Edit tour

Windows Analysis Report
https://estgirls-my.sharepoint.com/:b:/g/personal/s7958766_estg_moe_gov_sa/EeCN0MAR0F5NufUZkT2Q-mcBn4v13Ov8FQ0oi798Dgtayg?e=zTKNmK

Overview

General Information

Sample URL:	https://estgirls-my.sharepoint.com/:b:/g/personal/s7958766_estg_moe_gov_sa/EeCN0MAR0F5NufUZkT2Q-mcBn4v13Ov8FQ0oi798Dgtayg?e=zTKNmK
Analysis ID:	1428968
Infos:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish54

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

Drops files with a non-matching file extension (content does not match file extension)

Found iframes

HTML body contains low number of good links

HTML title does not match URL

Phishing site detected (based on OCR NLP Model)

Submit button contains javascript call

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5848 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3624 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1964,i,6069389677495694469,7174581422029952172,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6356 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://estgirls-my.sharepoint.com/:b:/g/personal/s7958766_estg_moe_gov_sa/EeCN0MAR0F5NufUZkT2Q-mcBn4v13Ov8FQ0oi798Dgtayg?e=zTKNmK" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
1.5.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.6.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.7.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.11.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Phishing site detected (based on favicon image match)

Source: https://belovedkittenrescue.com	Matcher: Template: microsoft matched with high similarity
Source: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491602979817971.ZGM3ODI3MmYtMmZhYi00ZmFmLThkZWEtM2Q3N2Q5NjQyZjM5YWY3NDM0ZTEtZmI0Yy00Yjk4LTkxODUtYjEzOTY5ODVlZDIx&ui_locales=en-US&mkt=en-US&client-request-id=a67d96ca-27dd-4840-a2c4-a24b8295837e&state=Syu44JejXp8LqEQ8ywvgVxEnArYu1QcYhl-Pjbt8Eb1gV1TwVt4Bbi_S0ujC6W1Y35lH-Juduiv30Rgn2iNnyWaxJOj1wIYIXOHdFcuxUXV6YgKOr4Uu8HaqYFLj7UfQFh7tYALG3-zJu7_aQQbErMOwU-u7imKtReh_ivYEweWc_bobgs8C9H1b7ooj0ONkkl81AeG_dRo4RaYMlNCBJrRtujJ2ob0xiwEdQhb1SW_AxV5tFXAWFZIVz_Zt_Jj-W8CyxgXd3loRZsHHgX4Ccg&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish54

Source: Yara match	File source: 1.5.pages.csv, type: HTML
Source: Yara match	File source: 2.6.pages.csv, type: HTML
Source: Yara match	File source: 2.7.pages.csv, type: HTML
Source: Yara match	File source: 2.11.pages.csv, type: HTML

Phishing site detected (based on image similarity)

Source: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491602979817971.ZGM3ODI3MmYtMmZhYi00ZmFmLThkZWEtM2Q3N2Q5NjQyZjM5YWY3NDM0ZTEtZmI0Yy00Yjk4LTkxODUtYjEzOTY5ODVlZDIx&ui_locales=en-US&mkt=en-US&client-request-id=a67d96ca-27dd-4840-a2c4-a24b8295837e&state=Syu44JejXp8LqEQ8ywvgVxEnArYu1QcYhl-Pjbt8Eb1gV1TwVt4Bbi_S0ujC6W1Y35lH-Juduiv30Rgn2iNnyWaxJOj1wIYIXOHdFcuxUXV6YgKOr4Uu8HaqYFLj7UfQFh7tYALG3-zJu7_aQQbErMOwU-u7imKtReh_ivYEweWc_bobgs8C9H1b7ooj0ONkkl81AeG_dRo4RaYMlNCBJrRtujJ2ob0xiwEdQhb1SW_AxV5tFXAWFZIVz_Zt_Jj-W8CyxgXd3loRZsHHgX4Ccg&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true

Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site detected (based on logo match)

Matcher: Template: microsoft matched

Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26client_id%3d4765445b-32c6-49b0-83e6-1d93765276ca%26mkt%3dEN-US%26opid%3d4796DC2E20C549C9%26opidt%3d1713563522%26uaid%3da67d96ca27dd4840a2c4a24b8295837e%26contextid%3dC6B7CECBF7EF37A3%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&uaid=a67d96ca27dd4840a2c4a24b8295837e&suc=4765445b-32c6-49b0-83e6-1d93765276ca&lic=1

HTTP Parser: Iframe src: https://fpt.live.com/?session_id=a67d96ca27dd4840a2c4a24b8295837e&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SU&mkt=EN-US

Source: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491602979817971.ZGM3ODI3MmYtMmZhYi00ZmFmLThkZWEtM2Q3N2Q5NjQyZjM5YWY3NDM0ZTEtZmI0Yy00Yjk4LTkxODUtYjEzOTY5ODVlZDIx&ui_locales=en-US&mkt=en-US&client-request-id=a67d96ca-27dd-4840-a2c4-a24b8295837e&state=Syu44JejXp8LqEQ8ywvgVxEnArYu1QcYhl-Pjbt8Eb1gV1TwVt4Bbi_S0ujC6W1Y35lH-Juduiv30Rgn2iNnyWaxJOj1wIYIXOHdFcuxUXV6YgKOr4Uu8HaqYFLj7UfQFh7tYALG3-zJu7_aQQbErMOwU-u7imKtReh_ivYEweWc_bobgs8C9H1b7ooj0ONkkl81AeG_dRo4RaYMlNCBJrRtujJ2ob0xiwEdQhb1SW_AxV5tFXAWFZIVz_Zt_Jj-W8CyxgXd3loRZsHHgX4Ccg&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0	HTTP Parser: Number of links: 0
Source: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491602979817971.ZGM3ODI3MmYtMmZhYi00ZmFmLThkZWEtM2Q3N2Q5NjQyZjM5YWY3NDM0ZTEtZmI0Yy00Yjk4LTkxODUtYjEzOTY5ODVlZDIx&ui_locales=en-US&mkt=en-US&client-request-id=a67d96ca-27dd-4840-a2c4-a24b8295837e&state=Syu44JejXp8LqEQ8ywvgVxEnArYu1QcYhl-Pjbt8Eb1gV1TwVt4Bbi_S0ujC6W1Y35lH-Juduiv30Rgn2iNnyWaxJOj1wIYIXOHdFcuxUXV6YgKOr4Uu8HaqYFLj7UfQFh7tYALG3-zJu7_aQQbErMOwU-u7imKtReh_ivYEweWc_bobgs8C9H1b7ooj0ONkkl81AeG_dRo4RaYMlNCBJrRtujJ2ob0xiwEdQhb1SW_AxV5tFXAWFZIVz_Zt_Jj-W8CyxgXd3loRZsHHgX4Ccg&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: Number of links: 0
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26client_id%3d4765445b-32c6-49b0-83e6-1d93765276ca%26mkt%3dEN-US%26opid%3d4796DC2E20C549C9%26opidt%3d1713563522%26uaid%3da67d96ca27dd4840a2c4a24b8295837e%26contextid%3dC6B7CECBF7EF37A3%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&uaid=a67d96ca27dd4840a2c4a24b8295837e&suc=4765445b-32c6-49b0-83e6-1d93765276ca&lic=1	HTTP Parser: Number of links: 0

Source: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491602979817971.ZGM3ODI3MmYtMmZhYi00ZmFmLThkZWEtM2Q3N2Q5NjQyZjM5YWY3NDM0ZTEtZmI0Yy00Yjk4LTkxODUtYjEzOTY5ODVlZDIx&ui_locales=en-US&mkt=en-US&client-request-id=a67d96ca-27dd-4840-a2c4-a24b8295837e&state=Syu44JejXp8LqEQ8ywvgVxEnArYu1QcYhl-Pjbt8Eb1gV1TwVt4Bbi_S0ujC6W1Y35lH-Juduiv30Rgn2iNnyWaxJOj1wIYIXOHdFcuxUXV6YgKOr4Uu8HaqYFLj7UfQFh7tYALG3-zJu7_aQQbErMOwU-u7imKtReh_ivYEweWc_bobgs8C9H1b7ooj0ONkkl81AeG_dRo4RaYMlNCBJrRtujJ2ob0xiwEdQhb1SW_AxV5tFXAWFZIVz_Zt_Jj-W8CyxgXd3loRZsHHgX4Ccg&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491602979817971.ZGM3ODI3MmYtMmZhYi00ZmFmLThkZWEtM2Q3N2Q5NjQyZjM5YWY3NDM0ZTEtZmI0Yy00Yjk4LTkxODUtYjEzOTY5ODVlZDIx&ui_locales=en-US&mkt=en-US&client-request-id=a67d96ca-27dd-4840-a2c4-a24b8295837e&state=Syu44JejXp8LqEQ8ywvgVxEnArYu1QcYhl-Pjbt8Eb1gV1TwVt4Bbi_S0ujC6W1Y35lH-Juduiv30Rgn2iNnyWaxJOj1wIYIXOHdFcuxUXV6YgKOr4Uu8HaqYFLj7UfQFh7tYALG3-zJu7_aQQbErMOwU-u7imKtReh_ivYEweWc_bobgs8C9H1b7ooj0ONkkl81AeG_dRo4RaYMlNCBJrRtujJ2ob0xiwEdQhb1SW_AxV5tFXAWFZIVz_Zt_Jj-W8CyxgXd3loRZsHHgX4Ccg&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26client_id%3d4765445b-32c6-49b0-83e6-1d93765276ca%26mkt%3dEN-US%26opid%3d4796DC2E20C549C9%26opidt%3d1713563522%26uaid%3da67d96ca27dd4840a2c4a24b8295837e%26contextid%3dC6B7CECBF7EF37A3%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&uaid=a67d96ca27dd4840a2c4a24b8295837e&suc=4765445b-32c6-49b0-83e6-1d93765276ca&lic=1	HTTP Parser: Title: Create account does not match URL

Source: Chrome DOM: 0.4

ML Model on OCR Text: Matched 96.6% probability on "contract.pdf Info 1/1 DOCUMENT IS PRIVATE C.I .1CK TO IJM .OC.K Note: This Document was shared via Office365 and registered as private. Recipients "

Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26client_id%3d4765445b-32c6-49b0-83e6-1d93765276ca%26mkt%3dEN-US%26opid%3d4796DC2E20C549C9%26opidt%3d1713563522%26uaid%3da67d96ca27dd4840a2c4a24b8295837e%26contextid%3dC6B7CECBF7EF37A3%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&uaid=a67d96ca27dd4840a2c4a24b8295837e&suc=4765445b-32c6-49b0-83e6-1d93765276ca&lic=1	HTTP Parser: On click: OnBack(); return false;
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26client_id%3d4765445b-32c6-49b0-83e6-1d93765276ca%26mkt%3dEN-US%26opid%3d4796DC2E20C549C9%26opidt%3d1713563522%26uaid%3da67d96ca27dd4840a2c4a24b8295837e%26contextid%3dC6B7CECBF7EF37A3%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&uaid=a67d96ca27dd4840a2c4a24b8295837e&suc=4765445b-32c6-49b0-83e6-1d93765276ca&lic=1	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26client_id%3d4765445b-32c6-49b0-83e6-1d93765276ca%26mkt%3dEN-US%26opid%3d4796DC2E20C549C9%26opidt%3d1713563522%26uaid%3da67d96ca27dd4840a2c4a24b8295837e%26contextid%3dC6B7CECBF7EF37A3%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&uaid=a67d96ca27dd4840a2c4a24b8295837e&suc=4765445b-32c6-49b0-83e6-1d93765276ca&lic=1	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26client_id%3d4765445b-32c6-49b0-83e6-1d93765276ca%26mkt%3dEN-US%26opid%3d4796DC2E20C549C9%26opidt%3d1713563522%26uaid%3da67d96ca27dd4840a2c4a24b8295837e%26contextid%3dC6B7CECBF7EF37A3%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&uaid=a67d96ca27dd4840a2c4a24b8295837e&suc=4765445b-32c6-49b0-83e6-1d93765276ca&lic=1	HTTP Parser: On click: OnBack(); return false;
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26client_id%3d4765445b-32c6-49b0-83e6-1d93765276ca%26mkt%3dEN-US%26opid%3d4796DC2E20C549C9%26opidt%3d1713563522%26uaid%3da67d96ca27dd4840a2c4a24b8295837e%26contextid%3dC6B7CECBF7EF37A3%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&uaid=a67d96ca27dd4840a2c4a24b8295837e&suc=4765445b-32c6-49b0-83e6-1d93765276ca&lic=1	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26client_id%3d4765445b-32c6-49b0-83e6-1d93765276ca%26mkt%3dEN-US%26opid%3d4796DC2E20C549C9%26opidt%3d1713563522%26uaid%3da67d96ca27dd4840a2c4a24b8295837e%26contextid%3dC6B7CECBF7EF37A3%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&uaid=a67d96ca27dd4840a2c4a24b8295837e&suc=4765445b-32c6-49b0-83e6-1d93765276ca&lic=1	HTTP Parser: On click: HOSTUI.evt_inlineBack_onclick();

HTTP Parser: <input type="password" .../> found

Source: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491602979817971.ZGM3ODI3MmYtMmZhYi00ZmFmLThkZWEtM2Q3N2Q5NjQyZjM5YWY3NDM0ZTEtZmI0Yy00Yjk4LTkxODUtYjEzOTY5ODVlZDIx&ui_locales=en-US&mkt=en-US&client-request-id=a67d96ca-27dd-4840-a2c4-a24b8295837e&state=Syu44JejXp8LqEQ8ywvgVxEnArYu1QcYhl-Pjbt8Eb1gV1TwVt4Bbi_S0ujC6W1Y35lH-Juduiv30Rgn2iNnyWaxJOj1wIYIXOHdFcuxUXV6YgKOr4Uu8HaqYFLj7UfQFh7tYALG3-zJu7_aQQbErMOwU-u7imKtReh_ivYEweWc_bobgs8C9H1b7ooj0ONkkl81AeG_dRo4RaYMlNCBJrRtujJ2ob0xiwEdQhb1SW_AxV5tFXAWFZIVz_Zt_Jj-W8CyxgXd3loRZsHHgX4Ccg&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0	HTTP Parser: No favicon
Source: https://fpt.live.com/?session_id=a67d96ca27dd4840a2c4a24b8295837e&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SU&mkt=EN-US	HTTP Parser: No favicon

Source: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491602979817971.ZGM3ODI3MmYtMmZhYi00ZmFmLThkZWEtM2Q3N2Q5NjQyZjM5YWY3NDM0ZTEtZmI0Yy00Yjk4LTkxODUtYjEzOTY5ODVlZDIx&ui_locales=en-US&mkt=en-US&client-request-id=a67d96ca-27dd-4840-a2c4-a24b8295837e&state=Syu44JejXp8LqEQ8ywvgVxEnArYu1QcYhl-Pjbt8Eb1gV1TwVt4Bbi_S0ujC6W1Y35lH-Juduiv30Rgn2iNnyWaxJOj1wIYIXOHdFcuxUXV6YgKOr4Uu8HaqYFLj7UfQFh7tYALG3-zJu7_aQQbErMOwU-u7imKtReh_ivYEweWc_bobgs8C9H1b7ooj0ONkkl81AeG_dRo4RaYMlNCBJrRtujJ2ob0xiwEdQhb1SW_AxV5tFXAWFZIVz_Zt_Jj-W8CyxgXd3loRZsHHgX4Ccg&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0	HTTP Parser: No <meta name="author".. found
Source: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491602979817971.ZGM3ODI3MmYtMmZhYi00ZmFmLThkZWEtM2Q3N2Q5NjQyZjM5YWY3NDM0ZTEtZmI0Yy00Yjk4LTkxODUtYjEzOTY5ODVlZDIx&ui_locales=en-US&mkt=en-US&client-request-id=a67d96ca-27dd-4840-a2c4-a24b8295837e&state=Syu44JejXp8LqEQ8ywvgVxEnArYu1QcYhl-Pjbt8Eb1gV1TwVt4Bbi_S0ujC6W1Y35lH-Juduiv30Rgn2iNnyWaxJOj1wIYIXOHdFcuxUXV6YgKOr4Uu8HaqYFLj7UfQFh7tYALG3-zJu7_aQQbErMOwU-u7imKtReh_ivYEweWc_bobgs8C9H1b7ooj0ONkkl81AeG_dRo4RaYMlNCBJrRtujJ2ob0xiwEdQhb1SW_AxV5tFXAWFZIVz_Zt_Jj-W8CyxgXd3loRZsHHgX4Ccg&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491602979817971.ZGM3ODI3MmYtMmZhYi00ZmFmLThkZWEtM2Q3N2Q5NjQyZjM5YWY3NDM0ZTEtZmI0Yy00Yjk4LTkxODUtYjEzOTY5ODVlZDIx&ui_locales=en-US&mkt=en-US&client-request-id=a67d96ca-27dd-4840-a2c4-a24b8295837e&state=Syu44JejXp8LqEQ8ywvgVxEnArYu1QcYhl-Pjbt8Eb1gV1TwVt4Bbi_S0ujC6W1Y35lH-Juduiv30Rgn2iNnyWaxJOj1wIYIXOHdFcuxUXV6YgKOr4Uu8HaqYFLj7UfQFh7tYALG3-zJu7_aQQbErMOwU-u7imKtReh_ivYEweWc_bobgs8C9H1b7ooj0ONkkl81AeG_dRo4RaYMlNCBJrRtujJ2ob0xiwEdQhb1SW_AxV5tFXAWFZIVz_Zt_Jj-W8CyxgXd3loRZsHHgX4Ccg&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491602979817971.ZGM3ODI3MmYtMmZhYi00ZmFmLThkZWEtM2Q3N2Q5NjQyZjM5YWY3NDM0ZTEtZmI0Yy00Yjk4LTkxODUtYjEzOTY5ODVlZDIx&ui_locales=en-US&mkt=en-US&client-request-id=a67d96ca-27dd-4840-a2c4-a24b8295837e&state=Syu44JejXp8LqEQ8ywvgVxEnArYu1QcYhl-Pjbt8Eb1gV1TwVt4Bbi_S0ujC6W1Y35lH-Juduiv30Rgn2iNnyWaxJOj1wIYIXOHdFcuxUXV6YgKOr4Uu8HaqYFLj7UfQFh7tYALG3-zJu7_aQQbErMOwU-u7imKtReh_ivYEweWc_bobgs8C9H1b7ooj0ONkkl81AeG_dRo4RaYMlNCBJrRtujJ2ob0xiwEdQhb1SW_AxV5tFXAWFZIVz_Zt_Jj-W8CyxgXd3loRZsHHgX4Ccg&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26client_id%3d4765445b-32c6-49b0-83e6-1d93765276ca%26mkt%3dEN-US%26opid%3d4796DC2E20C549C9%26opidt%3d1713563522%26uaid%3da67d96ca27dd4840a2c4a24b8295837e%26contextid%3dC6B7CECBF7EF37A3%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&uaid=a67d96ca27dd4840a2c4a24b8295837e&suc=4765445b-32c6-49b0-83e6-1d93765276ca&lic=1	HTTP Parser: No <meta name="author".. found
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26client_id%3d4765445b-32c6-49b0-83e6-1d93765276ca%26mkt%3dEN-US%26opid%3d4796DC2E20C549C9%26opidt%3d1713563522%26uaid%3da67d96ca27dd4840a2c4a24b8295837e%26contextid%3dC6B7CECBF7EF37A3%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&uaid=a67d96ca27dd4840a2c4a24b8295837e&suc=4765445b-32c6-49b0-83e6-1d93765276ca&lic=1	HTTP Parser: No <meta name="author".. found

