c4-8ad70e770dee; X-E4E-CANARY=IxwA5hRuUE6GXi9cGlgg9WB_H3icUdsYYRZoPp6Yjxtl6DoKzOiZZvb_00imNwaxH3cRsPvc25M.; ClientId=5C488F42EA3B40D0B682387E548FEC66
Source: global traffic	HTTP traffic detected: GET /Encryption/service.svc/s/GetFileAttachment?id=ZmRkMGFkMWItZDQ0MS00YWYyLThiYTktMmIzZjIyMWM4NjMz_E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375&X-E4E-CANARY=IxwA5hRuUE6GXi9cGlgg9WB_H3icUdsYYRZoPp6Yjxtl6DoKzOiZZvb_00imNwaxH3cRsPvc25M.&isImagePreview=True HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: clientTimeZoneOffset=120; MicrosoftApplicationsTelemetryDeviceId=af3618a9-f995-4e59-b5d6-6043b6305d19; MicrosoftApplicationsTelemetryFirstLaunchTime=2023-05-10T21:21:11.052Z; X-E4E-CorrelationId=5c2bedbb-ed91-4fab-855b-f25101461f96; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40chamblessmath.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}@chamblessmath.onmicrosoft.com; X-RecipientEmailAddress=mclary@statenational.com|O03zb7R7WIUoDgchIDCN9p4F1jlu8CcKb9jVDqZ6ckHMyMWAZOsBj0Tl%2f%2bS%2fWx99d8U%2b5tdCBIg3RCWzPg3OROfXh2zTHh28B9oD4QPAK9zf3Alt6jMQTCts0sSyeREFLk5ZIStfdDF0eL4EQ1gltrTt7OVweA%2fZ0qdf2vU8RprzwYPiloe3s6YUh0QjijnPiZpvYGuFcMZcb2U1tkvVBjr5B6Mj88bfG5rAzKQOQvMWMzsUmihP4zVjg6YB69F4oQbZRl%2ftlKdWHTwecOlc5Xx%2bN%2fy0F5OLlVJx7ULoxGfij7eF0IUt8h2Ly%2fKqLQAv8f1Onn51kX88p4ggHt%2fQfA%3d%3d; X-SenderEmailAddress=rmcbride@chambless-math.com; X-SenderOrganization=AwGEAAAAAoAAAAADAQAAANPu52tb0WpLrMi8HJFYSWFPVT1jaGFtYmxlc3NtYXRoLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIxNEEwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTRAVEmk/x2JNil9Bqbi8411DTj1Db25maWd1cmF0aW9uLENOPWNoYW1ibGVzc21hdGgub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjE0QTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ==; X-MessageId=%3cPH7PR17MB6002566397FFB29FD58C31DDB8769%40PH7PR17MB6002.namprd17.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375=PH8PR14MB5850; X-OTPItemId=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375; X-SenderExternalOrganizationId=5526729b-5da8-4878-b9f5-96944d3c71c6; X-AnonResource=true; X-OTPAuth=886dbfe5-2b22-45f6-b0c4-8ad70e770dee; X-E4E-CANARY=IxwA5hRuUE6GXi9cGlgg9WB_H3icUdsYYRZoPp6Yjxtl6DoKzOiZZvb_00imNwaxH3cRsPvc25M.; ClientId=5C488F42EA3B40D0B682387E548FEC66
Source: global traffic	HTTP traffic detected: GET /Encryption/service.svc/s/GetFileAttachment?id=Y2E0MzRkMzYtYTY2Yy00ODA4LTkzYWItNGRiYzcyMGVkOTkx_E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375&X-E4E-CANARY=IxwA5hRuUE6GXi9cGlgg9WB_H3icUdsYYRZoPp6Yjxtl6DoKzOiZZvb_00imNwaxH3cRsPvc25M.&isImagePreview=True HTTP/1.1Host: outlook.office365.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: clientTimeZoneOffset=120; MicrosoftApplicationsTelemetryDeviceId=af3618a9-f995-4e59-b5d6-6043b6305d19; MicrosoftApplicationsTelemetryFirstLaunchTime=2023-05-10T21:21:11.052Z; X-E4E-CorrelationId=5c2bedbb-ed91-4fab-855b-f25101461f96; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40chamblessmath.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}@chamblessmath.onmicrosoft.com; X-RecipientEmailAddress=mclary@statenational.com|O03zb7R7WIUoDgchIDCN9p4F1jlu8CcKb9jVDqZ6ckHMyMWAZOsBj0Tl%2f%2bS%2fWx99d8U%2b5tdCBIg3RCWzPg3OROfXh2zTHh28B9oD4QPAK9zf3Alt6jMQTCts0sSyeREFLk5ZIStfdDF0eL4EQ1gltrTt7OVweA%2fZ0qdf2vU8RprzwYPiloe3s6YUh0QjijnPiZpvYGuFcMZcb2U1tkvVBjr5B6Mj88bfG5rAzKQOQvMWMzsUmihP4zVjg6YB69F4oQbZRl%2ftlKdWHTwecOlc5Xx%2bN%2fy0F5OLlVJx7ULoxGfij7eF0IUt8h2Ly%2fKqLQAv8f1Onn51kX88p4ggHt%2fQfA%3d%3d; X-SenderEmailAddress=rmcbride@chambless-math.com; X-SenderOrganization=AwGEAAAAAoAAAAADAQAAANPu52tb0WpLrMi8HJFYSWFPVT1jaGFtYmxlc3NtYXRoLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIxNEEwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTRAVEmk/x2JNil9Bqbi8411DTj1Db25maWd1cmF0aW9uLENOPWNoYW1ibGVzc21hdGgub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjE0QTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ==; X-MessageId=%3cPH7PR17MB6002566397FFB29FD58C31DDB8769%40PH7PR17MB6002.namprd17.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375=PH8PR14MB5850; X-OTPItemId=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375; X-SenderExternalOrganizationId=5526729b-5da8-4878-b9f5-96944d3c71c6; X-AnonResource=true; X-OTPAuth=886dbfe5-2b22-45f6-b0c4-8ad70e770dee; X-E4E-CANARY=IxwA5hRuUE6GXi9cGlgg9WB_H3icUdsYYRZoPp6Yjxtl6DoKzOiZZvb_00imNwaxH3cRsPvc25M.; ClientId=5C488F42EA3B40D0B682387E548FEC66
Source: global traffic	HTTP traffic detected: GET /Encryption/service.svc/s/GetFileAttachment?id=ZmRkMGFkMWItZDQ0MS00YWYyLThiYTktMmIzZjIyMWM4NjMz_E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375&X-E4E-CANARY=IxwA5hRuUE6GXi9cGlgg9WB_H3icUdsYYRZoPp6Yjxtl6DoKzOiZZvb_00imNwaxH3cRsPvc25M.&isImagePreview=True HTTP/1.1Host: outlook.office365.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: clientTimeZoneOffset=120; MicrosoftApplicationsTelemetryDeviceId=af3618a9-f995-4e59-b5d6-6043b6305d19; MicrosoftApplicationsTelemetryFirstLaunchTime=2023-05-10T21:21:11.052Z; X-E4E-CorrelationId=5c2bedbb-ed91-4fab-855b-f25101461f96; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40chamblessmath.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}@chamblessmath.onmicrosoft.com; X-RecipientEmailAddress=mclary@statenational.com|O03zb7R7WIUoDgchIDCN9p4F1jlu8CcKb9jVDqZ6ckHMyMWAZOsBj0Tl%2f%2bS%2fWx99d8U%2b5tdCBIg3RCWzPg3OROfXh2zTHh28B9oD4QPAK9zf3Alt6jMQTCts0sSyeREFLk5ZIStfdDF0eL4EQ1gltrTt7OVweA%2fZ0qdf2vU8RprzwYPiloe3s6YUh0QjijnPiZpvYGuFcMZcb2U1tkvVBjr5B6Mj88bfG5rAzKQOQvMWMzsUmihP4zVjg6YB69F4oQbZRl%2ftlKdWHTwecOlc5Xx%2bN%2fy0F5OLlVJx7ULoxGfij7eF0IUt8h2Ly%2fKqLQAv8f1Onn51kX88p4ggHt%2fQfA%3d%3d; X-SenderEmailAddress=rmcbride@chambless-math.com; X-SenderOrganization=AwGEAAAAAoAAAAADAQAAANPu52tb0WpLrMi8HJFYSWFPVT1jaGFtYmxlc3NtYXRoLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIxNEEwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTRAVEmk/x2JNil9Bqbi8411DTj1Db25maWd1cmF0aW9uLENOPWNoYW1ibGVzc21hdGgub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjE0QTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ==; X-MessageId=%3cPH7PR17MB6002566397FFB29FD58C31DDB8769%40PH7PR17MB6002.namprd17.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375=PH8PR14MB5850; X-OTPItemId=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375; X-SenderExternalOrganizationId=5526729b-5da8-4878-b9f5-96944d3c71c6; X-AnonResource=true; X-OTPAuth=886dbfe5-2b22-45f6-b0c4-8ad70e770dee; X-E4E-CANARY=IxwA5hRuUE6GXi9cGlgg9WB_H3icUdsYYRZoPp6Yjxtl6DoKzOiZZvb_00imNwaxH3cRsPvc25M.; ClientId=5C488F42EA3B40D0B682387E548FEC66
Source: global traffic	HTTP traffic detected: GET /Encryption/service.svc/s/GetFileAttachment?id=MmZkMjdhMWEtZDQzMy00ZTViLTk5NDQtNzRmOWVmODVhMjVk_E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375&X-E4E-CANARY=IxwA5hRuUE6GXi9cGlgg9WB_H3icUdsYYRZoPp6Yjxtl6DoKzOiZZvb_00imNwaxH3cRsPvc25M.&isImagePreview=True HTTP/1.1Host: outlook.office365.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: clientTimeZoneOffset=120; MicrosoftApplicationsTelemetryDeviceId=af3618a9-f995-4e59-b5d6-6043b6305d19; MicrosoftApplicationsTelemetryFirstLaunchTime=2023-05-10T21:21:11.052Z; X-E4E-CorrelationId=5c2bedbb-ed91-4fab-855b-f25101461f96; X-OmeVersion=V2; X-ConsumerEncryption=false; X-CfmRecipientAddress=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40chamblessmath.onmicrosoft.com; E4EAnchorMailbox=SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}@chamblessmath.onmicrosoft.com; X-RecipientEmailAddress=mclary@statenational.com|O03zb7R7WIUoDgchIDCN9p4F1jlu8CcKb9jVDqZ6ckHMyMWAZOsBj0Tl%2f%2bS%2fWx99d8U%2b5tdCBIg3RCWzPg3OROfXh2zTHh28B9oD4QPAK9zf3Alt6jMQTCts0sSyeREFLk5ZIStfdDF0eL4EQ1gltrTt7OVweA%2fZ0qdf2vU8RprzwYPiloe3s6YUh0QjijnPiZpvYGuFcMZcb2U1tkvVBjr5B6Mj88bfG5rAzKQOQvMWMzsUmihP4zVjg6YB69F4oQbZRl%2ftlKdWHTwecOlc5Xx%2bN%2fy0F5OLlVJx7ULoxGfij7eF0IUt8h2Ly%2fKqLQAv8f1Onn51kX88p4ggHt%2fQfA%3d%3d; X-SenderEmailAddress=rmcbride@chambless-math.com; X-SenderOrganization=AwGEAAAAAoAAAAADAQAAANPu52tb0WpLrMi8HJFYSWFPVT1jaGFtYmxlc3NtYXRoLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIxNEEwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTRAVEmk/x2JNil9Bqbi8411DTj1Db25maWd1cmF0aW9uLENOPWNoYW1ibGVzc21hdGgub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjE0QTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ==; X-MessageId=%3cPH7PR17MB6002566397FFB29FD58C31DDB8769%40PH7PR17MB6002.namprd17.prod.outlook.com%3e; X-StoreObjectId=; X-RecipientPrimarySmtp=; E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375=PH8PR14MB5850; X-OTPItemId=E4E_M_ba176c9b-d685-4da8-964e-1f47e3197375; X-SenderExternalOrganizationId=5526729b-5da8-4878-b9f5-96944d3c71c6; X-AnonResource=true; X-OTPAuth=886dbfe5-2b22-45f6-b0c4-8ad70e770dee; X-E4E-CANARY=IxwA5hRuUE6GXi9cGlgg9WB_H3icUdsYYRZoPp6Yjxtl6DoKzOiZZvb_00imNwaxH3cRsPvc25M.; ClientId=5C488F42EA3B40D0B682387E548FEC66
Source: global traffic	HTTP traffic detected: GET /ajax/libs/modernizr/2.8.3/modernizr.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://indd.adobe.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /utilnav/9.1/utilitynav.css HTTP/1.1Host: prod.adobeccstatic.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://indd.adobe.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en_US/sdk.js HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://indd.adobe.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://indd.adobe.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en_US/sdk.js?hash=f8f956b655d4435c424576ac42c7bcbd HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://indd.adobe.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://indd.adobe.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b/ss/adbadobeinddprod/1/JS-1.4.2-D56H/s39955748728782?AQB=1&ndh=1&pf=1&t=10%2F4%2F2023%2023%3A21%3A18%203%20-120&D=D%3D&fid=571DF91AC0294E17-251E4671F3A91904&ce=UTF-8&cdp=2&fpCookieDomainPeriods=2&g=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=913&AQE=1 HTTP/1.1Host: sstats.adobe.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://indd.adobe.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s_fid=571DF91AC0294E17-251E4671F3A91904; s_cc=true
Source: global traffic	HTTP traffic detected: GET /b/ss/adbadobeinddprod/1/JS-1.4.2-D56H/s39955748728782?AQB=1&pccr=true&vidn=322E0566DB4CD139-4000098663F43E77&ndh=1&pf=1&t=10%2F4%2F2023%2023%3A21%3A18%203%20-120&D=D%3D&fid=571DF91AC0294E17-251E4671F3A91904&ce=UTF-8&cdp=2&fpCookieDomainPeriods=2&g=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=913&AQE=1 HTTP/1.1Host: sstats.adobe.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://indd.adobe.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s_fid=571DF91AC0294E17-251E4671F3A91904; s_cc=true; s_vi=[CS]v1|322E0566DB4CD139-4000098663F43E77[CE]