Source: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491602979817971.ZGM3ODI3MmYtMmZhYi00ZmFmLThkZWEtM2Q3N2Q5NjQyZjM5YWY3NDM0ZTEtZmI0Yy00Yjk4LTkxODUtYjEzOTY5ODVlZDIx&ui_locales=en-US&mkt=en-US&client-request-id=a67d96ca-27dd-4840-a2c4-a24b8295837e&state=Syu44JejXp8LqEQ8ywvgVxEnArYu1QcYhl-Pjbt8Eb1gV1TwVt4Bbi_S0ujC6W1Y35lH-Juduiv30Rgn2iNnyWaxJOj1wIYIXOHdFcuxUXV6YgKOr4Uu8HaqYFLj7UfQFh7tYALG3-zJu7_aQQbErMOwU-u7imKtReh_ivYEweWc_bobgs8C9H1b7ooj0ONkkl81AeG_dRo4RaYMlNCBJrRtujJ2ob0xiwEdQhb1SW_AxV5tFXAWFZIVz_Zt_Jj-W8CyxgXd3loRZsHHgX4Ccg&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0	HTTP Parser: No <meta name="copyright".. found
Source: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491602979817971.ZGM3ODI3MmYtMmZhYi00ZmFmLThkZWEtM2Q3N2Q5NjQyZjM5YWY3NDM0ZTEtZmI0Yy00Yjk4LTkxODUtYjEzOTY5ODVlZDIx&ui_locales=en-US&mkt=en-US&client-request-id=a67d96ca-27dd-4840-a2c4-a24b8295837e&state=Syu44JejXp8LqEQ8ywvgVxEnArYu1QcYhl-Pjbt8Eb1gV1TwVt4Bbi_S0ujC6W1Y35lH-Juduiv30Rgn2iNnyWaxJOj1wIYIXOHdFcuxUXV6YgKOr4Uu8HaqYFLj7UfQFh7tYALG3-zJu7_aQQbErMOwU-u7imKtReh_ivYEweWc_bobgs8C9H1b7ooj0ONkkl81AeG_dRo4RaYMlNCBJrRtujJ2ob0xiwEdQhb1SW_AxV5tFXAWFZIVz_Zt_Jj-W8CyxgXd3loRZsHHgX4Ccg&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491602979817971.ZGM3ODI3MmYtMmZhYi00ZmFmLThkZWEtM2Q3N2Q5NjQyZjM5YWY3NDM0ZTEtZmI0Yy00Yjk4LTkxODUtYjEzOTY5ODVlZDIx&ui_locales=en-US&mkt=en-US&client-request-id=a67d96ca-27dd-4840-a2c4-a24b8295837e&state=Syu44JejXp8LqEQ8ywvgVxEnArYu1QcYhl-Pjbt8Eb1gV1TwVt4Bbi_S0ujC6W1Y35lH-Juduiv30Rgn2iNnyWaxJOj1wIYIXOHdFcuxUXV6YgKOr4Uu8HaqYFLj7UfQFh7tYALG3-zJu7_aQQbErMOwU-u7imKtReh_ivYEweWc_bobgs8C9H1b7ooj0ONkkl81AeG_dRo4RaYMlNCBJrRtujJ2ob0xiwEdQhb1SW_AxV5tFXAWFZIVz_Zt_Jj-W8CyxgXd3loRZsHHgX4Ccg&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491602979817971.ZGM3ODI3MmYtMmZhYi00ZmFmLThkZWEtM2Q3N2Q5NjQyZjM5YWY3NDM0ZTEtZmI0Yy00Yjk4LTkxODUtYjEzOTY5ODVlZDIx&ui_locales=en-US&mkt=en-US&client-request-id=a67d96ca-27dd-4840-a2c4-a24b8295837e&state=Syu44JejXp8LqEQ8ywvgVxEnArYu1QcYhl-Pjbt8Eb1gV1TwVt4Bbi_S0ujC6W1Y35lH-Juduiv30Rgn2iNnyWaxJOj1wIYIXOHdFcuxUXV6YgKOr4Uu8HaqYFLj7UfQFh7tYALG3-zJu7_aQQbErMOwU-u7imKtReh_ivYEweWc_bobgs8C9H1b7ooj0ONkkl81AeG_dRo4RaYMlNCBJrRtujJ2ob0xiwEdQhb1SW_AxV5tFXAWFZIVz_Zt_Jj-W8CyxgXd3loRZsHHgX4Ccg&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26client_id%3d4765445b-32c6-49b0-83e6-1d93765276ca%26mkt%3dEN-US%26opid%3d4796DC2E20C549C9%26opidt%3d1713563522%26uaid%3da67d96ca27dd4840a2c4a24b8295837e%26contextid%3dC6B7CECBF7EF37A3%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&uaid=a67d96ca27dd4840a2c4a24b8295837e&suc=4765445b-32c6-49b0-83e6-1d93765276ca&lic=1	HTTP Parser: No <meta name="copyright".. found
Source: https://signup.live.com/signup?sru=https%3a%2f%2flogin.live.com%2foauth20_authorize.srf%3flc%3d1033%26client_id%3d4765445b-32c6-49b0-83e6-1d93765276ca%26mkt%3dEN-US%26opid%3d4796DC2E20C549C9%26opidt%3d1713563522%26uaid%3da67d96ca27dd4840a2c4a24b8295837e%26contextid%3dC6B7CECBF7EF37A3%26opignore%3d1&mkt=EN-US&uiflavor=web&lw=1&fl=easi2&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&uaid=a67d96ca27dd4840a2c4a24b8295837e&suc=4765445b-32c6-49b0-83e6-1d93765276ca&lic=1	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.4:49766 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.63.206.91
Source: unknown	TCP traffic detected without corresponding DNS query: 69.164.42.0
Source: unknown	TCP traffic detected without corresponding DNS query: 69.164.42.0
Source: unknown	TCP traffic detected without corresponding DNS query: 69.164.42.0
Source: unknown	TCP traffic detected without corresponding DNS query: 69.164.42.0
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /:b:/g/personal/s7958766_estg_moe_gov_sa/EeCN0MAR0F5NufUZkT2Q-mcBn4v13Ov8FQ0oi798Dgtayg?e=zTKNmK HTTP/1.1Host: estgirls-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epdf&parent=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments&ga=1 HTTP/1.1Host: estgirls-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1Host: estgirls-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1Host: estgirls-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /personal/s7958766_estg_moe_gov_sa/_api/v2.1/graphql HTTP/1.1Host: estgirls-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1Host: estgirls-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epdf&parent=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments&ga=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /personal/s7958766_estg_moe_gov_sa/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1Host: estgirls-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1Host: estgirls-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /personal/s7958766_estg_moe_gov_sa/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1Host: estgirls-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%5D&defaultBrotli=true&authenticateFast=true&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099649,3]&spStartApplicationWebBundle=true&enableIntegrities=true HTTP/1.1Host: estgirls-my.sharepoint.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epdf&parent=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments&ga=1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /transform/thumbnail?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Festgirls-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!3wg9-hIsbkKjisgTkXNd6LRDPUacccZPsT38WqC54ml1Bruter-IRZ4fXQ1eVBg9%2Fitems%2F01PD5Q4JXARXIMAEOQLZG3T5IZSE6ZB6TH%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvZXN0Z2lybHMtbXkuc2hhcmVwb2ludC5jb21AYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiIiwiY2FjaGVrZXkiOiIwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNlNDM3NmVjMDI1NmQ1MTJlMjM3MzIwOWNmNDM5OTY5ZGE0ZDk0MzYzNGZlOTZjYTU1NmZmMWE3YTFjMTVhNGJlIiwiZW5kcG9pbnR1cmwiOiJURjgwRTBXRUM0cWNENzhvRWQxb0gwRjNxVXl4RlF6RXdvSjlrT1VybHlNPSIsImVuZHBvaW50dXJsTGVuZ3RoIjoiMTE4IiwiZXhwIjoiMTcxMzU4MjAwMCIsImlwYWRkciI6IjgxLjE4MS41Ny41MiIsImlzbG9vcGJhY2siOiJUcnVlIiwiaXNzIjoiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwIiwiaXN1c2VyIjoidHJ1ZSIsIm5hbWVpZCI6IjAjLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUiLCJuYmYiOiIxNzEzNTYwNDAwIiwibmlpIjoibWljcm9zb2Z0LnNoYXJlcG9pbnQiLCJzaGFyaW5naWQiOiIzTlVzZFR6QS9rT0M0cEJvQmJKRjFnIiwic2l0ZWlkIjoiWm1FelpEQTRaR1l0TW1NeE1pMDBNalpsTFdFek9HRXRZemd4TXpreE56TTFaR1U0Iiwic25pZCI6IjYiLCJzdHAiOiJ0IiwidHQiOiIwIiwidmVyIjoiaGFzaGVkcHJvb2Z0b2tlbiJ9.ZgbJkRJ9o5Ke5sfg2XVFcy9TQ4gtZLqksRzitF_6T4Q&cTag=%22c%3A%7BC0D08DE0-D011-4D5E-B9F5-19913D90FA67%7D%2C1%22&encodeFailures=1&width=1280&height=859&srcWidth=&srcHeight= HTTP/1.1Host: northeurope1-mediap.svc.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://estgirls-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /transform/thumbnail?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Festgirls-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!3wg9-hIsbkKjisgTkXNd6LRDPUacccZPsT38WqC54ml1Bruter-IRZ4fXQ1eVBg9%2Fitems%2F01PD5Q4JXARXIMAEOQLZG3T5IZSE6ZB6TH%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvZXN0Z2lybHMtbXkuc2hhcmVwb2ludC5jb21AYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiIiwiY2FjaGVrZXkiOiIwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNlNDM3NmVjMDI1NmQ1MTJlMjM3MzIwOWNmNDM5OTY5ZGE0ZDk0MzYzNGZlOTZjYTU1NmZmMWE3YTFjMTVhNGJlIiwiZW5kcG9pbnR1cmwiOiJURjgwRTBXRUM0cWNENzhvRWQxb0gwRjNxVXl4RlF6RXdvSjlrT1VybHlNPSIsImVuZHBvaW50dXJsTGVuZ3RoIjoiMTE4IiwiZXhwIjoiMTcxMzU4MjAwMCIsImlwYWRkciI6IjgxLjE4MS41Ny41MiIsImlzbG9vcGJhY2siOiJUcnVlIiwiaXNzIjoiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwIiwiaXN1c2VyIjoidHJ1ZSIsIm5hbWVpZCI6IjAjLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUiLCJuYmYiOiIxNzEzNTYwNDAwIiwibmlpIjoibWljcm9zb2Z0LnNoYXJlcG9pbnQiLCJzaGFyaW5naWQiOiIzTlVzZFR6QS9rT0M0cEJvQmJKRjFnIiwic2l0ZWlkIjoiWm1FelpEQTRaR1l0TW1NeE1pMDBNalpsTFdFek9HRXRZemd4TXpreE56TTFaR1U0Iiwic25pZCI6IjYiLCJzdHAiOiJ0IiwidHQiOiIwIiwidmVyIjoiaGFzaGVkcHJvb2Z0b2tlbiJ9.ZgbJkRJ9o5Ke5sfg2XVFcy9TQ4gtZLqksRzitF_6T4Q&cTag=%22c%3A%7BC0D08DE0-D011-4D5E-B9F5-19913D90FA67%7D%2C1%22&encodeFailures=1&width=1280&height=859&srcWidth=&srcHeight= HTTP/1.1Host: northeurope1-mediap.svc.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/odspserviceworkerproxy.aspx?swManifestName=odbmspdfwebworker&debug=false&bypass=false HTTP/1.1Host: estgirls-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epdf&parent=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments&ga=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=; MicrosoftApplicationsTelemetryDeviceId=ccc88f20-cdb4-4f2c-8688-a92937621503
Source: global traffic	HTTP traffic detected: GET /transform/passthrough?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Festgirls-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!3wg9-hIsbkKjisgTkXNd6LRDPUacccZPsT38WqC54ml1Bruter-IRZ4fXQ1eVBg9%2Fitems%2F01PD5Q4JXARXIMAEOQLZG3T5IZSE6ZB6TH%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvZXN0Z2lybHMtbXkuc2hhcmVwb2ludC5jb21AYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiIiwiY2FjaGVrZXkiOiIwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNlNDM3NmVjMDI1NmQ1MTJlMjM3MzIwOWNmNDM5OTY5ZGE0ZDk0MzYzNGZlOTZjYTU1NmZmMWE3YTFjMTVhNGJlIiwiZW5kcG9pbnR1cmwiOiJURjgwRTBXRUM0cWNENzhvRWQxb0gwRjNxVXl4RlF6RXdvSjlrT1VybHlNPSIsImVuZHBvaW50dXJsTGVuZ3RoIjoiMTE4IiwiZXhwIjoiMTcxMzU4MjAwMCIsImlwYWRkciI6IjgxLjE4MS41Ny41MiIsImlzbG9vcGJhY2siOiJUcnVlIiwiaXNzIjoiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwIiwiaXN1c2VyIjoidHJ1ZSIsIm5hbWVpZCI6IjAjLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUiLCJuYmYiOiIxNzEzNTYwNDAwIiwibmlpIjoibWljcm9zb2Z0LnNoYXJlcG9pbnQiLCJzaGFyaW5naWQiOiIzTlVzZFR6QS9rT0M0cEJvQmJKRjFnIiwic2l0ZWlkIjoiWm1FelpEQTRaR1l0TW1NeE1pMDBNalpsTFdFek9HRXRZemd4TXpreE56TTFaR1U0Iiwic25pZCI6IjYiLCJzdHAiOiJ0IiwidHQiOiIwIiwidmVyIjoiaGFzaGVkcHJvb2Z0b2tlbiJ9.ZgbJkRJ9o5Ke5sfg2XVFcy9TQ4gtZLqksRzitF_6T4Q&cTag=%22c%3A%7BC0D08DE0-D011-4D5E-B9F5-19913D90FA67%7D%2C1%22 HTTP/1.1Host: northeurope1-mediap.svc.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://estgirls-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://estgirls-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /transform/passthrough?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Festgirls-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!3wg9-hIsbkKjisgTkXNd6LRDPUacccZPsT38WqC54ml1Bruter-IRZ4fXQ1eVBg9%2Fitems%2F01PD5Q4JXARXIMAEOQLZG3T5IZSE6ZB6TH%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvZXN0Z2lybHMtbXkuc2hhcmVwb2ludC5jb21AYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiIiwiY2FjaGVrZXkiOiIwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNlNDM3NmVjMDI1NmQ1MTJlMjM3MzIwOWNmNDM5OTY5ZGE0ZDk0MzYzNGZlOTZjYTU1NmZmMWE3YTFjMTVhNGJlIiwiZW5kcG9pbnR1cmwiOiJURjgwRTBXRUM0cWNENzhvRWQxb0gwRjNxVXl4RlF6RXdvSjlrT1VybHlNPSIsImVuZHBvaW50dXJsTGVuZ3RoIjoiMTE4IiwiZXhwIjoiMTcxMzU4MjAwMCIsImlwYWRkciI6IjgxLjE4MS41Ny41MiIsImlzbG9vcGJhY2siOiJUcnVlIiwiaXNzIjoiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwIiwiaXN1c2VyIjoidHJ1ZSIsIm5hbWVpZCI6IjAjLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUiLCJuYmYiOiIxNzEzNTYwNDAwIiwibmlpIjoibWljcm9zb2Z0LnNoYXJlcG9pbnQiLCJzaGFyaW5naWQiOiIzTlVzZFR6QS9rT0M0cEJvQmJKRjFnIiwic2l0ZWlkIjoiWm1FelpEQTRaR1l0TW1NeE1pMDBNalpsTFdFek9HRXRZemd4TXpreE56TTFaR1U0Iiwic25pZCI6IjYiLCJzdHAiOiJ0IiwidHQiOiIwIiwidmVyIjoiaGFzaGVkcHJvb2Z0b2tlbiJ9.ZgbJkRJ9o5Ke5sfg2XVFcy9TQ4gtZLqksRzitF_6T4Q&cTag=%22c%3A%7BC0D08DE0-D011-4D5E-B9F5-19913D90FA67%7D%2C1%22 HTTP/1.1Host: northeurope1-mediap.svc.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /haqHYyzL HTTP/1.1Host: login.ms2.belovedkittenrescue.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_api/v2.0/drive/apps?select=*%2Cpromoted%2CbuiltIn&%24expand=actions HTTP/1.1Host: estgirls-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/jsonAccept-Language: en-USsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epdf&parent=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments&ga=1Accept-Encoding: gzip, deflate, brCookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=; MicrosoftApplicationsTelemetryDeviceId=ccc88f20-cdb4-4f2c-8688-a92937621503; ai_session=CGDR8b2QKIE2W0/5WGq2EZ\|1713563486859\|1713563486859; MSFPC=GUID=749eee6039c5489b9db3000c7ab3f399&HASH=749e&LV=202310&V=4&LU=1696413236917
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: login.belovedkittenrescue.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: a405-c7b6=a2a2d927ec60dd38ec52c4226f2df574602a86d8408b49fd9cd2e3ecc489b6ce
Source: global traffic	HTTP traffic detected: GET /login HTTP/1.1Host: www.belovedkittenrescue.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: a405-c7b6=a2a2d927ec60dd38ec52c4226f2df574602a86d8408b49fd9cd2e3ecc489b6ce
Source: global traffic	HTTP traffic detected: GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491602979817971.ZGM3ODI3MmYtMmZhYi00ZmFmLThkZWEtM2Q3N2Q5NjQyZjM5YWY3NDM0ZTEtZmI0Yy00Yjk4LTkxODUtYjEzOTY5ODVlZDIx&ui_locales=en-US&mkt=en-US&client-request-id=a67d96ca-27dd-4840-a2c4-a24b8295837e&state=Syu44JejXp8LqEQ8ywvgVxEnArYu1QcYhl-Pjbt8Eb1gV1TwVt4Bbi_S0ujC6W1Y35lH-Juduiv30Rgn2iNnyWaxJOj1wIYIXOHdFcuxUXV6YgKOr4Uu8HaqYFLj7UfQFh7tYALG3-zJu7_aQQbErMOwU-u7imKtReh_ivYEweWc_bobgs8C9H1b7ooj0ONkkl81AeG_dRo4RaYMlNCBJrRtujJ2ob0xiwEdQhb1SW_AxV5tFXAWFZIVz_Zt_Jj-W8CyxgXd3loRZsHHgX4Ccg&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0 HTTP/1.1Host: login.belovedkittenrescue.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: a405-c7b6=a2a2d927ec60dd38ec52c4226f2df574602a86d8408b49fd9cd2e3ecc489b6ce; fpc=AknvRAF3GEtMl4GurL9O1vA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8comX6T_qadyWaTRBS0nrT5rc3GYkelzdI2V_L3g8NTiVwDtcvQw3o5DpUf5ax6ylIPKLsXV5yRtdd49GYJusL6jeeDQ5Vj4VTb-PQfQ7KGiNk5qu2NwQdvYMBf8ZrAqEmZ1_f_1PRcP0VQ8bqJ7cxBcfxu-XKh_bUmKxMSy2IE8gAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=341A6B55382865413D177F3339C664D5
Source: global traffic	HTTP traffic detected: GET /s/a2a2d927ec60dd38ec52c4226f2df574602a86d8408b49fd9cd2e3ecc489b6ce.js HTTP/1.1Host: login.belovedkittenrescue.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491602979817971.ZGM3ODI3MmYtMmZhYi00ZmFmLThkZWEtM2Q3N2Q5NjQyZjM5YWY3NDM0ZTEtZmI0Yy00Yjk4LTkxODUtYjEzOTY5ODVlZDIx&ui_locales=en-US&mkt=en-US&client-request-id=a67d96ca-27dd-4840-a2c4-a24b8295837e&state=Syu44JejXp8LqEQ8ywvgVxEnArYu1QcYhl-Pjbt8Eb1gV1TwVt4Bbi_S0ujC6W1Y35lH-Juduiv30Rgn2iNnyWaxJOj1wIYIXOHdFcuxUXV6YgKOr4Uu8HaqYFLj7UfQFh7tYALG3-zJu7_aQQbErMOwU-u7imKtReh_ivYEweWc_bobgs8C9H1b7ooj0ONkkl81AeG_dRo4RaYMlNCBJrRtujJ2ob0xiwEdQhb1SW_AxV5tFXAWFZIVz_Zt_Jj-W8CyxgXd3loRZsHHgX4Ccg&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: a405-c7b6=a2a2d927ec60dd38ec52c4226f2df574602a86d8408b49fd9cd2e3ecc489b6ce; fpc=AknvRAF3GEtMl4GurL9O1vA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8comX6T_qadyWaTRBS0nrT5rc3GYkelzdI2V_L3g8NTiVwDtcvQw3o5DpUf5ax6ylIPKLsXV5yRtdd49GYJusL6jeeDQ5Vj4VTb-PQfQ7KGiNk5qu2NwQdvYMBf8ZrAqEmZ1_f_1PRcP0VQ8bqJ7cxBcfxu-XKh_bUmKxMSy2IE8gAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=341A6B55382865413D177F3339C664D5; esctx-HfkrDJ8zWBY=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Tx9zS59EWovYEWieSAaG6BP5XdE1AKBSB6yQfWyNtFaOuJjk43optfLc1d-Tv0s44T6kyGfXo0guVnZD2iud_Z8hLDDvaBZadKUt6IZBmm-xh68np-rmd6vXTuYMJs2TGpfYjPZe6-hglOaQqk_bOCAA