Source: global traffic	HTTP traffic detected: GET /tr/?id=643078795828978&ev=fb_page_view&dl=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&rl=&if=false&ts=1683753678507&sw=1280&sh=1024&at= HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://indd.adobe.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=643078795828978&ev=fb_page_view&dl=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&rl=&if=false&ts=1683753678507&sw=1280&sh=1024&at= HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b/ss/adbadobeinddprod/1/JS-1.4.2-D56H/s39955748728782?AQB=1&pccr=true&vidn=322E0566DB4CD139-4000098663F43E77&ndh=1&pf=1&t=10%2F4%2F2023%2023%3A21%3A18%203%20-120&D=D%3D&fid=571DF91AC0294E17-251E4671F3A91904&ce=UTF-8&cdp=2&fpCookieDomainPeriods=2&g=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=913&AQE=1 HTTP/1.1Host: sstats.adobe.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s_fid=571DF91AC0294E17-251E4671F3A91904; s_cc=true; s_vi=[CS]v1|322E0566DB4CD139-4000098663F43E77[CE]
Source: global traffic	HTTP traffic detected: GET /b/ss/adbadobeinddprod/1/JS-1.4.2-D56H/s31742487553624?AQB=1&ndh=1&pf=1&t=10%2F4%2F2023%2023%3A21%3A20%203%20-120&D=D%3D&fid=571DF91AC0294E17-251E4671F3A91904&ce=UTF-8&cdp=2&fpCookieDomainPeriods=2&pageName=indd.adobe.com%3ADocViewer%3AFirstPageLoaded&g=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&ch=indd.adobe.com&c1=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&v1=D%3Dc1&c2=1&v2=D%3Dc2&c3=1&v3=D%3Dc3&v4=D%3Dc4&c5=792px&v5=D%3Dc5&c6=612px&v6=D%3Dc6&v7=D%3Dc7&v8=D%3Dc8&c9=MAX%20Credit%20Union&v9=D%3Dc9&c10=false&v10=D%3Dc10&c11=false&v11=D%3Dc11&v12=D%3Dc12&v13=D%3Dc13&c14=&v14=D%3Dc14&v15=D%3Dc15&v16=D%3Dc16&c17=true&v17=D%3Dc17&v41=D%3Dc41&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=913&AQE=1 HTTP/1.1Host: sstats.adobe.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://indd.adobe.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s_fid=571DF91AC0294E17-251E4671F3A91904; s_cc=true; s_vi=[CS]v1|322E0566DB4CD139-4000098663F43E77[CE]
Source: global traffic	HTTP traffic detected: GET /b/ss/adbadobeinddprod/1/JS-1.4.2-D56H/s31035080537143?AQB=1&ndh=1&pf=1&t=10%2F4%2F2023%2023%3A21%3A20%203%20-120&D=D%3D&fid=571DF91AC0294E17-251E4671F3A91904&ce=UTF-8&cdp=2&fpCookieDomainPeriods=2&pageName=indd.adobe.com%3ADocViewer%3APageLoaded&g=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&ch=indd.adobe.com&c1=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&v1=D%3Dc1&c2=1&v2=D%3Dc2&c3=1&v3=D%3Dc3&v4=D%3Dc4&c5=792px&v5=D%3Dc5&c6=612px&v6=D%3Dc6&v7=D%3Dc7&v8=D%3Dc8&c9=MAX%20Credit%20Union&v9=D%3Dc9&c10=false&v10=D%3Dc10&c11=false&v11=D%3Dc11&v12=D%3Dc12&v13=D%3Dc13&c14=&v14=D%3Dc14&v15=D%3Dc15&v16=D%3Dc16&c17=true&v17=D%3Dc17&v41=D%3Dc41&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=913&AQE=1 HTTP/1.1Host: sstats.adobe.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://indd.adobe.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s_fid=571DF91AC0294E17-251E4671F3A91904; s_cc=true; s_vi=[CS]v1|322E0566DB4CD139-4000098663F43E77[CE]
Source: global traffic	HTTP traffic detected: GET /b/ss/adbadobeinddprod/1/JS-1.4.2-D56H/s31742487553624?AQB=1&ndh=1&pf=1&t=10%2F4%2F2023%2023%3A21%3A20%203%20-120&D=D%3D&fid=571DF91AC0294E17-251E4671F3A91904&ce=UTF-8&cdp=2&fpCookieDomainPeriods=2&pageName=indd.adobe.com%3ADocViewer%3AFirstPageLoaded&g=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&ch=indd.adobe.com&c1=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&v1=D%3Dc1&c2=1&v2=D%3Dc2&c3=1&v3=D%3Dc3&v4=D%3Dc4&c5=792px&v5=D%3Dc5&c6=612px&v6=D%3Dc6&v7=D%3Dc7&v8=D%3Dc8&c9=MAX%20Credit%20Union&v9=D%3Dc9&c10=false&v10=D%3Dc10&c11=false&v11=D%3Dc11&v12=D%3Dc12&v13=D%3Dc13&c14=&v14=D%3Dc14&v15=D%3Dc15&v16=D%3Dc16&c17=true&v17=D%3Dc17&v41=D%3Dc41&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=913&AQE=1 HTTP/1.1Host: sstats.adobe.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s_fid=571DF91AC0294E17-251E4671F3A91904; s_cc=true; s_vi=[CS]v1|322E0566DB4CD139-4000098663F43E77[CE]
Source: global traffic	HTTP traffic detected: GET /b/ss/adbadobeinddprod/1/JS-1.4.2-D56H/s33997086340312?AQB=1&ndh=1&pf=1&t=10%2F4%2F2023%2023%3A21%3A20%203%20-120&D=D%3D&fid=571DF91AC0294E17-251E4671F3A91904&ce=UTF-8&cdp=2&fpCookieDomainPeriods=2&pageName=indd.adobe.com%3ADocViewer%3AIFrameSrcURLs&g=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&ch=indd.adobe.com&c1=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&v1=D%3Dc1&c2=1&v2=D%3Dc2&c3=1&v3=D%3Dc3&v4=D%3Dc4&c5=792px&v5=D%3Dc5&c6=612px&v6=D%3Dc6&v7=D%3Dc7&v8=D%3Dc8&c9=MAX%20Credit%20Union&v9=D%3Dc9&c10=false&v10=D%3Dc10&c11=false&v11=D%3Dc11&v12=D%3Dc12&v13=D%3Dc13&c14=&v14=D%3Dc14&v15=D%3Dc15&v16=D%3Dc16&c17=true&v17=D%3Dc17&v41=D%3Dc41&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=913&AQE=1 HTTP/1.1Host: sstats.adobe.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://indd.adobe.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s_fid=571DF91AC0294E17-251E4671F3A91904; s_cc=true; s_vi=[CS]v1|322E0566DB4CD139-4000098663F43E77[CE]
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJOhywEIi6vMAQj7u8wBCN68zAEI6sDMAQidycwBCOPLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b/ss/adbadobeinddprod/1/JS-1.4.2-D56H/s39787157790741?AQB=1&ndh=1&pf=1&t=10%2F4%2F2023%2023%3A21%3A20%203%20-120&D=D%3D&fid=571DF91AC0294E17-251E4671F3A91904&ce=UTF-8&cdp=2&fpCookieDomainPeriods=2&pageName=indd.adobe.com%3ADocViewer%3AInsertHTMLSnippetsWithoutIFrame&g=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&ch=indd.adobe.com&c1=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&v1=D%3Dc1&c2=1&v2=D%3Dc2&c3=1&v3=D%3Dc3&v4=D%3Dc4&c5=792px&v5=D%3Dc5&c6=612px&v6=D%3Dc6&v7=D%3Dc7&v8=D%3Dc8&c9=MAX%20Credit%20Union&v9=D%3Dc9&c10=false&v10=D%3Dc10&c11=false&v11=D%3Dc11&v12=D%3Dc12&v13=D%3Dc13&c14=&v14=D%3Dc14&v15=D%3Dc15&v16=D%3Dc16&c17=true&v17=D%3Dc17&v41=D%3Dc41&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=913&AQE=1 HTTP/1.1Host: sstats.adobe.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://indd.adobe.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s_fid=571DF91AC0294E17-251E4671F3A91904; s_cc=true; s_vi=[CS]v1|322E0566DB4CD139-4000098663F43E77[CE]
Source: global traffic	HTTP traffic detected: GET /b/ss/adbadobeinddprod/1/JS-1.4.2-D56H/s31035080537143?AQB=1&ndh=1&pf=1&t=10%2F4%2F2023%2023%3A21%3A20%203%20-120&D=D%3D&fid=571DF91AC0294E17-251E4671F3A91904&ce=UTF-8&cdp=2&fpCookieDomainPeriods=2&pageName=indd.adobe.com%3ADocViewer%3APageLoaded&g=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&ch=indd.adobe.com&c1=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&v1=D%3Dc1&c2=1&v2=D%3Dc2&c3=1&v3=D%3Dc3&v4=D%3Dc4&c5=792px&v5=D%3Dc5&c6=612px&v6=D%3Dc6&v7=D%3Dc7&v8=D%3Dc8&c9=MAX%20Credit%20Union&v9=D%3Dc9&c10=false&v10=D%3Dc10&c11=false&v11=D%3Dc11&v12=D%3Dc12&v13=D%3Dc13&c14=&v14=D%3Dc14&v15=D%3Dc15&v16=D%3Dc16&c17=true&v17=D%3Dc17&v41=D%3Dc41&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=913&AQE=1 HTTP/1.1Host: sstats.adobe.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s_fid=571DF91AC0294E17-251E4671F3A91904; s_cc=true; s_vi=[CS]v1|322E0566DB4CD139-4000098663F43E77[CE]
Source: global traffic	HTTP traffic detected: GET /b/ss/adbadobeinddprod/1/JS-1.4.2-D56H/s33997086340312?AQB=1&ndh=1&pf=1&t=10%2F4%2F2023%2023%3A21%3A20%203%20-120&D=D%3D&fid=571DF91AC0294E17-251E4671F3A91904&ce=UTF-8&cdp=2&fpCookieDomainPeriods=2&pageName=indd.adobe.com%3ADocViewer%3AIFrameSrcURLs&g=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&ch=indd.adobe.com&c1=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&v1=D%3Dc1&c2=1&v2=D%3Dc2&c3=1&v3=D%3Dc3&v4=D%3Dc4&c5=792px&v5=D%3Dc5&c6=612px&v6=D%3Dc6&v7=D%3Dc7&v8=D%3Dc8&c9=MAX%20Credit%20Union&v9=D%3Dc9&c10=false&v10=D%3Dc10&c11=false&v11=D%3Dc11&v12=D%3Dc12&v13=D%3Dc13&c14=&v14=D%3Dc14&v15=D%3Dc15&v16=D%3Dc16&c17=true&v17=D%3Dc17&v41=D%3Dc41&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=913&AQE=1 HTTP/1.1Host: sstats.adobe.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s_fid=571DF91AC0294E17-251E4671F3A91904; s_cc=true; s_vi=[CS]v1|322E0566DB4CD139-4000098663F43E77[CE]
Source: global traffic	HTTP traffic detected: GET /b/ss/adbadobeinddprod/1/JS-1.4.2-D56H/s39787157790741?AQB=1&ndh=1&pf=1&t=10%2F4%2F2023%2023%3A21%3A20%203%20-120&D=D%3D&fid=571DF91AC0294E17-251E4671F3A91904&ce=UTF-8&cdp=2&fpCookieDomainPeriods=2&pageName=indd.adobe.com%3ADocViewer%3AInsertHTMLSnippetsWithoutIFrame&g=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&ch=indd.adobe.com&c1=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&v1=D%3Dc1&c2=1&v2=D%3Dc2&c3=1&v3=D%3Dc3&v4=D%3Dc4&c5=792px&v5=D%3Dc5&c6=612px&v6=D%3Dc6&v7=D%3Dc7&v8=D%3Dc8&c9=MAX%20Credit%20Union&v9=D%3Dc9&c10=false&v10=D%3Dc10&c11=false&v11=D%3Dc11&v12=D%3Dc12&v13=D%3Dc13&c14=&v14=D%3Dc14&v15=D%3Dc15&v16=D%3Dc16&c17=true&v17=D%3Dc17&v41=D%3Dc41&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=913&AQE=1 HTTP/1.1Host: sstats.adobe.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s_fid=571DF91AC0294E17-251E4671F3A91904; s_cc=true; s_vi=[CS]v1|322E0566DB4CD139-4000098663F43E77[CE]
Source: global traffic	HTTP traffic detected: GET /b/ss/adbadobeinddprod/1/JS-1.4.2-D56H/s38088832359856?AQB=1&ndh=1&pf=1&t=10%2F4%2F2023%2023%3A21%3A25%203%20-120&D=D%3D&fid=571DF91AC0294E17-251E4671F3A91904&ce=UTF-8&cdp=2&fpCookieDomainPeriods=2&pageName=indd.adobe.com%3ADocViewer%3AIdleMode&g=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&ch=indd.adobe.com&c1=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&v1=D%3Dc1&c2=1&v2=D%3Dc2&c3=1&v3=D%3Dc3&v4=D%3Dc4&c5=792px&v5=D%3Dc5&c6=612px&v6=D%3Dc6&v7=D%3Dc7&v8=D%3Dc8&c9=MAX%20Credit%20Union&v9=D%3Dc9&c10=false&v10=D%3Dc10&c11=false&v11=D%3Dc11&v12=D%3Dc12&v13=D%3Dc13&c14=&v14=D%3Dc14&v15=D%3Dc15&v16=D%3Dc16&c17=true&v17=D%3Dc17&v41=D%3Dc41&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=913&AQE=1 HTTP/1.1Host: sstats.adobe.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://indd.adobe.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s_fid=571DF91AC0294E17-251E4671F3A91904; s_cc=true; s_vi=[CS]v1|322E0566DB4CD139-4000098663F43E77[CE]
Source: global traffic	HTTP traffic detected: GET /b/ss/adbadobeinddprod/1/JS-1.4.2-D56H/s38088832359856?AQB=1&ndh=1&pf=1&t=10%2F4%2F2023%2023%3A21%3A25%203%20-120&D=D%3D&fid=571DF91AC0294E17-251E4671F3A91904&ce=UTF-8&cdp=2&fpCookieDomainPeriods=2&pageName=indd.adobe.com%3ADocViewer%3AIdleMode&g=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&ch=indd.adobe.com&c1=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&v1=D%3Dc1&c2=1&v2=D%3Dc2&c3=1&v3=D%3Dc3&v4=D%3Dc4&c5=792px&v5=D%3Dc5&c6=612px&v6=D%3Dc6&v7=D%3Dc7&v8=D%3Dc8&c9=MAX%20Credit%20Union&v9=D%3Dc9&c10=false&v10=D%3Dc10&c11=false&v11=D%3Dc11&v12=D%3Dc12&v13=D%3Dc13&c14=&v14=D%3Dc14&v15=D%3Dc15&v16=D%3Dc16&c17=true&v17=D%3Dc17&v41=D%3Dc41&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=913&AQE=1 HTTP/1.1Host: sstats.adobe.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s_fid=571DF91AC0294E17-251E4671F3A91904; s_cc=true; s_vi=[CS]v1|322E0566DB4CD139-4000098663F43E77[CE]