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_3b4rnVNi70Sso4_c42_ImQ2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.belovedkittenrescue.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491602979817971.ZGM3ODI3MmYtMmZhYi00ZmFmLThkZWEtM2Q3N2Q5NjQyZjM5YWY3NDM0ZTEtZmI0Yy00Yjk4LTkxODUtYjEzOTY5ODVlZDIx&ui_locales=en-US&mkt=en-US&client-request-id=a67d96ca-27dd-4840-a2c4-a24b8295837e&state=Syu44JejXp8LqEQ8ywvgVxEnArYu1QcYhl-Pjbt8Eb1gV1TwVt4Bbi_S0ujC6W1Y35lH-Juduiv30Rgn2iNnyWaxJOj1wIYIXOHdFcuxUXV6YgKOr4Uu8HaqYFLj7UfQFh7tYALG3-zJu7_aQQbErMOwU-u7imKtReh_ivYEweWc_bobgs8C9H1b7ooj0ONkkl81AeG_dRo4RaYMlNCBJrRtujJ2ob0xiwEdQhb1SW_AxV5tFXAWFZIVz_Zt_Jj-W8CyxgXd3loRZsHHgX4Ccg&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true HTTP/1.1Host: login.belovedkittenrescue.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491602979817971.ZGM3ODI3MmYtMmZhYi00ZmFmLThkZWEtM2Q3N2Q5NjQyZjM5YWY3NDM0ZTEtZmI0Yy00Yjk4LTkxODUtYjEzOTY5ODVlZDIx&ui_locales=en-US&mkt=en-US&client-request-id=a67d96ca-27dd-4840-a2c4-a24b8295837e&state=Syu44JejXp8LqEQ8ywvgVxEnArYu1QcYhl-Pjbt8Eb1gV1TwVt4Bbi_S0ujC6W1Y35lH-Juduiv30Rgn2iNnyWaxJOj1wIYIXOHdFcuxUXV6YgKOr4Uu8HaqYFLj7UfQFh7tYALG3-zJu7_aQQbErMOwU-u7imKtReh_ivYEweWc_bobgs8C9H1b7ooj0ONkkl81AeG_dRo4RaYMlNCBJrRtujJ2ob0xiwEdQhb1SW_AxV5tFXAWFZIVz_Zt_Jj-W8CyxgXd3loRZsHHgX4Ccg&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: a405-c7b6=a2a2d927ec60dd38ec52c4226f2df574602a86d8408b49fd9cd2e3ecc489b6ce; fpc=AknvRAF3GEtMl4GurL9O1vA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8comX6T_qadyWaTRBS0nrT5rc3GYkelzdI2V_L3g8NTiVwDtcvQw3o5DpUf5ax6ylIPKLsXV5yRtdd49GYJusL6jeeDQ5Vj4VTb-PQfQ7KGiNk5qu2NwQdvYMBf8ZrAqEmZ1_f_1PRcP0VQ8bqJ7cxBcfxu-XKh_bUmKxMSy2IE8gAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=341A6B55382865413D177F3339C664D5; esctx-HfkrDJ8zWBY=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Tx9zS59EWovYEWieSAaG6BP5XdE1AKBSB6yQfWyNtFaOuJjk43optfLc1d-Tv0s44T6kyGfXo0guVnZD2iud_Z8hLDDvaBZadKUt6IZBmm-xh68np-rmd6vXTuYMJs2TGpfYjPZe6-hglOaQqk_bOCAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /s/a2a2d927ec60dd38ec52c4226f2df574602a86d8408b49fd9cd2e3ecc489b6ce HTTP/1.1Host: login.belovedkittenrescue.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491602979817971.ZGM3ODI3MmYtMmZhYi00ZmFmLThkZWEtM2Q3N2Q5NjQyZjM5YWY3NDM0ZTEtZmI0Yy00Yjk4LTkxODUtYjEzOTY5ODVlZDIx&ui_locales=en-US&mkt=en-US&client-request-id=a67d96ca-27dd-4840-a2c4-a24b8295837e&state=Syu44JejXp8LqEQ8ywvgVxEnArYu1QcYhl-Pjbt8Eb1gV1TwVt4Bbi_S0ujC6W1Y35lH-Juduiv30Rgn2iNnyWaxJOj1wIYIXOHdFcuxUXV6YgKOr4Uu8HaqYFLj7UfQFh7tYALG3-zJu7_aQQbErMOwU-u7imKtReh_ivYEweWc_bobgs8C9H1b7ooj0ONkkl81AeG_dRo4RaYMlNCBJrRtujJ2ob0xiwEdQhb1SW_AxV5tFXAWFZIVz_Zt_Jj-W8CyxgXd3loRZsHHgX4Ccg&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: a405-c7b6=a2a2d927ec60dd38ec52c4226f2df574602a86d8408b49fd9cd2e3ecc489b6ce; fpc=AknvRAF3GEtMl4GurL9O1vA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8comX6T_qadyWaTRBS0nrT5rc3GYkelzdI2V_L3g8NTiVwDtcvQw3o5DpUf5ax6ylIPKLsXV5yRtdd49GYJusL6jeeDQ5Vj4VTb-PQfQ7KGiNk5qu2NwQdvYMBf8ZrAqEmZ1_f_1PRcP0VQ8bqJ7cxBcfxu-XKh_bUmKxMSy2IE8gAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=341A6B55382865413D177F3339C664D5; esctx-HfkrDJ8zWBY=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Tx9zS59EWovYEWieSAaG6BP5XdE1AKBSB6yQfWyNtFaOuJjk43optfLc1d-Tv0s44T6kyGfXo0guVnZD2iud_Z8hLDDvaBZadKUt6IZBmm-xh68np-rmd6vXTuYMJs2TGpfYjPZe6-hglOaQqk_bOCAA
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: login.belovedkittenrescue.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491602979817971.ZGM3ODI3MmYtMmZhYi00ZmFmLThkZWEtM2Q3N2Q5NjQyZjM5YWY3NDM0ZTEtZmI0Yy00Yjk4LTkxODUtYjEzOTY5ODVlZDIx&ui_locales=en-US&mkt=en-US&client-request-id=a67d96ca-27dd-4840-a2c4-a24b8295837e&state=Syu44JejXp8LqEQ8ywvgVxEnArYu1QcYhl-Pjbt8Eb1gV1TwVt4Bbi_S0ujC6W1Y35lH-Juduiv30Rgn2iNnyWaxJOj1wIYIXOHdFcuxUXV6YgKOr4Uu8HaqYFLj7UfQFh7tYALG3-zJu7_aQQbErMOwU-u7imKtReh_ivYEweWc_bobgs8C9H1b7ooj0ONkkl81AeG_dRo4RaYMlNCBJrRtujJ2ob0xiwEdQhb1SW_AxV5tFXAWFZIVz_Zt_Jj-W8CyxgXd3loRZsHHgX4Ccg&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: a405-c7b6=a2a2d927ec60dd38ec52c4226f2df574602a86d8408b49fd9cd2e3ecc489b6ce; fpc=AknvRAF3GEtMl4GurL9O1vA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8comX6T_qadyWaTRBS0nrT5rc3GYkelzdI2V_L3g8NTiVwDtcvQw3o5DpUf5ax6ylIPKLsXV5yRtdd49GYJusL6jeeDQ5Vj4VTb-PQfQ7KGiNk5qu2NwQdvYMBf8ZrAqEmZ1_f_1PRcP0VQ8bqJ7cxBcfxu-XKh_bUmKxMSy2IE8gAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=341A6B55382865413D177F3339C664D5; esctx-HfkrDJ8zWBY=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Tx9zS59EWovYEWieSAaG6BP5XdE1AKBSB6yQfWyNtFaOuJjk43optfLc1d-Tv0s44T6kyGfXo0guVnZD2iud_Z8hLDDvaBZadKUt6IZBmm-xh68np-rmd6vXTuYMJs2TGpfYjPZe6-hglOaQqk_bOCAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /s/a2a2d927ec60dd38ec52c4226f2df574602a86d8408b49fd9cd2e3ecc489b6ce.js HTTP/1.1Host: login.belovedkittenrescue.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491602979817971.ZGM3ODI3MmYtMmZhYi00ZmFmLThkZWEtM2Q3N2Q5NjQyZjM5YWY3NDM0ZTEtZmI0Yy00Yjk4LTkxODUtYjEzOTY5ODVlZDIx&ui_locales=en-US&mkt=en-US&client-request-id=a67d96ca-27dd-4840-a2c4-a24b8295837e&state=Syu44JejXp8LqEQ8ywvgVxEnArYu1QcYhl-Pjbt8Eb1gV1TwVt4Bbi_S0ujC6W1Y35lH-Juduiv30Rgn2iNnyWaxJOj1wIYIXOHdFcuxUXV6YgKOr4Uu8HaqYFLj7UfQFh7tYALG3-zJu7_aQQbErMOwU-u7imKtReh_ivYEweWc_bobgs8C9H1b7ooj0ONkkl81AeG_dRo4RaYMlNCBJrRtujJ2ob0xiwEdQhb1SW_AxV5tFXAWFZIVz_Zt_Jj-W8CyxgXd3loRZsHHgX4Ccg&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: a405-c7b6=a2a2d927ec60dd38ec52c4226f2df574602a86d8408b49fd9cd2e3ecc489b6ce; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=341A6B55382865413D177F3339C664D5; esctx-HfkrDJ8zWBY=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Tx9zS59EWovYEWieSAaG6BP5XdE1AKBSB6yQfWyNtFaOuJjk43optfLc1d-Tv0s44T6kyGfXo0guVnZD2iud_Z8hLDDvaBZadKUt6IZBmm-xh68np-rmd6vXTuYMJs2TGpfYjPZe6-hglOaQqk_bOCAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXsAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8nwD827Wi-kG_mXBousSJ1ePosbJhKfEo_4dWiEsnPWjopyT21U6deRoWVpIOINEioiZvk2DICnAmHrRZStMM8ioORIlmg2AlEpMtCzFiA2UgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8Q-45z_Kyc4eKVhojkTpA7kDddtzzxcQy6c8JLjslJB64zHTCAvfCRL699o8tIart1VjIjHP5mHUs_ltyMmvjHOeeHrlfeZwd5C9CiP7s_tjmVPb_3xhViWpdaKAe8C6rGkct2Zekc28v6YX6BBUQtELP0GGvVz7wpocyn1xbD-UgAA; esctx-m1dW2TeptYM=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8XMuBF0wE-inyVJw02pGfSZMeDgGlHL_hECDf-ADpfrVJLT6wG37wnZcZUMnHcKfoIvRL5M9TmPpZzAe3gC0aO4NwbWxEWpxl7POqhOyqmM2d-m6ThCs5ZCL9cahUkkEYkdJYMCT2IRgecTQRuTcVjiAA; fpc=AknvRAF3GEtMl4GurL9O1vC8Ae7AAQAAAGvetN0OAAAA
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.belovedkittenrescue.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_xtPRDEy3EhlAdpju-Ah7qw2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.belovedkittenrescue.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_pxjdzrjcwtmbr-ntjn_f8q2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.belovedkittenrescue.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: live.belovedkittenrescue.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: a405-c7b6=a2a2d927ec60dd38ec52c4226f2df574602a86d8408b49fd9cd2e3ecc489b6ce; MUID=341A6B55382865413D177F3339C664D5
Source: global traffic	HTTP traffic detected: GET /s/a2a2d927ec60dd38ec52c4226f2df574602a86d8408b49fd9cd2e3ecc489b6ce HTTP/1.1Host: login.belovedkittenrescue.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491602979817971.ZGM3ODI3MmYtMmZhYi00ZmFmLThkZWEtM2Q3N2Q5NjQyZjM5YWY3NDM0ZTEtZmI0Yy00Yjk4LTkxODUtYjEzOTY5ODVlZDIx&ui_locales=en-US&mkt=en-US&client-request-id=a67d96ca-27dd-4840-a2c4-a24b8295837e&state=Syu44JejXp8LqEQ8ywvgVxEnArYu1QcYhl-Pjbt8Eb1gV1TwVt4Bbi_S0ujC6W1Y35lH-Juduiv30Rgn2iNnyWaxJOj1wIYIXOHdFcuxUXV6YgKOr4Uu8HaqYFLj7UfQFh7tYALG3-zJu7_aQQbErMOwU-u7imKtReh_ivYEweWc_bobgs8C9H1b7ooj0ONkkl81AeG_dRo4RaYMlNCBJrRtujJ2ob0xiwEdQhb1SW_AxV5tFXAWFZIVz_Zt_Jj-W8CyxgXd3loRZsHHgX4Ccg&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: a405-c7b6=a2a2d927ec60dd38ec52c4226f2df574602a86d8408b49fd9cd2e3ecc489b6ce; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=341A6B55382865413D177F3339C664D5; esctx-HfkrDJ8zWBY=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Tx9zS59EWovYEWieSAaG6BP5XdE1AKBSB6yQfWyNtFaOuJjk43optfLc1d-Tv0s44T6kyGfXo0guVnZD2iud_Z8hLDDvaBZadKUt6IZBmm-xh68np-rmd6vXTuYMJs2TGpfYjPZe6-hglOaQqk_bOCAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXsAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8nwD827Wi-kG_mXBousSJ1ePosbJhKfEo_4dWiEsnPWjopyT21U6deRoWVpIOINEioiZvk2DICnAmHrRZStMM8ioORIlmg2AlEpMtCzFiA2UgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8Q-45z_Kyc4eKVhojkTpA7kDddtzzxcQy6c8JLjslJB64zHTCAvfCRL699o8tIart1VjIjHP5mHUs_ltyMmvjHOeeHrlfeZwd5C9CiP7s_tjmVPb_3xhViWpdaKAe8C6rGkct2Zekc28v6YX6BBUQtELP0GGvVz7wpocyn1xbD-UgAA; esctx-m1dW2TeptYM=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8XMuBF0wE-inyVJw02pGfSZMeDgGlHL_hECDf-ADpfrVJLT6wG37wnZcZUMnHcKfoIvRL5M9TmPpZzAe3gC0aO4NwbWxEWpxl7POqhOyqmM2d-m6ThCs5ZCL9cahUkkEYkdJYMCT2IRgecTQRuTcVjiAA; fpc=AknvRAF3GEtMl4GurL9O1vC8Ae7AAQAAAGvetN0OAAAA
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_4d4b76a02ae121e3b20c.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: live.belovedkittenrescue.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: a405-c7b6=a2a2d927ec60dd38ec52c4226f2df574602a86d8408b49fd9cd2e3ecc489b6ce; MUID=341A6B55382865413D177F3339C664D5; uaid=f87fef687d3b42c1a9c94f5ed8824bd2; MSPRequ=id=N&lt=1713563502&co=1
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_eb638da25d4055fbbb57.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_presetpasswordsplitter_3c78f555810791db83a9.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_account_msa_3b879963b4f70829fd7a25cbc9519792.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_account_aad_a8332c62695d74843a11daf39a74e552.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_account_msa_3b879963b4f70829fd7a25cbc9519792.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_account_aad_a8332c62695d74843a11daf39a74e552.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&scope=openid+profile+https%3a%2f%2fwww.belovedkittenrescue.com%2fv2%2fOfficeHome.All&redirect_uri=https%3a%2f%2fwww.belovedkittenrescue.com%2flandingv2&response_type=code+id_token&state=Syu44JejXp8LqEQ8ywvgVxEnArYu1QcYhl-Pjbt8Eb1gV1TwVt4Bbi_S0ujC6W1Y35lH-Juduiv30Rgn2iNnyWaxJOj1wIYIXOHdFcuxUXV6YgKOr4Uu8HaqYFLj7UfQFh7tYALG3-zJu7_aQQbErMOwU-u7imKtReh_ivYEweWc_bobgs8C9H1b7ooj0ONkkl81AeG_dRo4RaYMlNCBJrRtujJ2ob0xiwEdQhb1SW_AxV5tFXAWFZIVz_Zt_Jj-W8CyxgXd3loRZsHHgX4Ccg&response_mode=form_post&nonce=638491602979817971.ZGM3ODI3MmYtMmZhYi00ZmFmLThkZWEtM2Q3N2Q5NjQyZjM5YWY3NDM0ZTEtZmI0Yy00Yjk4LTkxODUtYjEzOTY5ODVlZDIx&x-client-SKU=ID_NET6_0&x-client-Ver=7.3.1.0&uaid=a67d96ca27dd4840a2c4a24b8295837e&msproxy=1&issuer=mso&tenant=common&ui_locales=en-US&signup=1&lw=1&fl=easi2&epct=PAQABDgEAAADnfolhJpSnRYB1SVj-Hgd84h4hf9pcjo3oO1Z-_mXJ2p2B7lrhMIxU8LSIrlUAGcxDdijkf9VDPFFGEJC1gVwXCZKDJ0cSla6xR8hPI_XQAql-YvlMf20Q3gt_RROXZTOgJAVZO1CcE95A2X9mmoEkMvGEP-d9uM8P4eB2zAbd0nBSdTIf3MFEU_sKFHKsxuOw95TmYnUQrE1bd-l93mttsr-j6uZRqb5gKNc0G_4RdCAA&jshs=0 HTTP/1.1Host: live.belovedkittenrescue.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: a405-c7b6=a2a2d927ec60dd38ec52c4226f2df574602a86d8408b49fd9cd2e3ecc489b6ce; MUID=341A6B55382865413D177F3339C664D5; uaid=506939cad2ae4af0b70a3e863040ec59; MSPRequ=id=N&lt=1713563504&co=2
Source: global traffic	HTTP traffic detected: GET /personal/s7958766_estg_moe_gov_sa/_layouts/15/AccessDenied.aspx?correlation=53a820a1%2D008b%2D8000%2D9d5d%2D3d413cd47b8a HTTP/1.1Host: estgirls-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=; MicrosoftApplicationsTelemetryDeviceId=ccc88f20-cdb4-4f2c-8688-a92937621503; ai_session=CGDR8b2QKIE2W0/5WGq2EZ\|1713563486859\|1713563486859; MSFPC=GUID=749eee6039c5489b9db3000c7ab3f399&HASH=749e&LV=202310&V=4&LU=1696413236917
Source: global traffic	HTTP traffic detected: GET /converged_ux_v2_nBE5FSqn9KpH44ZlTc3VqQ2.css?v=1 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://signup.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jqueryshim_hlu0tTfjWJFWYNt1WZrVqg2.js?v=1 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://signup.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg HTTP/1.1Host: acctcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /knockout_3.3.0_X1BYS2jZMbi7hfUj8VuqFA2.js?v=1 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://signup.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lwsignupstringscountrybirthdate_en-us_gdxUIqa3ijrOefuBnwhTKg2.js?v=1 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://signup.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lightweightsignuppackage_MwksSuxFBgQ4Y619ES0DZQ2.js?v=1 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://signup.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg HTTP/1.1Host: acctcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/favicon.ico?v=2 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /oneds_MC5gQfpbTUjLu60sQCwU1w2.js?v=1 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /datarequestpackage_h-_7C7UzwdefXJT9njDBTQ2.js HTTP/1.1Host: acctcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://signup.live.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg HTTP/1.1Host: acctcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://signup.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/favicon.ico?v=2 HTTP/1.1Host: acctcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg HTTP/1.1Host: acctcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/a2a2d927ec60dd38ec52c4226f2df574602a86d8408b49fd9cd2e3ecc489b6ce HTTP/1.1Host: login.belovedkittenrescue.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491602979817971.ZGM3ODI3MmYtMmZhYi00ZmFmLThkZWEtM2Q3N2Q5NjQyZjM5YWY3NDM0ZTEtZmI0Yy00Yjk4LTkxODUtYjEzOTY5ODVlZDIx&ui_locales=en-US&mkt=en-US&client-request-id=a67d96ca-27dd-4840-a2c4-a24b8295837e&state=Syu44JejXp8LqEQ8ywvgVxEnArYu1QcYhl-Pjbt8Eb1gV1TwVt4Bbi_S0ujC6W1Y35lH-Juduiv30Rgn2iNnyWaxJOj1wIYIXOHdFcuxUXV6YgKOr4Uu8HaqYFLj7UfQFh7tYALG3-zJu7_aQQbErMOwU-u7imKtReh_ivYEweWc_bobgs8C9H1b7ooj0ONkkl81AeG_dRo4RaYMlNCBJrRtujJ2ob0xiwEdQhb1SW_AxV5tFXAWFZIVz_Zt_Jj-W8CyxgXd3loRZsHHgX4Ccg&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: a405-c7b6=a2a2d927ec60dd38ec52c4226f2df574602a86d8408b49fd9cd2e3ecc489b6ce; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=341A6B55382865413D177F3339C664D5; esctx-HfkrDJ8zWBY=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Tx9zS59EWovYEWieSAaG6BP5XdE1AKBSB6yQfWyNtFaOuJjk43optfLc1d-Tv0s44T6kyGfXo0guVnZD2iud_Z8hLDDvaBZadKUt6IZBmm-xh68np-rmd6vXTuYMJs2TGpfYjPZe6-hglOaQqk_bOCAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AXsAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8nwD827Wi-kG_mXBousSJ1ePosbJhKfEo_4dWiEsnPWjopyT21U6deRoWVpIOINEioiZvk2DICnAmHrRZStMM8ioORIlmg2AlEpMtCzFiA2UgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8Q-45z_Kyc4eKVhojkTpA7kDddtzzxcQy6c8JLjslJB64zHTCAvfCRL699o8tIart1VjIjHP5mHUs_ltyMmvjHOeeHrlfeZwd5C9CiP7s_tjmVPb_3xhViWpdaKAe8C6rGkct2Zekc28v6YX6BBUQtELP0GGvVz7wpocyn1xbD-UgAA; esctx-m1dW2TeptYM=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8XMuBF0wE-inyVJw02pGfSZMeDgGlHL_hECDf-ADpfrVJLT6wG37wnZcZUMnHcKfoIvRL5M9TmPpZzAe3gC0aO4NwbWxEWpxl7POqhOyqmM2d-m6ThCs5ZCL9cahUkkEYkdJYMCT2IRgecTQRuTcVjiAA; fpc=AknvRAF3GEtMl4GurL9O1vC8Ae7AAQAAAGvetN0OAAAA; brcap=0

Source: unknown

DNS traffic detected: queries for: estgirls-my.sharepoint.com

Source: unknown

HTTP traffic detected: POST /personal/s7958766_estg_moe_gov_sa/_api/v2.1/graphql HTTP/1.1Host: estgirls-my.sharepoint.comConnection: keep-aliveContent-Length: 507sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/json;odata=verboseContent-Type: application/json;odata=verboseX-ServiceWorker-Strategy: CacheFirstsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://estgirls-my.sharepoint.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epdf&parent=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments&ga=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=

Source: chromecache_583.2.dr	String found in binary or memory: http://fb.me/use-check-prop-types
Source: chromecache_573.2.dr, chromecache_719.2.dr	String found in binary or memory: http://scripts.sil.org/OFLThis
Source: chromecache_383.2.dr, chromecache_592.2.dr, chromecache_413.2.dr, chromecache_384.2.dr, chromecache_646.2.dr, chromecache_508.2.dr, chromecache_723.2.dr	String found in binary or memory: http://www.contoso.com
Source: chromecache_692.2.dr, chromecache_782.2.dr	String found in binary or memory: https://200.hc.com/the-harpercollins-200/moby-dick/
Source: chromecache_786.2.dr	String found in binary or memory: https://facebook.github.io/react/docs/more-about-refs.html#the-ref-callback-attribute
Source: chromecache_605.2.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_534.2.dr	String found in binary or memory: https://github.com/uuidjs/uuid#getrandomvalues-not-supported
Source: chromecache_474.2.dr	String found in binary or memory: https://lists.live.com/
Source: chromecache_502.2.dr, chromecache_664.2.dr	String found in binary or memory: https://login.ms2.belovedkittenrescue.com/haqHYyzL)
Source: chromecache_322.2.dr	String found in binary or memory: https://make.powerautomate.com
Source: chromecache_322.2.dr	String found in binary or memory: https://make.preprod.powerautomate.com
Source: chromecache_322.2.dr	String found in binary or memory: https://make.test.powerautomate.com
Source: chromecache_768.2.dr	String found in binary or memory: https://media.cloudapp.net
Source: chromecache_768.2.dr	String found in binary or memory: https://northcentralus1-medias.svc.ms
Source: chromecache_507.2.dr	String found in binary or memory: https://odspwebdevdeploy.blob.core.windows.net
Source: chromecache_637.2.dr, chromecache_507.2.dr	String found in binary or memory: https://onedrive.live.com/?gologin=1
Source: chromecache_510.2.dr, chromecache_337.2.dr, chromecache_632.2.dr, chromecache_497.2.dr	String found in binary or memory: https://outlook.office.com/search
Source: chromecache_510.2.dr, chromecache_337.2.dr, chromecache_436.2.dr	String found in binary or memory: https://portal.office.com/
Source: chromecache_583.2.dr	String found in binary or memory: https://reactjs.org/link/react-polyfills
Source: chromecache_637.2.dr	String found in binary or memory: https://res-1.cdn.office.net
Source: chromecache_637.2.dr, chromecache_777.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-04-05.011/
Source: chromecache_777.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-04-05.011/stsserviceworkerprefetch/stsservicew
Source: chromecache_777.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-04-12.003/
Source: chromecache_777.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-04-12.003/spserviceworker.js
Source: chromecache_637.2.dr	String found in binary or memory: https://res-2.cdn.office.net/files/odsp-web-prod_2024-04-05.011/
Source: chromecache_507.2.dr	String found in binary or memory: https://res.cdn.office.net/teams-js/2.0.0/js/MicrosoftTeams.min.js
Source: chromecache_507.2.dr	String found in binary or memory: https://securebroker.sharepointonline.com
Source: chromecache_768.2.dr	String found in binary or memory: https://sharepoint.uservoice.com/forums/329214-sites-and-collaboration
Source: chromecache_637.2.dr	String found in binary or memory: https://shell.cdn.office.net
Source: chromecache_637.2.dr, chromecache_777.2.dr	String found in binary or memory: https://shell.cdn.office.net/api/ShellBootstrapper/business/OneShell
Source: chromecache_768.2.dr	String found in binary or memory: https://shellppe.msocdn.com
Source: chromecache_768.2.dr	String found in binary or memory: https://shellprod.msocdn.com
Source: chromecache_637.2.dr	String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-common-library-prod_2019-02-15_20190219.002/require.js
Source: chromecache_597.2.dr	String found in binary or memory: https://substrate.office.com
Source: chromecache_393.2.dr	String found in binary or memory: https://support.office.com/en-us/article/Manage-lists-and-libraries-with-many-items-b8588dae-9387-48
Source: chromecache_692.2.dr, chromecache_782.2.dr	String found in binary or memory: https://www.littlebrown.com/titles/j-d-salinger/the-catcher-in-the-rye/9780316769488/
Source: chromecache_507.2.dr	String found in binary or memory: https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2F$
Source: chromecache_637.2.dr	String found in binary or memory: https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2Fonedrive
Source: chromecache_507.2.dr	String found in binary or memory: https://www.office.com/login?ru=%2Flaunch%2F$
Source: chromecache_637.2.dr	String found in binary or memory: https://www.office.com/login?ru=%2Flaunch%2Fonedrive
Source: chromecache_692.2.dr, chromecache_782.2.dr	String found in binary or memory: https://www.peachpit.com/store/dont-make-me-think-revisited-a-common-sense-approach-9780321965516
Source: chromecache_692.2.dr, chromecache_782.2.dr	String found in binary or memory: https://www.penguinrandomhouse.com/books/196330/great-tales-and-poems-of-edgar-allan-poe-by-edgar-al
Source: chromecache_692.2.dr	String found in binary or memory: https://www.simonandschuster.com/books/The-Great-Gatsby/F-Scott-Fitzgerald/9781982146702#:~007E;007E
Source: chromecache_782.2.dr	String found in binary or memory: https://www.simonandschuster.com/books/The-Great-Gatsby/F-Scott-Fitzgerald/9781982146702#:~:text=The
Source: chromecache_692.2.dr	String found in binary or memory: https://www.simonandschuster.com/books/The-Sun-Also-Rises/Ernest-Hemingway/9781982199524#:~007E;007E
Source: chromecache_782.2.dr	String found in binary or memory: https://www.simonandschuster.com/books/The-Sun-Also-Rises/Ernest-Hemingway/9781982199524#:~:text=The

Source: unknown	Network traffic detected: HTTP traffic on port 50254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 50260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50210
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50183
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 50251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50226
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50187
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50289 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50191
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50192
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50237
Source: unknown	Network traffic detected: HTTP traffic on port 50252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 50269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 50192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50243
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50242
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50245
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50244
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50247
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50246
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50254
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50253
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50255
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50260
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 50253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50209 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50264
Source: unknown	Network traffic detected: HTTP traffic on port 50226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50269
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50209
Source: unknown	Network traffic detected: HTTP traffic on port 50245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50289
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1964,i,6069389677495694469,7174581422029952172,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://estgirls-my.sharepoint.com/:b:/g/personal/s7958766_estg_moe_gov_sa/EeCN0MAR0F5NufUZkT2Q-mcBn4v13Ov8FQ0oi798Dgtayg?e=zTKNmK"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1964,i,6069389677495694469,7174581422029952172,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 664	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 502
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 502	Jump to dropped file

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Drive-by Compromise	Windows Management Instrumentation	1 Scripting	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://aadcdn.msftauth.net/shared/1.0/content/images/picker_account_msa_3b879963b4f70829fd7a25cbc9519792.svg	0%	URL Reputation	safe
https://make.powerautomate.com	0%	URL Reputation	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg	0%	URL Reputation	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	0%	URL Reputation	safe
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css	0%	URL Reputation	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg	0%	URL Reputation	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif	0%	URL Reputation	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif	0%	URL Reputation	safe
http://www.contoso.com	0%	URL Reputation	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg	0%	URL Reputation	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/picker_account_aad_a8332c62695d74843a11daf39a74e552.svg	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
www.belovedkittenrescue.com	82.180.132.218	true	false	unknown
dual-spo-0005.spo-msedge.net	13.107.136.10	true	false	unknown
login.belovedkittenrescue.com	82.180.132.218	true	false	unknown
part-0013.t-0009.t-msedge.net	13.107.246.41	true	false	unknown
cs1100.wpc.omegacdn.net	152.199.4.44	true	false	unknown
www.google.com	74.125.138.103	true	false	high
part-0012.t-0009.t-msedge.net	13.107.246.40	true	false	unknown
login.ms2.belovedkittenrescue.com	82.180.132.218	true	false	unknown
live.belovedkittenrescue.com	82.180.132.218	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
signup.live.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	unknown
estgirls-my.sharepoint.com	unknown	unknown	false	unknown
m365cdn.nel.measure.office.net	unknown	unknown	false	high
spo.nel.measure.office.net	unknown	unknown	false	high
identity.nel.measure.office.net	unknown	unknown	false	high
northeurope1-mediap.svc.ms	unknown	unknown	false	unknown
fpt.live.com	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/CSPReporting.aspx	false		unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/picker_account_msa_3b879963b4f70829fd7a25cbc9519792.svg	false	URL Reputation: safe	unknown
https://www.belovedkittenrescue.com/login	false		unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_eb638da25d4055fbbb57.js	false		unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg	false	URL Reputation: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_presetpasswordsplitter_3c78f555810791db83a9.js	false		unknown
https://estgirls-my.sharepoint.com/_layouts/15/spwebworkerproxy.ashx	false		unknown
https://estgirls-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=odbmspdfwebworker&debug=false&bypass=false	false		unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_xtPRDEy3EhlAdpju-Ah7qw2.js	false		unknown
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_pxjdzrjcwtmbr-ntjn_f8q2.js	false		unknown
https://login.belovedkittenrescue.com/favicon.ico	false		unknown
https://estgirls-my.sharepoint.com/:b:/g/personal/s7958766_estg_moe_gov_sa/EeCN0MAR0F5NufUZkT2Q-mcBn4v13Ov8FQ0oi798Dgtayg?e=zTKNmK	false		unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	false	URL Reputation: safe	unknown
https://estgirls-my.sharepoint.com/_layouts/15/images/odbfavicon.ico?rev=47	false		unknown
https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epdf&parent=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments&ga=1	false		unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js	false		unknown
https://login.belovedkittenrescue.com/	false		unknown
https://estgirls-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%5D&defaultBrotli=true&authenticateFast=true&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099649,3]&spStartApplicationWebBundle=true&enableIntegrities=true	false		unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_4d4b76a02ae121e3b20c.js	false		unknown
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css	false	URL Reputation: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg	false	URL Reputation: safe	unknown
https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_api/SP.OAuth.Token/Acquire()	false		unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif	false	URL Reputation: safe	unknown
https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/AccessDenied.aspx?correlation=53a820a1%2D008b%2D8000%2D9d5d%2D3d413cd47b8a	false		unknown
https://login.belovedkittenrescue.com/s/a2a2d927ec60dd38ec52c4226f2df574602a86d8408b49fd9cd2e3ecc489b6ce	false		unknown
https://login.belovedkittenrescue.com/s/a2a2d927ec60dd38ec52c4226f2df574602a86d8408b49fd9cd2e3ecc489b6ce.js	false		unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif	false	URL Reputation: safe	unknown
https://fpt.live.com/?session_id=a67d96ca27dd4840a2c4a24b8295837e&CustomerId=33e01921-4d64-4f8c-a055-5bdaffd5e33d&PageId=SU&mkt=EN-US	false		high
https://live.belovedkittenrescue.com/Me.htm?v=3	false		unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg	false	URL Reputation: safe	unknown
https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_api/v2.1/graphql	false		unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/picker_account_aad_a8332c62695d74843a11daf39a74e552.svg	false	URL Reputation: safe	unknown
https://login.ms2.belovedkittenrescue.com/haqHYyzL	false		unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.simonandschuster.com/books/The-Sun-Also-Rises/Ernest-Hemingway/9781982199524#:~007E;007E	chromecache_692.2.dr	false		high
https://outlook.office.com/search	chromecache_510.2.dr, chromecache_337.2.dr, chromecache_632.2.dr, chromecache_497.2.dr	false		high
https://www.office.com/login?ru=%2Flaunch%2F$	chromecache_507.2.dr	false		high
https://shellppe.msocdn.com	chromecache_768.2.dr	false		unknown
https://make.powerautomate.com	chromecache_322.2.dr	false	URL Reputation: safe	unknown
https://sharepoint.uservoice.com/forums/329214-sites-and-collaboration	chromecache_768.2.dr	false		high
https://support.office.com/en-us/article/Manage-lists-and-libraries-with-many-items-b8588dae-9387-48	chromecache_393.2.dr	false		high
https://www.littlebrown.com/titles/j-d-salinger/the-catcher-in-the-rye/9780316769488/	chromecache_692.2.dr, chromecache_782.2.dr	false		unknown
https://reactjs.org/link/react-polyfills	chromecache_583.2.dr	false		high
https://securebroker.sharepointonline.com	chromecache_507.2.dr	false		unknown
https://shellprod.msocdn.com	chromecache_768.2.dr	false		unknown
https://northcentralus1-medias.svc.ms	chromecache_768.2.dr	false		unknown
https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2F$	chromecache_507.2.dr	false		high
https://www.simonandschuster.com/books/The-Great-Gatsby/F-Scott-Fitzgerald/9781982146702#:~:text=The	chromecache_782.2.dr	false		high
https://onedrive.live.com/?gologin=1	chromecache_637.2.dr, chromecache_507.2.dr	false		high
https://200.hc.com/the-harpercollins-200/moby-dick/	chromecache_692.2.dr, chromecache_782.2.dr	false		unknown
https://facebook.github.io/react/docs/more-about-refs.html#the-ref-callback-attribute	chromecache_786.2.dr	false		unknown
https://make.preprod.powerautomate.com	chromecache_322.2.dr	false		unknown
https://login.ms2.belovedkittenrescue.com/haqHYyzL)	chromecache_502.2.dr, chromecache_664.2.dr	false		unknown
https://portal.office.com/	chromecache_510.2.dr, chromecache_337.2.dr, chromecache_436.2.dr	false		high
https://www.penguinrandomhouse.com/books/196330/great-tales-and-poems-of-edgar-allan-poe-by-edgar-al	chromecache_692.2.dr, chromecache_782.2.dr	false		high
https://make.test.powerautomate.com	chromecache_322.2.dr	false		unknown
https://github.com/douglascrockford/JSON-js	chromecache_605.2.dr	false		high
https://www.simonandschuster.com/books/The-Great-Gatsby/F-Scott-Fitzgerald/9781982146702#:~007E;007E	chromecache_692.2.dr	false		high
http://fb.me/use-check-prop-types	chromecache_583.2.dr	false		high
https://spoprod-a.akamaihd.net/files/odsp-common-library-prod_2019-02-15_20190219.002/require.js	chromecache_637.2.dr	false		high
https://www.simonandschuster.com/books/The-Sun-Also-Rises/Ernest-Hemingway/9781982199524#:~:text=The	chromecache_782.2.dr	false		high
https://substrate.office.com	chromecache_597.2.dr	false		high
https://www.peachpit.com/store/dont-make-me-think-revisited-a-common-sense-approach-9780321965516	chromecache_692.2.dr, chromecache_782.2.dr	false		high
http://www.contoso.com	chromecache_383.2.dr, chromecache_592.2.dr, chromecache_413.2.dr, chromecache_384.2.dr, chromecache_646.2.dr, chromecache_508.2.dr, chromecache_723.2.dr	false	URL Reputation: safe	unknown
https://lists.live.com/	chromecache_474.2.dr	false		high
https://www.office.com/login?ru=%2Flaunch%2Fonedrive	chromecache_637.2.dr	false		high
http://scripts.sil.org/OFLThis	chromecache_573.2.dr, chromecache_719.2.dr	false		high
https://github.com/uuidjs/uuid#getrandomvalues-not-supported	chromecache_534.2.dr	false		high
https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2Fonedrive	chromecache_637.2.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.138.10	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.41	part-0013.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.40	part-0012.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
82.180.132.218	www.belovedkittenrescue.com	Denmark	29100	BROADCOMDK	false
13.107.213.41	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
74.125.138.103	www.google.com	United States	15169	GOOGLEUS	false
152.199.4.44	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428968
Start date and time:	2024-04-19 23:49:59 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://estgirls-my.sharepoint.com/:b:/g/personal/s7958766_estg_moe_gov_sa/EeCN0MAR0F5NufUZkT2Q-mcBn4v13Ov8FQ0oi798Dgtayg?e=zTKNmK
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.phis.win@20/932@42/12
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://login.ms2.belovedkittenrescue.com/haqHYyzL Browse: https://live.belovedkittenrescue.com/oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&scope=openid+profile+https%3a%2f%2fwww.belovedkittenrescue.com%2fv2%2fOfficeHome.All&redirect_uri=https%3a%2f%2fwww.belovedkittenrescue.com%2flandingv2&response_type=code+id_token&state=Syu44JejXp8LqEQ8ywvgVxEnArYu1QcYhl-Pjbt8Eb1gV1TwVt4Bbi_S0ujC6W1Y35lH-Juduiv30Rgn2iNnyWaxJOj1wIYIXOHdFcuxUXV6YgKOr4Uu8HaqYFLj7UfQFh7tYALG3-zJu7_aQQbErMOwU-u7imKtReh_ivYEweWc_bobgs8C9H1b7ooj0ONkkl81AeG_dRo4RaYMlNCBJrRtujJ2ob0xiwEdQhb1SW_AxV5tFXAWFZIVz_Zt_Jj-W8CyxgXd3loRZsHHgX4Ccg&response_mode=form_post&nonce=638491602979817971.ZGM3ODI3MmYtMmZhYi00ZmFmLThkZWEtM2Q3N2Q5NjQyZjM5YWY3NDM0ZTEtZmI0Yy00Yjk4LTkxODUtYjEzOTY5ODVlZDIx&x-client-SKU=ID_NET6_0&x-client-Ver=7.3.1.0&uaid=a67d96ca27dd4840a2c4a24b8295837e&msproxy=1&issuer=mso&tenant=common&ui_locales=en-US&signup=1&lw=1&fl=easi2&epct=PAQABDgEAAADnfolhJpSnRYB1SVj-Hgd84h4hf9pcjo3oO1Z-_mXJ2p2B7lrhMIxU8LSIrlUAGcxDdijkf9VDPFFGEJC1gVwXCZKDJ0cSla6xR8hPI_XQAql-YvlMf20Q3gt_RROXZTOgJAVZO1CcE95A2X9mmoEkMvGEP-d9uM8P4eB2zAbd0nBSdTIf3MFEU_sKFHKsxuOw95TmYnUQrE1bd-l93mttsr-j6uZRqb5gKNc0G_4RdCAA&jshs=0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (45312)
Category:	downloaded
Size (bytes):	45342
Entropy (8bit):	5.398802624688839
Encrypted:	false
SSDEEP:	768:tSMtbp15CYsoYMSNSVJotbJkogJHtKg/Vt7aiAelg8hd0biXsVvlG4e:tSyl153YMxoAVd4g/VFai0vl9e
MD5:	412631F9B4650033EC0BFE2B5A1CC4D2
SHA1:	8D2A8243FD33E8E30F3BD323F43F807A0DFDC92D
SHA-256:	F3D5E2D3BD04FA71C9AA22903462FE98B7FDB71EAB3F89B871F7F9190C2E8023
SHA-512:	A40BB1F4A655013FDDA39953B774080D91BF6C80CB1AD4E438C09AEF81C8A53AFB118D42E9614FE5D6D871B06C491DF1FA37B5099EF52660E6D91637A7687289
Malicious:	false
Reputation:	low
URL:	https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.utilities/fui.util-fdbfe309.js
Preview:	"use strict";(self.odspNextWebpackJsonp=self.odspNextWebpackJsonp\|\|[]).push([["fui.util"],{"fui.util_719":(e,t,n)=>{n.d(t,{YY:()=>Gt,F2:()=>lt,up:()=>S,r5:()=>we,DG:()=>v,H3:()=>Fe,nO:()=>b,k_:()=>zt,YI:()=>g,xQ:()=>bn,AZ:()=>J,xY:()=>X,Aq:()=>Ne,Xh:()=>l,VO:()=>d,Jx:()=>Z,CW:()=>w,ny:()=>Y,Z3:()=>Q,w9:()=>p,cI:()=>k,HQ:()=>kt,TA:()=>ce,hx:()=>Rt,Df:()=>_e,wB:()=>xt,t3:()=>vt,te:()=>yt,dy:()=>me,bQ:()=>wn,sN:()=>He,N0:()=>hn,i3:()=>Ot,_x:()=>ln,it:()=>Yt,tw:()=>Jt,p9:()=>Ge,cc:()=>Nt,mB:()=>Qt,so:()=>St,hl:()=>pn,wT:()=>tn,Pq:()=>le,ih:()=>he,S9:()=>_n,K4:()=>h,fj:()=>Xt,vM:()=>$t,lM:()=>mn,wZ:()=>rt,PV:()=>$e,CS:()=>ye,o3:()=>De,N6:()=>Ce,gp:()=>Zt,_z:()=>en,yi:()=>an,DU:()=>qt,Yq:()=>nn,z3:()=>I,eH:()=>Te,V9:()=>x,Dn:()=>Pt,bP:()=>T,wc:()=>Wt,T7:()=>ve,ry:()=>f,MV:()=>Mt,xK:()=>dn,_q:()=>cn,__:()=>sn,xE:()=>on,Gw:()=>rn,Q8:()=>Kt,gj:()=>P,pZ:()=>gt,Mt:()=>Ft,aM:()=>It,Zx:()=>Pe,RH:()=>Bt,e1:()=>On,n8:()=>Cn,cT:()=>We,Pl:()=>Ke,dN:()=>Ue,NN:()=>ke,fV:()=>Vt,FB:()=>H,TG:()=>B,fZ:()=>Le