Source: global traffic	HTTP traffic detected: GET /?n6=iyqI HTTP/1.1Host: mymax.mycumax.usConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://indd.adobe.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?n6=iyqI HTTP/1.1Host: mymax.mycumax.usConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://mymax.mycumax.us/?n6=iyqIAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: r872Gb=NDRmNjc4Y2UtY2FmNi00NzBkLWE5OGMtMGI3ZDAwZTkyZWUyOmE4ZWFkZTI5LWFkYjMtNGM4Yi05Y2YyLTM3OGVhMzQ1MmYzOQ==
Source: global traffic	HTTP traffic detected: GET /b/ss/adbadobeinddprod/1/JS-1.4.2-D56H/s38343569712510?AQB=1&ndh=1&pf=1&t=10%2F4%2F2023%2023%3A21%3A31%203%20-120&D=D%3D&fid=571DF91AC0294E17-251E4671F3A91904&ce=UTF-8&cdp=2&fpCookieDomainPeriods=2&pageName=indd.adobe.com%3ADocViewer%3AIdleMode&g=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&ch=indd.adobe.com&c1=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&v1=D%3Dc1&c2=1&v2=D%3Dc2&c3=1&v3=D%3Dc3&v4=D%3Dc4&c5=792px&v5=D%3Dc5&c6=612px&v6=D%3Dc6&v7=D%3Dc7&v8=D%3Dc8&c9=MAX%20Credit%20Union&v9=D%3Dc9&c10=false&v10=D%3Dc10&c11=false&v11=D%3Dc11&v12=D%3Dc12&v13=D%3Dc13&c14=&v14=D%3Dc14&v15=D%3Dc15&v16=D%3Dc16&c17=true&v17=D%3Dc17&v41=D%3Dc41&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=913&AQE=1 HTTP/1.1Host: sstats.adobe.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://indd.adobe.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s_fid=571DF91AC0294E17-251E4671F3A91904; s_cc=true; s_vi=[CS]v1|322E0566DB4CD139-4000098663F43E77[CE]
Source: global traffic	HTTP traffic detected: GET /b/ss/adbadobeinddprod/1/JS-1.4.2-D56H/s38343569712510?AQB=1&ndh=1&pf=1&t=10%2F4%2F2023%2023%3A21%3A31%203%20-120&D=D%3D&fid=571DF91AC0294E17-251E4671F3A91904&ce=UTF-8&cdp=2&fpCookieDomainPeriods=2&pageName=indd.adobe.com%3ADocViewer%3AIdleMode&g=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&ch=indd.adobe.com&c1=https%3A%2F%2Findd.adobe.com%2Fview%2Ff01290b3-e6da-4be6-bd56-03690b124393&v1=D%3Dc1&c2=1&v2=D%3Dc2&c3=1&v3=D%3Dc3&v4=D%3Dc4&c5=792px&v5=D%3Dc5&c6=612px&v6=D%3Dc6&v7=D%3Dc7&v8=D%3Dc8&c9=MAX%20Credit%20Union&v9=D%3Dc9&c10=false&v10=D%3Dc10&c11=false&v11=D%3Dc11&v12=D%3Dc12&v13=D%3Dc13&c14=&v14=D%3Dc14&v15=D%3Dc15&v16=D%3Dc16&c17=true&v17=D%3Dc17&v41=D%3Dc41&s=1280x1024&c=24&j=1.6&v=N&k=Y&bw=1280&bh=913&AQE=1 HTTP/1.1Host: sstats.adobe.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: s_fid=571DF91AC0294E17-251E4671F3A91904; s_cc=true; s_vi=[CS]v1|322E0566DB4CD139-4000098663F43E77[CE]
Source: global traffic	HTTP traffic detected: GET /websocket/hook/?r872Gb=NDRmNjc4Y2VjYWY2NDcwZGE5OGMwYjdkMDBlOTJlZTI= HTTP/1.1Host: mymax.mycumax.usConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://mymax.mycumax.usSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: r872Gb=NDRmNjc4Y2UtY2FmNi00NzBkLWE5OGMtMGI3ZDAwZTkyZWUyOmE4ZWFkZTI5LWFkYjMtNGM4Yi05Y2YyLTM3OGVhMzQ1MmYzOQ==Sec-WebSocket-Key: UqmS8+OCPKTcMYpFX0G4Tw==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /?n6=iyqI&sso_reload=true HTTP/1.1Host: mymax.mycumax.usConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://mymax.mycumax.us/?n6=iyqIAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: r872Gb=NDRmNjc4Y2UtY2FmNi00NzBkLWE5OGMtMGI3ZDAwZTkyZWUyOmE4ZWFkZTI5LWFkYjMtNGM4Yi05Y2YyLTM3OGVhMzQ1MmYzOQ==; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: mymax.mycumax.usConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mymax.mycumax.us/?n6=iyqIAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: r872Gb=NDRmNjc4Y2UtY2FmNi00NzBkLWE5OGMtMGI3ZDAwZTkyZWUyOmE4ZWFkZTI5LWFkYjMtNGM4Yi05Y2YyLTM3OGVhMzQ1MmYzOQ==; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: live.mycumax.usConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8Purpose: prefetchSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://mymax.mycumax.us/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: r872Gb=NDRmNjc4Y2UtY2FmNi00NzBkLWE5OGMtMGI3ZDAwZTkyZWUyOmE4ZWFkZTI5LWFkYjMtNGM4Yi05Y2YyLTM3OGVhMzQ1MmYzOQ==
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_x5mnFQnvPBIbGR3P86RaUg2.js HTTP/1.1Host: 5d42383b-44f678ce.mycumax.usConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"Origin: https://mymax.mycumax.ussec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://mymax.mycumax.us/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Found strings which match to known social media urls

Source: chromecache_236.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/t3hOLs8wlXy/ equals www.facebook.com (Facebook)