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 23:50:52.016045094 CEST	53	58592	1.1.1.1	192.168.2.4
Apr 19, 2024 23:50:52.059843063 CEST	53	59864	1.1.1.1	192.168.2.4
Apr 19, 2024 23:50:52.693264008 CEST	53	54926	1.1.1.1	192.168.2.4
Apr 19, 2024 23:50:53.051738977 CEST	62570	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:50:53.052459002 CEST	53497	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:50:55.242415905 CEST	57127	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:50:55.242660999 CEST	64565	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:50:55.986896992 CEST	62663	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:50:55.987289906 CEST	55121	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:50:56.092348099 CEST	53	55121	1.1.1.1	192.168.2.4
Apr 19, 2024 23:50:56.092493057 CEST	53	62663	1.1.1.1	192.168.2.4
Apr 19, 2024 23:51:04.618936062 CEST	55331	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:51:04.619820118 CEST	62707	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:51:09.688930035 CEST	53	63857	1.1.1.1	192.168.2.4
Apr 19, 2024 23:51:13.105443001 CEST	138	138	192.168.2.4	192.168.2.255
Apr 19, 2024 23:51:15.885288954 CEST	52997	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:51:15.885559082 CEST	55656	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:51:15.992028952 CEST	53	52997	1.1.1.1	192.168.2.4
Apr 19, 2024 23:51:16.019066095 CEST	53	55656	1.1.1.1	192.168.2.4
Apr 19, 2024 23:51:17.782210112 CEST	56797	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:51:17.782510042 CEST	58420	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:51:17.887005091 CEST	53	56797	1.1.1.1	192.168.2.4
Apr 19, 2024 23:51:17.914985895 CEST	53	58420	1.1.1.1	192.168.2.4
Apr 19, 2024 23:51:26.105061054 CEST	53	50422	1.1.1.1	192.168.2.4
Apr 19, 2024 23:51:29.124187946 CEST	53	50665	1.1.1.1	192.168.2.4
Apr 19, 2024 23:51:34.360423088 CEST	62983	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:51:34.360802889 CEST	50064	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:51:34.500714064 CEST	53	50064	1.1.1.1	192.168.2.4
Apr 19, 2024 23:51:34.535137892 CEST	53	62983	1.1.1.1	192.168.2.4
Apr 19, 2024 23:51:35.601744890 CEST	65312	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:51:35.602215052 CEST	53330	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:51:35.725867033 CEST	53	65312	1.1.1.1	192.168.2.4
Apr 19, 2024 23:51:35.779531956 CEST	53	53330	1.1.1.1	192.168.2.4
Apr 19, 2024 23:51:37.208081961 CEST	61057	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:51:37.208081961 CEST	57790	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:51:37.321583033 CEST	53	57790	1.1.1.1	192.168.2.4
Apr 19, 2024 23:51:37.347795963 CEST	53	61057	1.1.1.1	192.168.2.4
Apr 19, 2024 23:51:41.119288921 CEST	55894	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:51:41.119817972 CEST	62448	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:51:41.183228970 CEST	54571	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:51:41.183434963 CEST	61759	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:51:41.223896027 CEST	53	55894	1.1.1.1	192.168.2.4
Apr 19, 2024 23:51:41.224145889 CEST	53	62448	1.1.1.1	192.168.2.4
Apr 19, 2024 23:51:41.306375027 CEST	53	54571	1.1.1.1	192.168.2.4
Apr 19, 2024 23:51:41.314172029 CEST	53	61759	1.1.1.1	192.168.2.4
Apr 19, 2024 23:51:42.689433098 CEST	56715	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:51:42.689596891 CEST	58879	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:51:42.794183969 CEST	53	58879	1.1.1.1	192.168.2.4
Apr 19, 2024 23:51:42.794426918 CEST	53	56715	1.1.1.1	192.168.2.4
Apr 19, 2024 23:51:44.975734949 CEST	53	57644	1.1.1.1	192.168.2.4
Apr 19, 2024 23:51:52.164634943 CEST	53	61721	1.1.1.1	192.168.2.4
Apr 19, 2024 23:51:52.179316998 CEST	53	52294	1.1.1.1	192.168.2.4
Apr 19, 2024 23:52:03.251315117 CEST	60812	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:52:03.252243042 CEST	52676	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:52:04.639153957 CEST	51718	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:52:04.639309883 CEST	56481	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:52:04.639986038 CEST	52731	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:52:04.640189886 CEST	60002	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:52:04.641066074 CEST	61782	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:52:04.641305923 CEST	56180	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:52:04.641921043 CEST	57666	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:52:04.642067909 CEST	59116	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:52:05.078998089 CEST	49981	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:52:05.079271078 CEST	64663	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:52:08.768858910 CEST	53	54204	1.1.1.1	192.168.2.4
Apr 19, 2024 23:52:08.840796947 CEST	63097	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:52:08.841475010 CEST	50627	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:52:10.195173025 CEST	57833	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:52:10.195395947 CEST	61684	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:52:11.712143898 CEST	55474	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:52:11.712321997 CEST	52389	53	192.168.2.4	1.1.1.1
Apr 19, 2024 23:52:20.380517006 CEST	53	63917	1.1.1.1	192.168.2.4

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 19, 2024 23:51:16.019123077 CEST	192.168.2.4	1.1.1.1	c256	(Port unreachable)	Destination Unreachable
Apr 19, 2024 23:52:08.992216110 CEST	192.168.2.4	1.1.1.1	c2a1	(Port unreachable)	Destination Unreachable

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 19, 2024 23:50:53.276154041 CEST	1.1.1.1	192.168.2.4	0xd9ab	No error (0)	estgirls-my.sharepoint.com	estgirls.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:50:53.276154041 CEST	1.1.1.1	192.168.2.4	0xd9ab	No error (0)	estgirls.sharepoint.com	1241-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:50:53.276154041 CEST	1.1.1.1	192.168.2.4	0xd9ab	No error (0)	1241-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com	188214-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:50:53.276154041 CEST	1.1.1.1	192.168.2.4	0xd9ab	No error (0)	188214-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com	188214-ipv4v6w.farm.dprodmgd104.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:50:53.276154041 CEST	1.1.1.1	192.168.2.4	0xd9ab	No error (0)	188214-ipv4v6.farm.dprodmgd104.aa-rt.sharepoint.com.dual-spo-0005.spo-msedge.net	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:50:53.276154041 CEST	1.1.1.1	192.168.2.4	0xd9ab	No error (0)	dual-spo-0005.spo-msedge.net		13.107.136.10	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:50:53.276154041 CEST	1.1.1.1	192.168.2.4	0xd9ab	No error (0)	dual-spo-0005.spo-msedge.net		13.107.138.10	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:50:53.277805090 CEST	1.1.1.1	192.168.2.4	0xa35	No error (0)	estgirls-my.sharepoint.com	estgirls.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:50:53.277805090 CEST	1.1.1.1	192.168.2.4	0xa35	No error (0)	estgirls.sharepoint.com	1241-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:50:53.277805090 CEST	1.1.1.1	192.168.2.4	0xa35	No error (0)	1241-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com	188214-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:50:53.277805090 CEST	1.1.1.1	192.168.2.4	0xa35	No error (0)	188214-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com	188214-ipv4v6w.farm.dprodmgd104.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:50:55.452156067 CEST	1.1.1.1	192.168.2.4	0x83c0	No error (0)	estgirls-my.sharepoint.com	estgirls.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:50:55.452156067 CEST	1.1.1.1	192.168.2.4	0x83c0	No error (0)	estgirls.sharepoint.com	1241-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:50:55.452156067 CEST	1.1.1.1	192.168.2.4	0x83c0	No error (0)	1241-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com	188214-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:50:55.452156067 CEST	1.1.1.1	192.168.2.4	0x83c0	No error (0)	188214-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com	188214-ipv4v6w.farm.dprodmgd104.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:50:55.488945961 CEST	1.1.1.1	192.168.2.4	0x4d4d	No error (0)	estgirls-my.sharepoint.com	estgirls.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:50:55.488945961 CEST	1.1.1.1	192.168.2.4	0x4d4d	No error (0)	estgirls.sharepoint.com	1241-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:50:55.488945961 CEST	1.1.1.1	192.168.2.4	0x4d4d	No error (0)	1241-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com	188214-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:50:55.488945961 CEST	1.1.1.1	192.168.2.4	0x4d4d	No error (0)	188214-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com	188214-ipv4v6w.farm.dprodmgd104.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:50:55.488945961 CEST	1.1.1.1	192.168.2.4	0x4d4d	No error (0)	188214-ipv4v6.farm.dprodmgd104.aa-rt.sharepoint.com.dual-spo-0005.spo-msedge.net	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:50:55.488945961 CEST	1.1.1.1	192.168.2.4	0x4d4d	No error (0)	dual-spo-0005.spo-msedge.net		13.107.136.10	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:50:55.488945961 CEST	1.1.1.1	192.168.2.4	0x4d4d	No error (0)	dual-spo-0005.spo-msedge.net		13.107.138.10	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:50:56.092348099 CEST	1.1.1.1	192.168.2.4	0x75b6	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 19, 2024 23:50:56.092493057 CEST	1.1.1.1	192.168.2.4	0x223c	No error (0)	www.google.com		74.125.138.103	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:50:56.092493057 CEST	1.1.1.1	192.168.2.4	0x223c	No error (0)	www.google.com		74.125.138.99	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:50:56.092493057 CEST	1.1.1.1	192.168.2.4	0x223c	No error (0)	www.google.com		74.125.138.104	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:50:56.092493057 CEST	1.1.1.1	192.168.2.4	0x223c	No error (0)	www.google.com		74.125.138.105	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:50:56.092493057 CEST	1.1.1.1	192.168.2.4	0x223c	No error (0)	www.google.com		74.125.138.147	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:50:56.092493057 CEST	1.1.1.1	192.168.2.4	0x223c	No error (0)	www.google.com		74.125.138.106	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:51:04.723977089 CEST	1.1.1.1	192.168.2.4	0x7a9f	No error (0)	spo.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:51:04.729367018 CEST	1.1.1.1	192.168.2.4	0x54b5	No error (0)	spo.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:51:09.963435888 CEST	1.1.1.1	192.168.2.4	0x961c	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:51:09.963435888 CEST	1.1.1.1	192.168.2.4	0x961c	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:51:15.992028952 CEST	1.1.1.1	192.168.2.4	0xb7fe	No error (0)	northeurope1-mediap.svc.ms	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:51:15.992028952 CEST	1.1.1.1	192.168.2.4	0xb7fe	No error (0)	dual-spo-0005.spo-msedge.net		13.107.138.10	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:51:15.992028952 CEST	1.1.1.1	192.168.2.4	0xb7fe	No error (0)	dual-spo-0005.spo-msedge.net		13.107.136.10	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:51:16.019066095 CEST	1.1.1.1	192.168.2.4	0xd8d2	No error (0)	northeurope1-mediap.svc.ms	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:51:17.887005091 CEST	1.1.1.1	192.168.2.4	0xb117	No error (0)	northeurope1-mediap.svc.ms	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:51:17.887005091 CEST	1.1.1.1	192.168.2.4	0xb117	No error (0)	dual-spo-0005.spo-msedge.net		13.107.138.10	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:51:17.887005091 CEST	1.1.1.1	192.168.2.4	0xb117	No error (0)	dual-spo-0005.spo-msedge.net		13.107.136.10	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:51:17.914985895 CEST	1.1.1.1	192.168.2.4	0x7104	No error (0)	northeurope1-mediap.svc.ms	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:51:22.469954014 CEST	1.1.1.1	192.168.2.4	0xb50	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:51:22.469954014 CEST	1.1.1.1	192.168.2.4	0xb50	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:51:34.535137892 CEST	1.1.1.1	192.168.2.4	0x23d1	No error (0)	login.ms2.belovedkittenrescue.com		82.180.132.218	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:51:35.725867033 CEST	1.1.1.1	192.168.2.4	0x32ad	No error (0)	login.belovedkittenrescue.com		82.180.132.218	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:51:37.347795963 CEST	1.1.1.1	192.168.2.4	0x8c63	No error (0)	www.belovedkittenrescue.com		82.180.132.218	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:51:39.232912064 CEST	1.1.1.1	192.168.2.4	0xb0c9	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:51:39.232912064 CEST	1.1.1.1	192.168.2.4	0xb0c9	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:51:39.232912064 CEST	1.1.1.1	192.168.2.4	0xb0c9	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:51:41.223896027 CEST	1.1.1.1	192.168.2.4	0x103a	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:51:41.223896027 CEST	1.1.1.1	192.168.2.4	0x103a	No error (0)	cs1100.wpc.omegacdn.net		152.199.4.44	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:51:41.224145889 CEST	1.1.1.1	192.168.2.4	0x451d	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:51:41.306375027 CEST	1.1.1.1	192.168.2.4	0x9e6	No error (0)	live.belovedkittenrescue.com		82.180.132.218	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:51:42.794183969 CEST	1.1.1.1	192.168.2.4	0xfabd	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:51:42.794426918 CEST	1.1.1.1	192.168.2.4	0x974c	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:51:42.794426918 CEST	1.1.1.1	192.168.2.4	0x974c	No error (0)	cs1100.wpc.omegacdn.net		152.199.4.44	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:51:44.267219067 CEST	1.1.1.1	192.168.2.4	0xf90	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:51:44.267219067 CEST	1.1.1.1	192.168.2.4	0xf90	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:52:03.370285034 CEST	1.1.1.1	192.168.2.4	0x30e0	No error (0)	signup.live.com	account.msa.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:03.384850979 CEST	1.1.1.1	192.168.2.4	0xb032	No error (0)	signup.live.com	account.msa.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:04.744221926 CEST	1.1.1.1	192.168.2.4	0x7b5c	No error (0)	m365cdn.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:04.744261026 CEST	1.1.1.1	192.168.2.4	0x7e64	No error (0)	m365cdn.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:04.744951963 CEST	1.1.1.1	192.168.2.4	0xaccc	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:04.746140003 CEST	1.1.1.1	192.168.2.4	0x86f1	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:04.748842955 CEST	1.1.1.1	192.168.2.4	0x2666	No error (0)	spo.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:04.860183954 CEST	1.1.1.1	192.168.2.4	0x6720	No error (0)	estgirls-my.sharepoint.com	estgirls.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:04.860183954 CEST	1.1.1.1	192.168.2.4	0x6720	No error (0)	estgirls.sharepoint.com	1241-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:04.860183954 CEST	1.1.1.1	192.168.2.4	0x6720	No error (0)	1241-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com	188214-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:04.860183954 CEST	1.1.1.1	192.168.2.4	0x6720	No error (0)	188214-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com	188214-ipv4v6w.farm.dprodmgd104.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:04.860183954 CEST	1.1.1.1	192.168.2.4	0x6720	No error (0)	188214-ipv4v6.farm.dprodmgd104.aa-rt.sharepoint.com.dual-spo-0005.spo-msedge.net	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:04.860183954 CEST	1.1.1.1	192.168.2.4	0x6720	No error (0)	dual-spo-0005.spo-msedge.net		13.107.136.10	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:52:04.860183954 CEST	1.1.1.1	192.168.2.4	0x6720	No error (0)	dual-spo-0005.spo-msedge.net		13.107.138.10	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:52:04.860260010 CEST	1.1.1.1	192.168.2.4	0xbd2b	No error (0)	estgirls-my.sharepoint.com	estgirls.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:04.860260010 CEST	1.1.1.1	192.168.2.4	0xbd2b	No error (0)	estgirls.sharepoint.com	1241-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:04.860260010 CEST	1.1.1.1	192.168.2.4	0xbd2b	No error (0)	1241-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com	188214-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:04.860260010 CEST	1.1.1.1	192.168.2.4	0xbd2b	No error (0)	188214-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com	188214-ipv4v6w.farm.dprodmgd104.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:04.964967012 CEST	1.1.1.1	192.168.2.4	0x9fa3	No error (0)	spo.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:05.001430988 CEST	1.1.1.1	192.168.2.4	0xd06c	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:05.001430988 CEST	1.1.1.1	192.168.2.4	0xd06c	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:52:05.183685064 CEST	1.1.1.1	192.168.2.4	0xa081	No error (0)	spo.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:05.184252024 CEST	1.1.1.1	192.168.2.4	0xb68d	No error (0)	spo.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:06.325450897 CEST	1.1.1.1	192.168.2.4	0xcf4e	No error (0)	shed.dual-low.part-0012.t-0009.t-msedge.net	part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:06.325450897 CEST	1.1.1.1	192.168.2.4	0xcf4e	No error (0)	part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:52:06.325450897 CEST	1.1.1.1	192.168.2.4	0xcf4e	No error (0)	part-0012.t-0009.t-msedge.net		13.107.213.40	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:52:07.040003061 CEST	1.1.1.1	192.168.2.4	0xbb	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:07.040003061 CEST	1.1.1.1	192.168.2.4	0xbb	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:52:07.040003061 CEST	1.1.1.1	192.168.2.4	0xbb	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:52:08.917377949 CEST	1.1.1.1	192.168.2.4	0xf70	No error (0)	csp-afd-prod.azurefd.net	azurefd-t-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:08.917377949 CEST	1.1.1.1	192.168.2.4	0xf70	No error (0)	shed.dual-low.part-0013.t-0009.t-msedge.net	part-0013.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:08.917377949 CEST	1.1.1.1	192.168.2.4	0xf70	No error (0)	part-0013.t-0009.t-msedge.net		13.107.213.41	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:52:08.917377949 CEST	1.1.1.1	192.168.2.4	0xf70	No error (0)	part-0013.t-0009.t-msedge.net		13.107.246.41	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:52:08.918725014 CEST	1.1.1.1	192.168.2.4	0x39a9	No error (0)	csp-afd-prod.azurefd.net	azurefd-t-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:08.947514057 CEST	1.1.1.1	192.168.2.4	0xadca	No error (0)	fpt.live.com	fpt.microsoft.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:08.991833925 CEST	1.1.1.1	192.168.2.4	0x935c	No error (0)	fpt.live.com	fpt.microsoft.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:10.301717997 CEST	1.1.1.1	192.168.2.4	0xd4a7	No error (0)	signup.live.com	account.msa.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:10.328602076 CEST	1.1.1.1	192.168.2.4	0x506c	No error (0)	signup.live.com	account.msa.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:11.820292950 CEST	1.1.1.1	192.168.2.4	0xae1b	No error (0)	fpt.live.com	fpt.microsoft.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:11.837847948 CEST	1.1.1.1	192.168.2.4	0x1ef5	No error (0)	fpt.live.com	fpt.microsoft.com		CNAME (Canonical name)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:50:53 UTC	764	OUT	GET /:b:/g/personal/s7958766_estg_moe_gov_sa/EeCN0MAR0F5NufUZkT2Q-mcBn4v13Ov8FQ0oi798Dgtayg?e=zTKNmK HTTP/1.1 Host: estgirls-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 21:50:53 UTC	3316	IN	HTTP/1.1 302 Found Cache-Control: private Content-Length: 369 Content-Type: text/html; charset=utf-8 Location: https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epdf&parent=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments&ga=1 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=; path=/; SameSite=None; secure; HttpOnly X-NetworkStatistics: 0,525568,0,0,1068517,0,156431 X-SharePointHealthScore: 0 X-AspNet-Version: 4.0.30319 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: 42a820a1-a012-8000-8798-d355412d14d9 request-id: 42a820a1-a012-8000-8798-d355412d14d9 MS-CV: oSCoQhKgAICHmNNVQS0U2Q.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=b6875bbb-f371-480d-aba1-2972ce042c2b&destinationEndpoint=Edge-Prod-ATL33r5b&frontEnd=AFD&RemoteIP=81.181.57.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; SPRequestDuration: 150 SPIisLatency: 3 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 7067D5B38AAC4365954EBE62065E1B9D Ref B: ATL331000104045 Ref C: 2024-04-19T21:50:53Z Date: Fri, 19 Apr 2024 21:50:53 GMT Connection: close
2024-04-19 21:50:53 UTC	369	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 65 73 74 67 69 72 6c 73 2d 6d 79 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 2f 70 65 72 73 6f 6e 61 6c 2f 73 37 39 35 38 37 36 36 5f 65 73 74 67 5f 6d 6f 65 5f 67 6f 76 5f 73 61 2f 5f 6c 61 79 6f 75 74 73 2f 31 35 2f 6f 6e 65 64 72 69 76 65 2e 61 73 70 78 3f 69 64 3d 25 32 46 70 65 72 73 6f 6e 61 6c 25 32 46 73 37 39 35 38 37 36 36 25 35 46 65 73 74 67 25 35 46 6d 6f 65 25 35 46 67 6f 76 25 35 46 73 61 25 32 46 44 6f 63 75 6d 65 6e 74 73 25 32 46 63 6f 6e 74 72 61 63 74 25 32 45 70 64 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epd

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:50:54 UTC	1552	OUT	GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1 Host: estgirls-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=
2024-04-19 21:50:55 UTC	3031	IN	HTTP/1.1 200 OK Cache-Control: max-age=600 Transfer-Encoding: chunked Content-Type: text/javascript; charset=utf-8 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=; path=/; SameSite=None; secure; HttpOnly X-NetworkStatistics: 0,525568,0,0,372648,0,58641 X-SharePointHealthScore: 3 X-AspNet-Version: 4.0.30319 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: 42a820a1-7068-8000-995c-9a3e782969ff request-id: 42a820a1-7068-8000-995c-9a3e782969ff MS-CV: oSCoQmhwAICZXJo+eClp/w.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=b6875bbb-f371-480d-aba1-2972ce042c2b&destinationEndpoint=Edge-Prod-ATL33r5d&frontEnd=AFD&RemoteIP=81.181.57.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: EBBEA6559CD24612B98E9ECD825582B7 Ref B: ATL331000107049 Ref C: 2024-04-19T21:50:55Z Date: Fri, 19 Apr 2024 21:50:54 GMT Connection: close
2024-04-19 21:50:55 UTC	706	IN	Data Raw: 32 62 62 0d 0a 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 20 3d 20 7b 7d 3b 0a 73 65 6c 66 2e 5f 6d 61 72 6b 50 65 72 66 53 74 61 67 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 65 79 29 20 7b 69 66 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 20 3d 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 29 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 3b 7d 20 65 6c 73 65 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 44 61 74 65 2e 6e 6f 77 28 29 3b 7d 20 69 66 20 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f Data Ascii: 2bbself._perfMarks = {};self._markPerfStage=function(key) {if(self.performance && typeof self.performance.now === 'function'){self._perfMarks[key]=self.performance.now();} else{self._perfMarks[key]=Date.now();} if (self.performance && typeof self.perfo
2024-04-19 21:50:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:50:55 UTC	1545	OUT	GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1 Host: estgirls-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=
2024-04-19 21:50:56 UTC	3028	IN	HTTP/1.1 200 OK Cache-Control: max-age=600 Transfer-Encoding: chunked Content-Type: text/javascript; charset=utf-8 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=; path=/; SameSite=None; secure; HttpOnly X-NetworkStatistics: 0,525568,0,0,248,0,24208 X-SharePointHealthScore: 1 X-AspNet-Version: 4.0.30319 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: 42a820a1-f0aa-8000-914e-e1c950dbd9ae request-id: 42a820a1-f0aa-8000-914e-e1c950dbd9ae MS-CV: oSCoQqrwAICRTuHJUNvZrg.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=b6875bbb-f371-480d-aba1-2972ce042c2b&destinationEndpoint=Edge-Prod-ATL33r5a&frontEnd=AFD&RemoteIP=81.181.57.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: F0985BBFBBFD4CD69C7DA967D860FB18 Ref B: ATL331000102051 Ref C: 2024-04-19T21:50:55Z Date: Fri, 19 Apr 2024 21:50:55 GMT Connection: close
2024-04-19 21:50:56 UTC	706	IN	Data Raw: 32 62 62 0d 0a 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 20 3d 20 7b 7d 3b 0a 73 65 6c 66 2e 5f 6d 61 72 6b 50 65 72 66 53 74 61 67 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 65 79 29 20 7b 69 66 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 20 3d 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 29 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 3b 7d 20 65 6c 73 65 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 44 61 74 65 2e 6e 6f 77 28 29 3b 7d 20 69 66 20 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f Data Ascii: 2bbself._perfMarks = {};self._markPerfStage=function(key) {if(self.performance && typeof self.performance.now === 'function'){self._perfMarks[key]=self.performance.now();} else{self._perfMarks[key]=Date.now();} if (self.performance && typeof self.perfo
2024-04-19 21:50:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:50:56 UTC	2132	OUT	POST /personal/s7958766_estg_moe_gov_sa/_api/v2.1/graphql HTTP/1.1 Host: estgirls-my.sharepoint.com Connection: keep-alive Content-Length: 507 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json;odata=verbose Content-Type: application/json;odata=verbose X-ServiceWorker-Strategy: CacheFirst sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://estgirls-my.sharepoint.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epdf&parent=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments&ga=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=
2024-04-19 21:50:56 UTC	507	OUT	Data Raw: 7b 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 28 5c 6e 20 20 20 20 20 20 20 20 24 73 70 6f 53 75 69 74 65 4c 69 6e 6b 73 51 75 65 72 79 53 74 72 69 6e 67 3a 20 53 74 72 69 6e 67 21 5c 6e 20 20 20 20 20 20 20 20 29 5c 6e 20 20 20 20 20 20 7b 5c 6e 20 20 20 20 20 20 5c 6e 20 20 20 20 20 20 6c 65 67 61 63 79 20 7b 5c 6e 20 20 20 20 20 20 73 70 6f 53 75 69 74 65 4c 69 6e 6b 73 28 5c 6e 20 20 20 20 20 20 71 75 65 72 79 53 74 72 69 6e 67 3a 20 24 73 70 6f 53 75 69 74 65 4c 69 6e 6b 73 51 75 65 72 79 53 74 72 69 6e 67 5c 6e 20 20 20 20 20 20 29 20 20 20 20 20 20 20 20 20 20 5c 6e 20 20 20 20 20 20 5c 6e 20 20 20 20 7d 5c 6e 20 20 20 20 20 20 5c 6e 20 20 20 20 20 20 5c 6e 20 20 70 65 72 66 20 7b 5c 6e 20 20 20 20 65 78 65 63 75 74 69 6f 6e 54 69 6d 65 5c 6e 20 Data Ascii: {"query":"query (\n $spoSuiteLinksQueryString: String!\n )\n {\n \n legacy {\n spoSuiteLinks(\n queryString: $spoSuiteLinksQueryString\n ) \n \n }\n \n \n perf {\n executionTime\n
2024-04-19 21:50:56 UTC	3010	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 24588 Content-Type: application/json P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=; path=/; SameSite=None; secure; HttpOnly X-NetworkStatistics: 0,525568,0,0,1071101,0,161883 X-SharePointHealthScore: 0 X-AspNet-Version: 4.0.30319 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: 42a820a1-d0b3-8000-8798-dafb4c92bd58 request-id: 42a820a1-d0b3-8000-8798-dafb4c92bd58 MS-CV: oSCoQrPQAICHmNr7TJK9WA.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=b6875bbb-f371-480d-aba1-2972ce042c2b&destinationEndpoint=Edge-Prod-ATL33r5b&frontEnd=AFD&RemoteIP=81.181.57.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 51297753AA694B0FA24DA47195303448 Ref B: ATL331000104045 Ref C: 2024-04-19T21:50:56Z Date: Fri, 19 Apr 2024 21:50:56 GMT Connection: close
2024-04-19 21:50:56 UTC	2784	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 6c 65 67 61 63 79 22 3a 7b 22 73 70 6f 53 75 69 74 65 4c 69 6e 6b 73 22 3a 7b 0a 20 22 53 50 53 75 69 74 65 56 65 72 73 69 6f 6e 22 3a 32 2c 0a 20 22 53 50 49 73 4d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 0a 20 22 43 73 73 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 73 68 65 6c 6c 75 78 2f 73 75 69 74 65 75 78 2e 73 68 65 6c 6c 2e 73 68 61 72 65 64 2e 33 38 34 61 61 63 65 35 66 39 38 61 38 36 32 32 66 34 32 31 63 66 35 39 39 33 35 37 62 36 38 64 2e 63 73 73 22 2c 0a 20 22 4a 73 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 73 68 65 6c 6c 75 78 2f 73 75 69 74 65 75 78 2e 73 68 65 6c 6c 2e 62 6f 6f 74 73 74 72 Data Ascii: {"data":{"legacy":{"spoSuiteLinks":{ "SPSuiteVersion":2, "SPIsMobile":false, "CssUrl":"https://res-1.cdn.office.net/shellux/suiteux.shell.shared.384aace5f98a8622f421cf599357b68d.css", "JsUrl":"https://res-1.cdn.office.net/shellux/suiteux.shell.bootstr
2024-04-19 21:50:56 UTC	8192	IN	Data Raw: 74 74 69 6e 67 73 41 6e 64 50 72 69 76 61 63 79 2f 3f 6c 61 6e 67 75 61 67 65 73 65 74 74 69 6e 67 73 3d 74 72 75 65 5c 22 2c 5c 22 4c 6f 61 64 55 73 65 72 54 68 65 6d 65 73 4a 73 6f 6e 55 72 6c 5c 22 3a 5c 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 73 68 65 6c 6c 75 78 2f 61 6c 6c 74 68 65 6d 65 73 2e 30 38 37 65 61 61 35 39 65 63 63 63 61 37 38 39 63 65 34 62 65 35 62 64 39 38 65 66 65 61 32 66 2e 6a 73 6f 6e 5c 22 2c 5c 22 4d 41 58 46 65 65 64 62 61 63 6b 55 72 6c 5c 22 3a 5c 22 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6f 66 66 69 63 65 2e 63 6f 6d 2f 66 31 2f 68 6f 6d 65 2f 69 6e 61 70 70 66 65 65 64 62 61 63 6b 61 64 64 69 6e 3f 68 65 6c 70 69 64 3d 31 36 31 32 35 35 5c 22 2c 5c 22 4d 41 58 48 65 Data Ascii: ttingsAndPrivacy/?languagesettings=true\",\"LoadUserThemesJsonUrl\":\"https://res-1.cdn.office.net/shellux/allthemes.087eaa59eccca789ce4be5bd98efea2f.json\",\"MAXFeedbackUrl\":\"https://support.office.com/f1/home/inappfeedbackaddin?helpid=161255\",\"MAXHe
2024-04-19 21:50:56 UTC	2520	IN	Data Raw: 6f 6e 61 75 64 69 6f 2e 6d 70 33 5c 22 2c 5c 22 73 79 73 74 65 6d 6e 6f 74 69 66 69 63 61 74 69 6f 6e 61 75 64 69 6f 5c 22 3a 5c 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 73 68 65 6c 6c 75 78 2f 73 79 73 74 65 6d 6e 6f 74 69 66 69 63 61 74 69 6f 6e 61 75 64 69 6f 2e 6d 70 33 5c 22 2c 5c 22 69 63 6f 6e 5f 6e 6f 74 69 66 69 63 61 74 69 6f 6e 73 5f 70 72 6f 67 72 65 73 73 5f 67 69 66 5c 22 3a 5c 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 73 68 65 6c 6c 75 78 2f 69 63 6f 6e 5f 6e 6f 74 69 66 69 63 61 74 69 6f 6e 73 5f 70 72 6f 67 72 65 73 73 2e 67 69 66 5c 22 2c 5c 22 6f 33 36 35 69 63 6f 6e 73 5f 65 6f 74 5c 22 3a 5c 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 Data Ascii: onaudio.mp3\",\"systemnotificationaudio\":\"https://res-1.cdn.office.net/shellux/systemnotificationaudio.mp3\",\"icon_notifications_progress_gif\":\"https://res-1.cdn.office.net/shellux/icon_notifications_progress.gif\",\"o365icons_eot\":\"https://res-1.c
2024-04-19 21:50:56 UTC	8192	IN	Data Raw: 22 2c 22 43 75 6c 74 75 72 65 4e 61 6d 65 22 3a 22 65 6e 2d 55 53 22 2c 22 43 75 72 72 65 6e 74 4d 61 69 6e 4c 69 6e 6b 45 6c 65 6d 65 6e 74 49 44 22 3a 22 53 68 65 6c 6c 53 68 61 72 65 70 6f 69 6e 74 22 2c 22 43 75 72 72 65 6e 74 57 6f 72 6b 6c 6f 61 64 48 65 6c 70 53 75 62 4c 69 6e 6b 73 22 3a 6e 75 6c 6c 2c 22 43 75 72 72 65 6e 74 57 6f 72 6b 6c 6f 61 64 53 65 74 74 69 6e 67 73 4c 69 6e 6b 22 3a 6e 75 6c 6c 2c 22 43 75 72 72 65 6e 74 57 6f 72 6b 6c 6f 61 64 53 65 74 74 69 6e 67 73 53 75 62 4c 69 6e 6b 73 22 3a 6e 75 6c 6c 2c 22 43 75 72 72 65 6e 74 57 6f 72 6b 6c 6f 61 64 55 73 65 72 53 75 62 4c 69 6e 6b 73 22 3a 6e 75 6c 6c 2c 22 44 69 6d 65 6e 73 69 6f 6e 73 22 3a 7b 22 54 6f 70 22 3a 35 30 7d 2c 22 44 6f 77 6e 41 72 72 6f 77 49 6d 61 67 65 22 3a 6e Data Ascii: ","CultureName":"en-US","CurrentMainLinkElementID":"ShellSharepoint","CurrentWorkloadHelpSubLinks":null,"CurrentWorkloadSettingsLink":null,"CurrentWorkloadSettingsSubLinks":null,"CurrentWorkloadUserSubLinks":null,"Dimensions":{"Top":50},"DownArrowImage":n
2024-04-19 21:50:56 UTC	2900	IN	Data Raw: 75 43 48 72 34 70 58 56 57 4f 32 71 59 38 35 69 75 48 52 43 2f 34 79 4c 79 4f 70 61 58 52 69 73 78 50 69 30 37 46 4c 32 59 7a 5a 78 2f 6c 59 69 2b 53 6c 76 45 35 55 7a 34 64 42 4f 75 30 63 56 52 78 54 41 6a 78 4b 38 72 30 4c 75 65 42 72 6b 63 36 34 48 6b 79 68 36 33 56 44 37 5a 6d 67 44 6a 4d 4a 67 41 77 77 58 54 2b 4d 72 72 32 4f 37 72 2f 64 71 4f 73 32 4f 6d 51 70 4f 77 42 51 42 39 48 42 66 45 78 69 48 39 42 77 6f 79 77 63 7a 6c 6a 44 64 49 54 72 78 58 76 39 68 64 2b 72 4c 64 57 37 4f 63 6a 6a 58 73 57 69 75 43 33 69 6a 4c 7a 4a 79 6c 35 43 41 59 66 36 4e 67 6d 30 45 30 51 37 6d 70 48 30 59 6d 6e 47 75 6b 36 47 72 71 70 68 38 69 6a 75 34 47 6c 38 2f 6f 52 6a 39 4f 4c 6c 6b 59 46 53 52 33 2b 44 47 71 4f 55 72 76 43 68 55 4b 65 72 7a 2f 6c 2f 35 33 6f 6d Data Ascii: uCHr4pXVWO2qY85iuHRC/4yLyOpaXRisxPi07FL2YzZx/lYi+SlvE5Uz4dBOu0cVRxTAjxK8r0LueBrkc64Hkyh63VD7ZmgDjMJgAwwXT+Mrr2O7r/dqOs2OmQpOwBQB9HBfExiH9BwoywczljDdITrxXv9hd+rLdW7OcjjXsWiuC3ijLzJyl5CAYf6Ngm0E0Q7mpH0YmnGuk6Grqph8iju4Gl8/oRj9OLlkYFSR3+DGqOUrvChUKerz/l/53om

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:50:57 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-19 21:50:57 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/073D) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=119571 Date: Fri, 19 Apr 2024 21:50:57 GMT Connection: close X-CID: 2

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://estgirls-my.sharepoint.com/:b:/g/personal/s7958766_estg_moe_gov_sa/EeCN0MAR0F5NufUZkT2Q-mcBn4v13Ov8FQ0oi798Dgtayg?e=zTKNmK

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 310

Chrome Cache Entry: 311

Chrome Cache Entry: 312

Chrome Cache Entry: 313

Chrome Cache Entry: 314

Chrome Cache Entry: 315

Chrome Cache Entry: 316

Chrome Cache Entry: 317

Chrome Cache Entry: 318

Chrome Cache Entry: 319

Chrome Cache Entry: 320

Chrome Cache Entry: 321

Chrome Cache Entry: 322

Chrome Cache Entry: 323

Chrome Cache Entry: 324

Chrome Cache Entry: 325

Chrome Cache Entry: 326

Chrome Cache Entry: 327

Chrome Cache Entry: 328

Chrome Cache Entry: 329

Chrome Cache Entry: 331

Chrome Cache Entry: 332

Chrome Cache Entry: 333

Chrome Cache Entry: 334

Chrome Cache Entry: 335

Chrome Cache Entry: 336

Chrome Cache Entry: 337

Windows Analysis Report
https://estgirls-my.sharepoint.com/:b:/g/personal/s7958766_estg_moe_gov_sa/EeCN0MAR0F5NufUZkT2Q-mcBn4v13Ov8FQ0oi798Dgtayg?e=zTKNmK