Source: chromecache_236.2.dr	String found in binary or memory: __d("FBPixelEndpoint",["invariant","FBEventsParamList","FBEventsUtils"],(function(a,b,c,d,e,f,g,h){"use strict";var i="https://www.facebook.com/tr/",j=location.href,k=window.top!==window,l=document.referrer;function m(a,b,d,e){e===void 0&&(e={});var f=new(c("FBEventsParamList"))();f.append("id",a);f.append("ev",b);f.append("dl",j);f.append("rl",l);f.append("if",k);f.append("ts",new Date().valueOf());f.append("cd",d);f.append("sw",window.screen.width);f.append("sh",window.screen.height);for(a in e)f.append(a,e[a]);return f}function a(a,b,c,d){a=m(a,b,c,d);b=a.toQueryString();2048>(i+"?"+b).length?n(i,b):o(i,a)}function n(a,b){var c=new Image();c.src=a+"?"+b}function o(a,b){var c="fb"+Math.random().toString().replace(".",""),e=document.createElement("form");e.method="post";e.action=a;e.target=c;e.acceptCharset="utf-8";e.style.display="none";a=!!(window.attachEvent&&!window.addEventListener);a=a?'<iframe name="'+c+'">':"iframe";var f=document.createElement(a);f instanceof HTMLIFrameElement||h(0,20659);f.src="javascript:false";f.id=c;f.name=c;e.appendChild(f);d("FBEventsUtils").listenOnce(f,"load",function(){b.each(function(a,b){var c=document.createElement("input");c.name=a;c.value=b;e.appendChild(c)}),d("FBEventsUtils").listenOnce(f,"load",function(){var a;(a=e.parentNode)==null?void 0:a.removeChild(e)}),e.submit()});(a=document.body)==null?void 0:a.appendChild(e)}g.sendEvent=a}),98); equals www.facebook.com (Facebook)
Source: chromecache_236.2.dr	String found in binary or memory: __d("LiveChatPluginConstants",["$InternalEnum"],(function(a,b,c,d,e,f){"use strict";a="LiveChatEvent/";c="mqtt";d=b("$InternalEnum")({CONNECTED:"Connected",CONNECTING:"Connecting",DISCONNECTED:"Disconnected"});e=250;b=a+"close_timestamps";var g=a+"reset_badging",h=a+"state",i=a+"switch_account",j=a+"typing",k=a+"unread_count",l=a+"update_message_list",m="platform/plugins/connect/guest",n=a+"guest_upgrade_success",o=a+"guest_upgrade_success_incognito",p=a+"navigate_to_welcome_page",q="platform/plugins/connect/access_token";a=a+"start_re_engagement";var r=124,s=187,t=24,u=424,v=288,w=313,x=219,y=40,z=36,A=24,B=18,C=708,D=540,E=244,F=202,G=509,H=430,I=6,J=0,K=1,L=-1,M="messaging_plugin",N=8634e4,O="#8A8D91",P="entrypoint:customer_chat_plugin",Q=0,R=1,S=2,T=3,U="new_message_update",V="initial_fetch",W=5e3,X="https://www.facebook.com/business/help/1661027437357021";f.MQTT=c;f.MQTTGatewayConnectionState=d;f.LOGIN_CHECK_INTERVAL=e;f.CLOSE_TIMESTAMPS=b;f.RESET_BADGING=g;f.STATE_UPDATE=h;f.SWITCH_ACCOUNT=i;f.TYPING_UPDATE=j;f.UNREAD_COUNT_UPDATE=k;f.UPDATE_MESSAGE_LIST=l;f.GUEST_MODE_CONNECT=m;f.GUEST_UPGRADE_SUCCESS=n;f.GUEST_UPGRADE_SUCCESS_INCOGNITO=o;f.NAVIGATE_TO_WELCOME_PAGE=p;f.ACCESS_TOKEN_LOGIN=q;f.START_RE_ENGAGEMENT=a;f.PROMPT_FALLBACK_HEIGHT=r;f.PROMPT_REDESIGN_FALLBACK_HEIGHT=s;f.PROMPT_CONTAINER_PADDING_HEIGHT=t;f.WELCOME_PAGE_GUEST_FALLBACK_HEIGHT=u;f.WELCOME_PAGE_NO_GUEST_FALLBACK_HEIGHT=v;f.WELCOME_PAGE_GUEST_FALLBACK_HEIGHT_WITH_COMPACT=w;f.WELCOME_PAGE_NO_GUEST_FALLBACK_HEIGHT_WITH_COMPACT=x;f.WELCOME_PAGE_ATTRIBUTION_OFFEST_HEIGHT=y;f.WELCOME_PAGE_ATTRIBUTION_OFFSET_HEIGHT_WITH_COMPACT=z;f.MAIN_IFRAME_PADDING_HEIGHT=A;f.MAIN_IFRAME_PADDING_HEIGHT_WITH_COMPACT=B;f.THREAD_PAGE_HEIGHT=C;f.THREAD_PAGE_HEIGHT_COMPACT=D;f.RE_ENGAGEMENT_COLLAPSED_DIALOG_HEIGHT=E;f.RE_ENGAGEMENT_COLLAPSED_DIALOG_HEIGHT_COMPACT=F;f.RE_ENGAGEMENT_EXPANDED_DIALOG_HEIGHT=G;f.RE_ENGAGEMENT_EXPANDED_DIALOG_HEIGHT_COMPACT=H;f.GREETING_TEXT_BOTTOM_SPACING_OFFEST=I;f.LOGGED_IN_CHAT_MODE=J;f.GUEST_CHAT_MODE=K;f.INVALID_CHAT_MODE=L;f.MESSENGING_PLUGIN=M;f.GUEST_SESSION_STORAGE_VALIDITY_MS=N;f.GUEST_SEND_BUTTON_COLOR_EMPTY_INPUT=O;f.LIVE_CHAT_ENTRYPOINT_ATTRIBUTION_TAG=P;f.ITP_CONSISTENCY_UNKNOWN_LOGGED_OUT=Q;f.ITP_CONSISTENCY_CONSISTENT_LOGGED_IN=R;f.ITP_CONSISTENCY_INCONSISTENT=S;f.ITP_CONSISTENCY_CONSISTENT_NO_ITP=T;f.NEW_MESSAGE_UPDATE=U;f.INITIAL_FETCH=V;f.PLUGIN_FADE_DELAY=W;f.HELP_DEX_LINK=X}),66); equals www.facebook.com (Facebook)
Source: chromecache_236.2.dr	String found in binary or memory: window.FB&&window.FB.__buffer&&(window.__buffer=babelHelpers["extends"]({},window.FB.__buffer)); } }).call(global);})();} catch (e) {var i = new Image();i.crossOrigin = 'anonymous';i.dataset.testid = 'fbSDKErrorReport';i.src='https://www.facebook.com/platform/scribe_endpoint.php/?c=jssdk_error&m='+encodeURIComponent('{"error":"LOAD", "extra": {"name":"'+e.name+'","line":"'+(e.lineNumber||e.line)+'","script":"'+(e.fileName||e.sourceURL||e.script||"sdk.js")+'","stack":"'+(e.stackTrace||e.stack)+'","revision":"1007468797","namespace":"FB","message":"'+e.message+'"}}');document.body.appendChild(i);} equals www.facebook.com (Facebook)

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 10 May 2023 21:21:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 23c7aa75-d306-45f6-8c42-89b8c4d20300x-ms-ests-server: 2.1.15357.5 - WEULR2 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://75b7f1f6-44f678ce.mycumax.us/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}referrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *Strict-Transport-Security: max-age=31536000; includeSubDomains

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 10 May 2023 21:21:33 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: b7988acc-256d-4804-ad46-818831741a00x-ms-ests-server: 2.1.15357.5 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://75b7f1f6-44f678ce.mycumax.us/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}referrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *Strict-Transport-Security: max-age=31536000; includeSubDomains

URLs found in memory or binary data

Source: chromecache_292.2.dr	String found in binary or memory: http://bugs.jquery.com/ticket/10859)
Source: chromecache_268.2.dr, chromecache_254.2.dr	String found in binary or memory: http://github.com/jquery/globalize