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:50:57 UTC	1563	OUT	GET /personal/s7958766_estg_moe_gov_sa/_api/v2.1/graphql HTTP/1.1 Host: estgirls-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=
2024-04-19 21:50:57 UTC	3007	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 87 Content-Type: application/json P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=; path=/; SameSite=None; secure; HttpOnly X-NetworkStatistics: 0,525568,0,0,5154820,0,317775 X-SharePointHealthScore: 3 X-AspNet-Version: 4.0.30319 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: 42a820a1-50f0-8000-8798-d337ad00dda1 request-id: 42a820a1-50f0-8000-8798-d337ad00dda1 MS-CV: oSCoQvBQAICHmNM3rQDdoQ.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=00000000-0000-0000-0000-000000000000&destinationEndpoint=Edge-Prod-ATL33r5b&frontEnd=AFD&RemoteIP=81.181.57.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 6459DD7F93E84794B306FD0E5E566990 Ref B: ATL331000104027 Ref C: 2024-04-19T21:50:57Z Date: Fri, 19 Apr 2024 21:50:57 GMT Connection: close
2024-04-19 21:50:57 UTC	87	IN	Data Raw: 7b 22 65 72 72 6f 72 73 22 3a 5b 7b 22 6d 65 73 73 61 67 65 22 3a 22 41 20 71 75 65 72 79 20 69 73 20 72 65 71 75 69 72 65 64 2e 22 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 22 63 6f 64 65 22 3a 22 45 58 45 43 55 54 49 4f 4e 5f 45 52 52 4f 52 22 7d 7d 5d 7d Data Ascii: {"errors":[{"message":"A query is required.","extensions":{"code":"EXECUTION_ERROR"}}]}

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:50:57 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-19 21:50:57 UTC	531	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0rcGnYgAAAAANOnx9vccHTr21ROgX9ESTU0pDRURHRTAzMDkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=119556 Date: Fri, 19 Apr 2024 21:50:57 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-19 21:50:57 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:51:02 UTC	2660	OUT	POST /personal/s7958766_estg_moe_gov_sa/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1 Host: estgirls-my.sharepoint.com Connection: keep-alive Content-Length: 821 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" ScenarioType: AUO sec-ch-ua-mobile: ?0 Authorization: Bearer User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CollectSPPerfMetrics: SPSQLQueryCount Content-Type: application/json;odata=verbose accept: application/json;odata=verbose X-ClientService-ClientTag: ODB Web X-SP-REQUESTRESOURCES: listUrl=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments X-ServiceWorker-Strategy: CacheFirst x-requestdigest: 0x7ED19AFFF7E14E6AC78F70A3EAA4CD486D55B5811C7DCFA7D5502C8D57CDB5B14E2DDB885B0524C8E1419322EA54A9E853CCF51C0CBB5E762C1DFB459B000EE5,19 Apr 2024 21:50:54 -0000 sec-ch-ua-platform: "Windows" Origin: https://estgirls-my.sharepoint.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epdf&parent=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments&ga=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=
2024-04-19 21:51:02 UTC	821	OUT	Data Raw: 7b 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 5f 5f 6d 65 74 61 64 61 74 61 22 3a 7b 22 74 79 70 65 22 3a 22 53 50 2e 52 65 6e 64 65 72 4c 69 73 74 44 61 74 61 50 61 72 61 6d 65 74 65 72 73 22 7d 2c 22 52 65 6e 64 65 72 4f 70 74 69 6f 6e 73 22 3a 31 30 35 32 36 37 39 2c 22 56 69 65 77 58 6d 6c 22 3a 22 3c 56 69 65 77 20 3e 3c 51 75 65 72 79 3e 3c 2f 51 75 65 72 79 3e 3c 56 69 65 77 46 69 65 6c 64 73 3e 3c 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 44 6f 63 49 63 6f 6e 5c 22 2f 3e 3c 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 4c 69 6e 6b 46 69 6c 65 6e 61 6d 65 5c 22 2f 3e 3c 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 4d 6f 64 69 66 69 65 64 5c 22 2f 3e 3c 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 45 64 69 74 6f 72 5c 22 2f 3e 3c 46 Data Ascii: {"parameters":{"__metadata":{"type":"SP.RenderListDataParameters"},"RenderOptions":1052679,"ViewXml":"<View ><Query></Query><ViewFields><FieldRef Name=\"DocIcon\"/><FieldRef Name=\"LinkFilename\"/><FieldRef Name=\"Modified\"/><FieldRef Name=\"Editor\"/><F
2024-04-19 21:51:02 UTC	3255	IN	HTTP/1.1 200 OK Cache-Control: private, max-age=0 Transfer-Encoding: chunked Content-Type: application/json; charset=utf-8 Expires: Thu, 04 Apr 2024 21:51:02 GMT Last-Modified: Fri, 19 Apr 2024 21:51:02 GMT Vary: Origin P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=; path=/; SameSite=None; secure; HttpOnly X-NetworkStatistics: 0,525568,0,0,1048529,0,222423 X-SharePointHealthScore: 3 X-SP-SERVERSTATE: ReadOnly=0 DATASERVICEVERSION: 3.0 SPClientServiceRequestDuration: 85 SPRequestDuration: 85 X-AspNet-Version: 4.0.30319 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: 44a820a1-2039-8000-9d5d-3956b02f1bde request-id: 44a820a1-2039-8000-9d5d-3956b02f1bde MS-CV: oSCoRDkgAICdXTlWsC8b3g.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=b6875bbb-f371-480d-aba1-2972ce042c2b&destinationEndpoint=Edge-Prod-ATL33r5c&frontEnd=AFD&RemoteIP=81.181.57.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: ED80C7D0335047549A39C5007E4FC0CC Ref B: ATL331000106023 Ref C: 2024-04-19T21:51:02Z Date: Fri, 19 Apr 2024 21:51:02 GMT Connection: close
2024-04-19 21:51:02 UTC	1877	IN	Data Raw: 37 34 65 0d 0a 7b 22 77 70 71 22 3a 22 22 2c 22 54 65 6d 70 6c 61 74 65 73 22 3a 7b 7d 2c 22 4c 69 73 74 44 61 74 61 22 3a 7b 20 22 52 6f 77 22 20 3a 20 0a 5b 7b 0d 0a 22 49 44 22 3a 20 22 31 35 22 2c 0d 0a 22 50 65 72 6d 4d 61 73 6b 22 3a 20 22 30 78 31 30 30 33 30 30 38 30 33 31 30 30 31 22 2c 0d 0a 22 46 53 4f 62 6a 54 79 70 65 22 3a 20 22 30 22 2c 0d 0a 22 48 54 4d 4c 5f 78 30 30 32 30 5f 46 69 6c 65 5f 78 30 30 32 30 5f 54 79 70 65 22 3a 20 22 22 2c 0d 0a 22 55 6e 69 71 75 65 49 64 22 3a 20 22 7b 43 30 44 30 38 44 45 30 2d 44 30 31 31 2d 34 44 35 45 2d 42 39 46 35 2d 31 39 39 31 33 44 39 30 46 41 36 37 7d 22 2c 0d 0a 22 50 72 6f 67 49 64 22 3a 20 22 22 2c 0d 0a 22 4e 6f 45 78 65 63 75 74 65 22 3a 20 22 31 22 2c 0d 0a 22 43 6f 6e 74 65 6e 74 54 79 70 Data Ascii: 74e{"wpq":"","Templates":{},"ListData":{ "Row" : [{"ID": "15","PermMask": "0x1003008031001","FSObjType": "0","HTML_x0020_File_x0020_Type": "","UniqueId": "{C0D08DE0-D011-4D5E-B9F5-19913D90FA67}","ProgId": "","NoExecute": "1","ContentTyp
2024-04-19 21:51:02 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 66 5c 75 30 36 34 61 20 5c 75 30 36 32 37 5c 75 30 36 34 34 5c 75 30 36 33 39 5c 75 30 36 34 36 5c 75 30 36 33 32 5c 75 30 36 34 61 22 2c 22 65 6d 61 69 6c 22 3a 22 73 37 39 35 38 37 36 36 40 65 73 74 67 2e 6d 6f 65 2e 67 6f 76 2e 73 61 22 2c 22 73 69 70 22 3a 22 73 37 39 35 38 37 36 36 40 65 73 74 67 2e 6d 6f 65 2e 67 6f 76 2e 73 61 22 7d 5d 2c 0d 0a 22 54 69 74 6c 65 22 3a 20 22 22 2c 0d 0a 22 4d 65 74 61 49 6e 66 6f 22 3a 20 5b 7b 22 6c 6f 6f 6b 75 70 49 64 22 3a 31 35 2c 22 6c 6f 6f 6b 75 70 56 61 6c 75 65 22 3a 22 76 74 69 5f 70 61 72 73 65 72 76 65 72 73 69 6f 6e 3a 53 52 7c 31 36 2e 30 2e 30 2e 32 34 38 30 33 5c 72 5c 6e 76 74 69 5f 64 65 63 72 79 70 74 73 6b 69 70 72 65 61 73 6f 6e 3a 49 57 7c 31 32 5c 72 5c 6e 76 74 69 5f 70 72 Data Ascii: 2000f\u064a \u0627\u0644\u0639\u0646\u0632\u064a","email":"s7958766@estg.moe.gov.sa","sip":"s7958766@estg.moe.gov.sa"}],"Title": "","MetaInfo": [{"lookupId":15,"lookupValue":"vti_parserversion:SR\|16.0.0.24803\r\nvti_decryptskipreason:IW\|12\r\nvti_pr
2024-04-19 21:51:02 UTC	3190	IN	Data Raw: 63 36 66 0d 0a 69 6e 67 22 3a 20 22 46 41 4c 53 45 22 2c 0a 22 43 6c 69 65 6e 74 53 69 64 65 43 6f 6d 70 6f 6e 65 6e 74 49 64 22 3a 20 22 30 30 30 30 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 30 30 30 30 30 30 30 30 22 2c 0a 22 50 69 6e 6e 65 64 54 6f 46 69 6c 74 65 72 73 50 61 6e 65 22 3a 20 22 46 41 4c 53 45 22 2c 0a 22 53 68 6f 77 49 6e 46 69 6c 74 65 72 73 50 61 6e 65 22 3a 20 22 41 75 74 6f 22 7d 0a 2c 7b 22 4e 61 6d 65 22 3a 20 22 46 69 6c 65 4c 65 61 66 52 65 66 22 2c 0a 22 46 69 65 6c 64 54 79 70 65 22 3a 20 22 46 69 6c 65 22 2c 0a 22 52 65 71 75 69 72 65 64 22 3a 20 22 54 52 55 45 22 2c 0a 22 52 65 61 6c 46 69 65 6c 64 4e 61 6d 65 22 3a 20 22 46 69 6c 65 4c 65 61 66 52 65 66 22 2c 0a 22 44 69 73 70 6c 61 79 4e 61 6d Data Ascii: c6fing": "FALSE","ClientSideComponentId": "00000000-0000-0000-0000-000000000000","PinnedToFiltersPane": "FALSE","ShowInFiltersPane": "Auto"},{"Name": "FileLeafRef","FieldType": "File","Required": "TRUE","RealFieldName": "FileLeafRef","DisplayNam
2024-04-19 21:51:02 UTC	6076	IN	Data Raw: 31 37 62 34 0d 0a 5a 43 49 36 49 6a 41 6a 4c 6d 5a 38 62 57 56 74 59 6d 56 79 63 32 68 70 63 48 78 31 63 6d 34 6c 4d 32 46 7a 63 47 38 6c 4d 32 46 68 62 6d 39 75 49 32 55 30 4d 7a 63 32 5a 57 4d 77 4d 6a 55 32 5a 44 55 78 4d 6d 55 79 4d 7a 63 7a 4d 6a 41 35 59 32 59 30 4d 7a 6b 35 4e 6a 6c 6b 59 54 52 6b 4f 54 51 7a 4e 6a 4d 30 5a 6d 55 35 4e 6d 4e 68 4e 54 55 32 5a 6d 59 78 59 54 64 68 4d 57 4d 78 4e 57 45 30 59 6d 55 69 4c 43 4a 75 59 6d 59 69 4f 69 49 78 4e 7a 45 7a 4e 54 59 77 4e 44 41 77 49 69 77 69 62 6d 6c 70 49 6a 6f 69 62 57 6c 6a 63 6d 39 7a 62 32 5a 30 4c 6e 4e 6f 59 58 4a 6c 63 47 39 70 62 6e 51 69 4c 43 4a 7a 61 47 46 79 61 57 35 6e 61 57 51 69 4f 69 49 7a 54 6c 56 7a 5a 46 52 36 51 53 39 72 54 30 4d 30 63 45 4a 76 51 6d 4a 4b 52 6a 46 6e 49 Data Ascii: 17b4ZCI6IjAjLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUiLCJuYmYiOiIxNzEzNTYwNDAwIiwibmlpIjoibWljcm9zb2Z0LnNoYXJlcG9pbnQiLCJzaGFyaW5naWQiOiIzTlVzZFR6QS9rT0M0cEJvQmJKRjFnI
2024-04-19 21:51:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:51:02 UTC	2651	OUT	POST /personal/s7958766_estg_moe_gov_sa/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1 Host: estgirls-my.sharepoint.com Connection: keep-alive Content-Length: 201 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" ScenarioType: AUO Accept-Language: en-US sec-ch-ua-mobile: ?0 Authorization: Bearer User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json;odata=verbose CollectSPPerfMetrics: SPSQLQueryCount accept: application/json;odata=verbose X-ClientService-ClientTag: ODB Web X-SP-REQUESTRESOURCES: listUrl=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments X-ServiceWorker-Strategy: CacheFirst x-requestdigest: 0x7ED19AFFF7E14E6AC78F70A3EAA4CD486D55B5811C7DCFA7D5502C8D57CDB5B14E2DDB885B0524C8E1419322EA54A9E853CCF51C0CBB5E762C1DFB459B000EE5,19 Apr 2024 21:50:54 -0000 sec-ch-ua-platform: "Windows" Origin: https://estgirls-my.sharepoint.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epdf&parent=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments&ga=1 Accept-Encoding: gzip, deflate, br Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=
2024-04-19 21:51:02 UTC	201	OUT	Data Raw: 7b 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 5f 5f 6d 65 74 61 64 61 74 61 22 3a 7b 22 74 79 70 65 22 3a 22 53 50 2e 52 65 6e 64 65 72 4c 69 73 74 44 61 74 61 50 61 72 61 6d 65 74 65 72 73 22 7d 2c 22 52 65 6e 64 65 72 4f 70 74 69 6f 6e 73 22 3a 35 34 34 35 33 38 33 2c 22 41 6c 6c 6f 77 4d 75 6c 74 69 70 6c 65 56 61 6c 75 65 46 69 6c 74 65 72 46 6f 72 54 61 78 6f 6e 6f 6d 79 46 69 65 6c 64 73 22 3a 74 72 75 65 2c 22 41 64 64 52 65 71 75 69 72 65 64 46 69 65 6c 64 73 22 3a 74 72 75 65 2c 22 52 65 71 75 69 72 65 46 6f 6c 64 65 72 43 6f 6c 6f 72 69 6e 67 46 69 65 6c 64 73 22 3a 74 72 75 65 7d 7d Data Ascii: {"parameters":{"__metadata":{"type":"SP.RenderListDataParameters"},"RenderOptions":5445383,"AllowMultipleValueFilterForTaxonomyFields":true,"AddRequiredFields":true,"RequireFolderColoringFields":true}}
2024-04-19 21:51:02 UTC	3255	IN	HTTP/1.1 200 OK Cache-Control: private, max-age=0 Transfer-Encoding: chunked Content-Type: application/json; charset=utf-8 Expires: Thu, 04 Apr 2024 21:51:02 GMT Last-Modified: Fri, 19 Apr 2024 21:51:02 GMT Vary: Origin P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=; path=/; SameSite=None; secure; HttpOnly X-NetworkStatistics: 0,525568,0,0,1223844,0,188432 X-SharePointHealthScore: 2 X-SP-SERVERSTATE: ReadOnly=0 DATASERVICEVERSION: 3.0 SPClientServiceRequestDuration: 65 SPRequestDuration: 66 X-AspNet-Version: 4.0.30319 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: 44a820a1-403e-8000-8798-d4f44d83bb57 request-id: 44a820a1-403e-8000-8798-d4f44d83bb57 MS-CV: oSCoRD5AAICHmNT0TYO7Vw.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=b6875bbb-f371-480d-aba1-2972ce042c2b&destinationEndpoint=Edge-Prod-ATL33r5a&frontEnd=AFD&RemoteIP=81.181.57.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 6735E242D66C4A51A5EBCB9060FC5252 Ref B: ATL331000101027 Ref C: 2024-04-19T21:51:02Z Date: Fri, 19 Apr 2024 21:51:01 GMT Connection: close
2024-04-19 21:51:02 UTC	1931	IN	Data Raw: 37 38 34 0d 0a 7b 22 77 70 71 22 3a 22 22 2c 22 54 65 6d 70 6c 61 74 65 73 22 3a 7b 7d 2c 22 4c 69 73 74 44 61 74 61 22 3a 7b 20 22 52 6f 77 22 20 3a 20 0a 5b 7b 0d 0a 22 49 44 22 3a 20 22 31 35 22 2c 0d 0a 22 50 65 72 6d 4d 61 73 6b 22 3a 20 22 30 78 31 30 30 33 30 30 38 30 33 31 30 30 31 22 2c 0d 0a 22 46 53 4f 62 6a 54 79 70 65 22 3a 20 22 30 22 2c 0d 0a 22 48 54 4d 4c 5f 78 30 30 32 30 5f 46 69 6c 65 5f 78 30 30 32 30 5f 54 79 70 65 22 3a 20 22 22 2c 0d 0a 22 55 6e 69 71 75 65 49 64 22 3a 20 22 7b 43 30 44 30 38 44 45 30 2d 44 30 31 31 2d 34 44 35 45 2d 42 39 46 35 2d 31 39 39 31 33 44 39 30 46 41 36 37 7d 22 2c 0d 0a 22 50 72 6f 67 49 64 22 3a 20 22 22 2c 0d 0a 22 4e 6f 45 78 65 63 75 74 65 22 3a 20 22 31 22 2c 0d 0a 22 43 6f 6e 74 65 6e 74 54 79 70 Data Ascii: 784{"wpq":"","Templates":{},"ListData":{ "Row" : [{"ID": "15","PermMask": "0x1003008031001","FSObjType": "0","HTML_x0020_File_x0020_Type": "","UniqueId": "{C0D08DE0-D011-4D5E-B9F5-19913D90FA67}","ProgId": "","NoExecute": "1","ContentTyp
2024-04-19 21:51:02 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 3a 53 52 7c 69 3a 30 23 2e 66 7c 6d 65 6d 62 65 72 73 68 69 70 7c 73 37 39 35 38 37 36 36 40 65 73 74 67 2e 6d 6f 65 2e 67 6f 76 2e 73 61 5c 72 5c 6e 76 74 69 5f 73 70 72 6f 63 73 73 63 68 65 6d 61 76 65 72 73 69 6f 6e 3a 53 52 7c 31 36 2e 30 2e 31 31 30 36 2e 30 5c 72 5c 6e 76 74 69 5f 64 62 73 63 68 65 6d 61 76 65 72 73 69 6f 6e 3a 53 52 7c 31 36 2e 30 2e 34 30 33 2e 30 5c 72 5c 6e 76 74 69 5f 74 69 6d 65 6c 61 73 74 77 6e 73 73 65 6e 74 3a 54 52 7c 31 37 20 41 70 72 20 32 30 32 34 20 31 32 3a 34 31 3a 33 37 20 2d 30 30 30 30 5c 72 5c 6e 76 74 69 5f 77 72 69 74 65 76 61 6c 69 64 61 74 69 6f 6e 74 6f 6b 65 6e 3a 53 57 7c 69 6d 45 57 66 66 41 63 52 62 78 32 42 35 42 6b 46 61 73 50 73 5c 2f 43 75 55 39 63 3d 5c 72 5c 6e 76 74 69 5f 6d 6f Data Ascii: 2000:SR\|i:0#.f\|membership\|s7958766@estg.moe.gov.sa\r\nvti_sprocsschemaversion:SR\|16.0.1106.0\r\nvti_dbschemaversion:SR\|16.0.403.0\r\nvti_timelastwnssent:TR\|17 Apr 2024 12:41:37 -0000\r\nvti_writevalidationtoken:SW\|imEWffAcRbx2B5BkFasPs\/CuU9c=\r\nvti_mo
2024-04-19 21:51:02 UTC	3136	IN	Data Raw: 63 33 39 0d 0a 20 22 66 46 4e 51 54 77 22 0d 0a 2c 20 22 2e 63 6f 72 72 65 6c 61 74 69 6f 6e 49 64 22 20 3a 20 22 34 34 61 38 32 30 61 31 2d 34 30 33 65 2d 38 30 30 30 2d 38 37 39 38 2d 64 34 66 34 34 64 38 33 62 62 35 37 22 0d 0a 2c 20 22 2e 74 72 61 6e 73 66 6f 72 6d 55 72 6c 22 20 3a 20 22 7b 2e 6d 65 64 69 61 42 61 73 65 55 72 6c 7d 5c 75 30 30 32 66 74 72 61 6e 73 66 6f 72 6d 5c 75 30 30 32 66 7b 2e 6d 65 74 68 6f 64 7d 3f 70 72 6f 76 69 64 65 72 3d 73 70 6f 26 69 6e 70 75 74 46 6f 72 6d 61 74 3d 7b 2e 66 69 6c 65 54 79 70 65 7d 26 63 73 3d 7b 2e 63 61 6c 6c 65 72 53 74 61 63 6b 7d 26 64 6f 63 69 64 3d 7b 2e 73 70 49 74 65 6d 55 72 6c 7d 26 7b 2e 64 72 69 76 65 41 63 63 65 73 73 54 6f 6b 65 6e 7d 22 0d 0a 2c 20 22 2e 74 68 75 6d 62 6e 61 69 6c 55 72 Data Ascii: c39 "fFNQTw", ".correlationId" : "44a820a1-403e-8000-8798-d4f44d83bb57", ".transformUrl" : "{.mediaBaseUrl}\u002ftransform\u002f{.method}?provider=spo&inputFormat={.fileType}&cs={.callerStack}&docid={.spItemUrl}&{.driveAccessToken}", ".thumbnailUr
2024-04-19 21:51:02 UTC	3365	IN	Data Raw: 64 31 65 0d 0a 30 30 33 63 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 4c 69 6e 6b 46 69 6c 65 6e 61 6d 65 5c 22 20 2f 5c 75 30 30 33 65 5c 75 30 30 33 63 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 4d 6f 64 69 66 69 65 64 5c 22 20 2f 5c 75 30 30 33 65 5c 75 30 30 33 63 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 53 68 61 72 65 64 57 69 74 68 5c 22 20 2f 5c 75 30 30 33 65 5c 75 30 30 33 63 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 45 64 69 74 6f 72 5c 22 20 2f 5c 75 30 30 33 65 5c 75 30 30 33 63 2f 56 69 65 77 46 69 65 6c 64 73 5c 75 30 30 33 65 5c 75 30 30 33 63 52 6f 77 4c 69 6d 69 74 20 50 61 67 65 64 3d 5c 22 54 52 55 45 5c 22 5c 75 30 30 33 65 33 30 5c 75 30 30 33 63 2f 52 6f 77 4c 69 6d 69 74 5c 75 30 30 33 65 5c 75 30 30 33 63 4a Data Ascii: d1e003cFieldRef Name=\"LinkFilename\" /\u003e\u003cFieldRef Name=\"Modified\" /\u003e\u003cFieldRef Name=\"SharedWith\" /\u003e\u003cFieldRef Name=\"Editor\" /\u003e\u003c/ViewFields\u003e\u003cRowLimit Paged=\"TRUE\"\u003e30\u003c/RowLimit\u003e\u003cJ
2024-04-19 21:51:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:51:03 UTC	2008	OUT	GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1 Host: estgirls-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epdf&parent=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments&ga=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=
2024-04-19 21:51:03 UTC	1886	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 7886 Content-Type: image/x-icon Last-Modified: Sat, 13 Apr 2024 02:47:19 GMT Accept-Ranges: bytes ETag: "80d5cbe64c8dda1:0" P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=; path=/; SameSite=None; secure; HttpOnly SPRequestDuration: 9 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: E60637F8E62249A7998918842FDF7AFB Ref B: ATL331000104009 Ref C: 2024-04-19T21:51:03Z Date: Fri, 19 Apr 2024 21:51:03 GMT Connection: close
2024-04-19 21:51:03 UTC	845	IN	Data Raw: 00 00 01 00 03 00 20 20 00 00 01 00 20 00 a8 10 00 00 36 00 00 00 18 18 00 00 01 00 20 00 88 09 00 00 de 10 00 00 10 10 00 00 01 00 20 00 68 04 00 00 66 1a 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6 hf( @
2024-04-19 21:51:03 UTC	7041	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ea a8 28 60 ea a8 28 bf ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 df ea a8 28 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ea a8 28 20 ea a8 28 cf ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 28 ff ea a8 Data Ascii: (`((((((((((((((((((((((((p( ((((((((((((((((((((((((

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:51:04 UTC	1707	OUT	GET /personal/s7958766_estg_moe_gov_sa/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1 Host: estgirls-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=
2024-04-19 21:51:04 UTC	3264	IN	HTTP/1.1 405 Method Not Allowed Cache-Control: private, max-age=0 Transfer-Encoding: chunked Content-Type: application/xml;charset=utf-8 Expires: Thu, 04 Apr 2024 21:51:04 GMT Last-Modified: Fri, 19 Apr 2024 21:51:04 GMT Vary: Origin P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=; path=/; SameSite=None; secure; HttpOnly X-NetworkStatistics: 0,525568,0,0,255,0,24208 X-SharePointHealthScore: 1 X-SP-SERVERSTATE: ReadOnly=0 DATASERVICEVERSION: 3.0 SPClientServiceRequestDuration: 21 SPRequestDuration: 22 X-AspNet-Version: 4.0.30319 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: 44a820a1-40b2-8000-9d5d-31b96a10cabd request-id: 44a820a1-40b2-8000-9d5d-31b96a10cabd MS-CV: oSCoRLJAAICdXTG5ahDKvQ.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=b6875bbb-f371-480d-aba1-2972ce042c2b&destinationEndpoint=Edge-Prod-ATL33r5d&frontEnd=AFD&RemoteIP=81.181.57.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 2EB94D13A2F345E2B153F55080AED0C1 Ref B: ATL331000107053 Ref C: 2024-04-19T21:51:04Z Date: Fri, 19 Apr 2024 21:51:04 GMT Connection: close
2024-04-19 21:51:04 UTC	450	IN	Data Raw: 31 62 62 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 6d 3a 65 72 72 6f 72 20 78 6d 6c 6e 73 3a 6d 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 61 64 6f 2f 32 30 30 37 2f 30 38 2f 64 61 74 61 73 65 72 76 69 63 65 73 2f 6d 65 74 61 64 61 74 61 22 3e 3c 6d 3a 63 6f 64 65 3e 2d 31 2c 20 4d 69 63 72 6f 73 6f 66 74 2e 53 68 61 72 65 50 6f 69 6e 74 2e 43 6c 69 65 6e 74 2e 43 6c 69 65 6e 74 53 65 72 76 69 63 65 45 78 63 65 70 74 69 6f 6e 3c 2f 6d 3a 63 6f 64 65 3e 3c 6d 3a 6d 65 73 73 61 67 65 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 54 68 65 20 48 54 54 50 20 6d 65 74 68 6f 64 20 27 47 45 54 27 20 63 61 6e 6e 6f 74 20 62 65 Data Ascii: 1bb<?xml version="1.0" encoding="utf-8"?><m:error xmlns:m="http://schemas.microsoft.com/ado/2007/08/dataservices/metadata"><m:code>-1, Microsoft.SharePoint.Client.ClientServiceException</m:code><m:message xml:lang="en-US">The HTTP method 'GET' cannot be
2024-04-19 21:51:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:51:05 UTC	2531	OUT	GET /_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%5D&defaultBrotli=true&authenticateFast=true&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099649,3]&spStartApplicationWebBundle=true&enableIntegrities=true HTTP/1.1 Host: estgirls-my.sharepoint.com Connection: keep-alive Cache-Control: max-age=0 Accept: / Service-Worker: script Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: serviceworker Referer: https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epdf&parent=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments&ga=1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=
2024-04-19 21:51:05 UTC	1905	IN	HTTP/1.1 200 OK Cache-Control: max-age=600 Content-Length: 897 Content-Type: text/javascript; charset=utf-8 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=; path=/; SameSite=None; secure; HttpOnly Service-Worker-Allowed: / Strict-Transport-Security: max-age=31536000 X-AspNet-Version: 4.0.30319 SPRequestDuration: 20 SPIisLatency: 0 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: F4FB6DFB7A254912B50850B050B97F4D Ref B: ATL331000106049 Ref C: 2024-04-19T21:51:05Z Date: Fri, 19 Apr 2024 21:51:04 GMT Connection: close
2024-04-19 21:51:05 UTC	897	IN	Data Raw: 0d 0a 76 61 72 20 5f 73 74 61 72 74 54 69 6d 65 3d 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 2c 5f 73 74 61 72 74 54 69 6d 65 54 69 63 6b 73 3d 44 61 74 65 2e 6e 6f 77 28 29 3b 0a 76 61 72 20 5f 73 68 6f 75 6c 64 42 79 70 61 73 73 3d 66 61 6c 73 65 3b 0a 76 61 72 20 5f 63 64 6e 42 61 73 65 55 72 6c 3d 27 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 66 69 6c 65 73 2f 6f 64 73 70 2d 77 65 62 2d 70 72 6f 64 5f 32 30 32 34 2d 30 34 2d 31 32 2e 30 30 33 2f 27 3b 0a 76 61 72 20 5f 73 77 42 75 69 6c 64 4e 75 6d 62 65 72 3d 27 6f 64 73 70 2d 77 65 62 2d 70 72 6f 64 5f 32 30 32 34 2d 30 34 2d 31 32 2e 30 30 33 27 3b 0a 76 61 72 20 5f 77 77 42 75 69 6c 64 4e 75 6d 62 65 72 3d 27 6f 64 73 70 2d 77 65 62 2d 70 72 6f Data Ascii: var _startTime=performance.now(),_startTimeTicks=Date.now();var _shouldBypass=false;var _cdnBaseUrl='https://res-1.cdn.office.net/files/odsp-web-prod_2024-04-12.003/';var _swBuildNumber='odsp-web-prod_2024-04-12.003';var _wwBuildNumber='odsp-web-pro

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:51:16 UTC	2071	OUT	GET /transform/thumbnail?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Festgirls-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!3wg9-hIsbkKjisgTkXNd6LRDPUacccZPsT38WqC54ml1Bruter-IRZ4fXQ1eVBg9%2Fitems%2F01PD5Q4JXARXIMAEOQLZG3T5IZSE6ZB6TH%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvZXN0Z2lybHMtbXkuc2hhcmVwb2ludC5jb21AYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiIiwiY2FjaGVrZXkiOiIwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNlNDM3NmVjMDI1NmQ1MTJlMjM3MzIwOWNmNDM5OTY5ZGE0ZDk0MzYzNGZlOTZjYTU1NmZmMWE3YTFjMTVhNGJlIiwiZW5kcG9pbnR1cmwiOiJURjgwRTBXRUM0cWNENzhvRWQxb0gwRjNxVXl4RlF6RXdvSjlrT1VybHlNPSIsImVuZHBvaW50dXJsTGVuZ3RoIjoiMTE4IiwiZXhwIjoiMTcxMzU4MjAwMCIsImlwYWRkciI6IjgxLjE4MS41Ny41MiIsImlzbG9vcGJhY2siOiJUcnVlIiwiaXNzIjoiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwIiwiaXN1c2VyIjoidHJ1ZSIsIm5hbWVpZCI6IjAjLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUiLCJuYmYiOiIxNzEzNTYwNDAwIiwibmlpIjoibWljcm9zb2Z0LnNoYXJlcG9pbnQiLCJzaGFyaW5naWQiOiIzTlVzZFR6QS9rT0M0cEJvQmJKRjFnIiwic2l0ZWlkIjoiWm1FelpEQTRaR1l0TW1NeE1pMDBNalpsTFdFek9HRXRZemd4TXpreE56TTFaR1U0Iiwic25pZCI6IjYiLCJzdHAiOiJ0IiwidHQiOiIwIiwidmVyIjoiaGFzaGVkcHJvb2Z0b2tlbiJ9.ZgbJkRJ9o5Ke5sfg2XVFcy9TQ4gtZLqksRzitF_6T4Q&cTag=%22c%3A%7BC0D08DE0-D011-4D5E-B9F5-19913D90FA67%7D%2C1%22&encodeFailures=1&width=1280&height=859&srcWidth=&srcHeight= HTTP/1.1 Host: northeurope1-mediap.svc.ms Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://estgirls-my.sharepoint.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 21:51:17 UTC	938	IN	HTTP/1.1 200 OK Cache-Control: private, max-age=2592000 Content-Length: 43482 Content-Type: image/jpeg Expires: Sun, 19 May 2024 21:51:16 GMT ETag: "{C0D08DE0-D011-4D5E-B9F5-19913D90FA67},2" X-AspNetMvc-Version: 5.2 Timing-Allow-Origin: * Access-Control-Expose-Headers: x-cache, x-msedge-ref, x-azure-ref-originshield X-OneDriveMpc-Version: 1.1.9.0 X-StreamOrigin: Cached Server-Timing: Provider;dur=80,SharePoint;dur=39,StreamRead;dur=0,TotalRequest;dur=172,Sandbox;dur=77 Request-Stat: Cached;True,RemoteReads;1 X-CorrelationId: 5e8e7190-8d56-4e41-b0c7-02efb28c12b5 X-OneDriveMeTA-Version: 1.480.58163.0 X-OneDriveMeTA-Build: Media_prod_31514963_040124.1_03-28-2024 X-OneDriveMeTA-Region: northeurope X-AspNet-Version: 4.0.30319 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: E8007FE59E004D8B87D37D329EB89E33 Ref B: ATL331000107027 Ref C: 2024-04-19T21:51:16Z Date: Fri, 19 Apr 2024 21:51:16 GMT Connection: close
2024-04-19 21:51:17 UTC	3232	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 06 04 04 05 04 04 06 05 05 05 06 06 06 07 09 0e 09 09 08 08 09 12 0d 0d 0a 0e 15 12 16 16 15 12 14 14 17 1a 21 1c 17 18 1f 19 14 14 1d 27 1d 1f 22 23 25 25 25 16 1c 29 2c 28 24 2b 21 24 25 24 ff db 00 43 01 06 06 06 09 08 09 11 09 09 11 24 18 14 18 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 ff c0 00 11 08 02 f0 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 01 00 02 03 01 01 01 00 00 00 00 00 00 00 00 00 00 03 04 01 02 05 06 07 08 ff c4 00 49 10 00 02 01 02 03 07 01 04 08 03 05 08 02 01 04 03 00 01 02 03 04 05 11 51 06 12 13 14 21 31 61 41 07 16 a2 d1 15 22 32 35 53 54 71 Data Ascii: JFIF``C!'"#%%%),($+!$%$C$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$"IQ!1aA"25STq
2024-04-19 21:51:17 UTC	8192	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc 66 00 00 00 00 00 00 00 00 00 01 98 00 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 ab 2b d6 ed 22 c3 2b d6 ed 20 38 d7 df 65 9f 3b da 8f bc bf 86 bf 76 7d 12 fb ec b3 e7 7b 51 f7 97 f0 d7 ee c0 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 ec ef df 16 ff 00 ac bf a5 9f 4f c3 fb 23 e6 1b 3b f7 c5 bf eb 2f e9 67 d3 f0 fe c8 0e cd 1e c4 a8 8a 8f 62 54 00 00 00 c6 66 1b c8 8e 53 c8 09 37 96 a6 37 d6 a5 69 d7 4b d4 86 57 69 7a 81 7f 88 b5 31 c4 5a 9c c7 7c 97 Data Ascii: f3+"+ 8e;v}{QO#;/gbTfS77iKWiz1Z\|
2024-04-19 21:51:17 UTC	4144	IN	Data Raw: f4 32 ad 1e 80 73 e5 16 c8 65 49 bf 43 ad ca 3d 07 25 e0 0e 47 05 e8 6c a9 3d 0e aa b2 cf d0 cf 25 e0 0e 5c 69 b5 e8 4f 4e 4e 25 c7 67 e0 c7 2a f4 03 14 ae 1a 2e 50 b9 79 f7 2a ab 66 4f 4a 8b cf b0 1d 5b 5a cd 9d 5a 12 6d 1c 8b 4a 6d 1d 6b 78 e4 80 b9 06 6e 69 05 d0 dc 00 00 0d 59 5e b7 69 16 19 5e b7 69 01 c6 be fb 2c f9 de d4 7d e5 fc 35 fb b3 e8 97 df 65 9f 3b da 8f bc bf 86 bf 76 07 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 47 67 7e f8 b7 fd 65 fd 2c fa 7e 1f d9 1f 30 d9 df be 2d ff 00 59 7f 4b 3e 9f 87 f6 40 76 68 f6 25 44 54 7b 12 a0 06 1a 32 18 11 4e 39 95 aa 51 4c b5 26 43 29 a0 2a 4a d9 3f 42 3e 55 68 5b 73 46 37 90 15 95 a2 d0 72 ab 42 ce f2 1b c8 0a bc a2 0a d1 68 5a df 89 85 Data Ascii: 2seIC=%Gl=%\iONN%g.PyfOJ[ZZmJmkxniY^i^i,}5e;v Gg~e,~0-YK>@vh%DT{2N9QL&C)*J?B>Uh[sF7rBhZ
2024-04-19 21:51:17 UTC	8192	IN	Data Raw: b2 03 e9 1c 53 3c 52 a4 64 cd b3 02 cf 14 71 4a d9 b1 9b 02 cf 14 71 4a d9 b1 9b 02 c7 1b c9 87 5f c9 56 52 21 9d 5c 80 bc ee 16 5d c8 67 70 b5 28 4a e5 af 52 19 5c 66 05 b9 d6 59 9a c6 a6 65 2e 36 66 d1 aa 07 42 33 59 11 56 9a c8 82 35 ba 77 35 9d 4c c0 ad 71 3e e7 3a ad 46 99 d1 ab 07 22 9d 4b 66 f3 e8 05 45 5e 49 96 ed ae 1e 7d c8 79 59 67 d9 93 d1 b6 69 81 d6 b5 ae f5 2e 71 7e af 73 9d 6f 4d a4 5b ea a2 06 95 e7 dc a7 29 66 c9 6b 3e fd 4a 92 97 50 27 8b 44 91 68 ab 19 92 46 a0 16 3a 0c 91 14 66 6d bc 04 9d 07 42 27 30 a6 04 eb 20 44 a6 6d bc 06 fd 0c c5 22 2d e0 a6 05 94 90 e8 44 aa 74 0e a0 12 36 91 ab 99 13 a8 6b be 04 d9 a6 63 a1 1c 66 67 78 0c b4 6b d0 d5 c8 d7 78 09 22 91 62 8a 59 95 14 8b 14 67 d4 0e 9d 04 5e a7 d8 e7 db c8 bf 4d f4 02 64 02 00 Data Ascii: S<RdqJqJ_VR!\]gp(JR\fYe.6fB3YV5w5Lq>:F"KfE^I}yYgi.q~soM[)fk>JP'DhF:fmB'0 Dm"-Dt6kcfgxkx"bYg^Md
2024-04-19 21:51:17 UTC	8192	IN	Data Raw: f4 27 db 1d 9d da 6d aa da ad 9e c7 21 81 5d 5b d0 c1 5d 57 ca 55 85 b5 5e 63 8a 92 9a 72 57 51 c9 6e c5 25 d1 e4 f3 cf 3e c7 02 5e cb 76 81 60 cb 04 8e 19 7d 53 0e b2 c5 23 8a 61 74 2e 68 da d5 56 8d 