Source: chromecache_292.2.dr	String found in binary or memory: http://gsgd.co.uk/sandbox/jquery/easing/
Source: chromecache_292.2.dr, chromecache_251.2.dr	String found in binary or memory: http://hammerjs.github.io/
Source: chromecache_220.2.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000007735dac8
Source: chromecache_220.2.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000007735dacd
Source: chromecache_220.2.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000007735dad8
Source: chromecache_220.2.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000007735dada
Source: chromecache_292.2.dr, chromecache_252.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_230.2.dr, chromecache_222.2.dr, chromecache_275.2.dr	String found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.12.4.min.js
Source: chromecache_292.2.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_236.2.dr	String found in binary or memory: https://itunes.apple.com/us/app/messenger/id454638411
Source: chromecache_275.2.dr	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=3a9ddf38-83f3-4ea1-a33a-ecf
Source: chromecache_273.2.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
Source: chromecache_287.2.dr	String found in binary or memory: https://mymax.mycumax.us/?n6=iyqI
Source: chromecache_273.2.dr	String found in binary or memory: https://o365exchange.visualstudio.com/IP%20Engineering/_queries/edit/1648312
Source: chromecache_220.2.dr	String found in binary or memory: https://p.typekit.net/p.css?s=1&k=urt5zuu&ht=tk&f=7180.7181.7182.7183&a=108349166&app=typekit&e=css
Source: chromecache_236.2.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.facebook.orca
Source: chromecache_230.2.dr	String found in binary or memory: https://r1.res.office365.com/
Source: chromecache_230.2.dr	String found in binary or memory: https://r1.res.office365.com/owa/prem/15.20.6363.32/resources
Source: chromecache_230.2.dr	String found in binary or memory: https://r1.res.office365.com/owa/prem/15.20.6363.32/resources/images/0
Source: chromecache_230.2.dr, chromecache_222.2.dr, chromecache_275.2.dr	String found in binary or memory: https://r1.res.office365.com/owa/prem/15.20.6363.32/resources/images/0/favicon.ico
Source: chromecache_230.2.dr	String found in binary or memory: https://r1.res.office365.com/owa/prem/15.20.6363.32/resources/images/0/sprite1.mouse.css
Source: chromecache_230.2.dr	String found in binary or memory: https://r1.res.office365.com/owa/prem/15.20.6363.32/resources/images/0/sprite1.mouse.png
Source: chromecache_230.2.dr	String found in binary or memory: https://r1.res.office365.com/owa/prem/15.20.6363.32/resources/styles/#LCL
Source: chromecache_230.2.dr	String found in binary or memory: https://r1.res.office365.com/owa/prem/15.20.6363.32/resources/styles/0/boot.genericmail.mouse.css
Source: chromecache_230.2.dr, chromecache_222.2.dr	String found in binary or memory: https://r1.res.office365.com/owa/prem/15.20.6363.32/resources/styles/fonts/office365icons.eot?#iefix
Source: chromecache_230.2.dr, chromecache_222.2.dr	String found in binary or memory: https://r1.res.office365.com/owa/prem/15.20.6363.32/resources/styles/fonts/office365icons.ttf
Source: chromecache_230.2.dr, chromecache_222.2.dr	String found in binary or memory: https://r1.res.office365.com/owa/prem/15.20.6363.32/resources/styles/fonts/office365icons.woff
Source: chromecache_230.2.dr	String found in binary or memory: https://r1.res.office365.com/owa/prem/15.20.6363.32/scripts
Source: chromecache_230.2.dr	String found in binary or memory: https://r1.res.office365.com/owa/prem/15.20.6363.32/scripts/boot.genericmail.0.mouse.js
Source: chromecache_230.2.dr	String found in binary or memory: https://r1.res.office365.com/owa/prem/15.20.6363.32/scripts/boot.genericmail.1.mouse.js
Source: chromecache_230.2.dr	String found in binary or memory: https://r1.res.office365.com/owa/prem/15.20.6363.32/scripts/en/boot.genericmail.mouse.strings.locali
Source: chromecache_230.2.dr	String found in binary or memory: https://r1.res.office365.com/owa/prem/15.20.6363.32/scripts/ext/en/osfruntime_strings.js
Source: chromecache_230.2.dr	String found in binary or memory: https://r1.res.office365.com/owa/prem/15.20.6363.32/scripts/globalize/globalize.culture.en-us.js
Source: chromecache_230.2.dr, chromecache_222.2.dr	String found in binary or memory: https://r1.res.office365.com/owa/prem/fonts/segoeui-bold.ttf
Source: chromecache_230.2.dr, chromecache_222.2.dr	String found in binary or memory: https://r1.res.office365.com/owa/prem/fonts/segoeui-bold.woff
Source: chromecache_230.2.dr, chromecache_222.2.dr	String found in binary or memory: https://r1.res.office365.com/owa/prem/fonts/segoeui-light.ttf
Source: chromecache_230.2.dr, chromecache_222.2.dr	String found in binary or memory: https://r1.res.office365.com/owa/prem/fonts/segoeui-light.woff
Source: chromecache_230.2.dr, chromecache_222.2.dr	String found in binary or memory: https://r1.res.office365.com/owa/prem/fonts/segoeui-regular.ttf
Source: chromecache_230.2.dr, chromecache_222.2.dr	String found in binary or memory: https://r1.res.office365.com/owa/prem/fonts/segoeui-regular.woff
Source: chromecache_230.2.dr, chromecache_222.2.dr	String found in binary or memory: https://r1.res.office365.com/owa/prem/fonts/segoeui-semibold.ttf
Source: chromecache_230.2.dr, chromecache_222.2.dr	String found in binary or memory: https://r1.res.office365.com/owa/prem/fonts/segoeui-semibold.woff
Source: chromecache_230.2.dr, chromecache_222.2.dr	String found in binary or memory: https://r1.res.office365.com/owa/prem/fonts/segoeui-semilight.ttf
Source: chromecache_230.2.dr, chromecache_222.2.dr	String found in binary or memory: https://r1.res.office365.com/owa/prem/fonts/segoeui-semilight.woff
Source: chromecache_292.2.dr, chromecache_272.2.dr	String found in binary or memory: https://raw.githubusercontent.com/jakearchibald/es6-promise/master/LICENSE
Source: chromecache_230.2.dr, chromecache_222.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/office-ui-fabric-js/1.2.0/css/fabric.components.mi
Source: chromecache_230.2.dr, chromecache_222.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/office-ui-fabric-js/1.2.0/css/fabric.min.css
Source: chromecache_230.2.dr, chromecache_222.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/office-ui-fabric-js/1.2.0/js/fabric.min.js
Source: chromecache_220.2.dr	String found in binary or memory: https://use.typekit.net/af/5c07ba/00000000000000007735dad8/30/a?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_220.2.dr	String found in binary or memory: https://use.typekit.net/af/5c07ba/00000000000000007735dad8/30/d?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_220.2.dr	String found in binary or memory: https://use.typekit.net/af/5c07ba/00000000000000007735dad8/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_220.2.dr	String found in binary or memory: https://use.typekit.net/af/650f2d/00000000000000007735dada/30/a?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_220.2.dr	String found in binary or memory: https://use.typekit.net/af/650f2d/00000000000000007735dada/30/d?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_220.2.dr	String found in binary or memory: https://use.typekit.net/af/650f2d/00000000000000007735dada/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_220.2.dr	String found in binary or memory: https://use.typekit.net/af/95bf80/00000000000000007735dacd/30/a?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_220.2.dr	String found in binary or memory: https://use.typekit.net/af/95bf80/00000000000000007735dacd/30/d?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_220.2.dr	String found in binary or memory: https://use.typekit.net/af/95bf80/00000000000000007735dacd/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_220.2.dr	String found in binary or memory: https://use.typekit.net/af/c0160f/00000000000000007735dac8/30/a?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_220.2.dr	String found in binary or memory: https://use.typekit.net/af/c0160f/00000000000000007735dac8/30/d?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_220.2.dr	String found in binary or memory: https://use.typekit.net/af/c0160f/00000000000000007735dac8/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: chromecache_236.2.dr	String found in binary or memory: https://www.internalfb.com/intern/invariant/

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E

System Summary

Yara signature match

Source: 8.pages.csv, type: HTML	Matched rule: apt_CN_Tetris_JS_advanced_1 date = 2020-09-06, author = @imp0rtp3 (modified by Florian Roth), description = Unique code from Jetriz, Swid & Jeniva of the Tetris framework, reference = https://imp0rtp3.wordpress.com/2021/08/12/tetris
Source: 8.pages.csv, type: HTML	Matched rule: SUSP_obfuscated_JS_obfuscatorio date = 2021-08-25, author = @imp0rtp3, description = Detects JS obfuscation done by the js obfuscator (often malicious), score = , reference = https://obfuscator.io

Classification label

Source: classification engine

Classification label: mal52.phis.win@26/100@34/13

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://outlook.office365.com/Encryption/retrieve.ashx?recipientemailaddress=mclary%40statenational.com&senderemailaddress=rmcbride%40chambless-math.com&senderorganization=AwGEAAAAAoAAAAADAQAAANPu52tb0WpLrMi8HJFYSWFPVT1jaGFtYmxlc3NtYXRoLm9ubWljcm9zb2Z0LmNvbSxPVT1NaWNyb3NvZnQgRXhjaGFuZ2UgSG9zdGVkIE9yZ2FuaXphdGlvbnMsREM9TkFNUFIxNEEwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTRAVEmk%2fx2JNil9Bqbi8411DTj1Db25maWd1cmF0aW9uLENOPWNoYW1ibGVzc21hdGgub25taWNyb3NvZnQuY29tLENOPUNvbmZpZ3VyYXRpb25Vbml0cyxEQz1OQU1QUjE0QTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NAQ%3d%3d&messageid=%3cPH7PR17MB6002566397FFB29FD58C31DDB8769%40PH7PR17MB6002.namprd17.prod.outlook.com%3e&cfmRecipient=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40chamblessmath.onmicrosoft.com&consumerEncryption=false&senderorgid=5526729b-5da8-4878-b9f5-96944d3c71c6&urldecoded=1&e4e_sdata=jyim%2fW3gAMDBa%2brcP5Vl4VcGKK4mqRbBKJdjMnFb43C5DDnaGHhsT2x5RsPsKAJ%2f%2fI1XttYjYpXGHsGxF9YlyI1W7NVZ1MEq%2b6jCPzMNfHUO15MH8axO8XWj58uYLkf07h2orr2fT2ODSh7u6vIen%2f0dfFO3Pjg2Eok09sg%2flUOqF1C7hbuPsDtUTJv3HywYmuqJMar2QFySAPZD1Lg56A5y2DOkXXMPuAq9AKyYfnDMjBV8R3KuoQRB0akyU%2bsF0uuVkmdtBvIC6uruSTA708%2fSRcOXwtY%2b2lszMqUVfW6fyRD5bxFBUmHAH1FhNqhWrlBEbEEjoaVP2W99gTiISg%3d%3d
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1800,i,12180169254427686293,31633173100013072,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1800,i,12180169254427686293,31633173100013072,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Creates files inside the program directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior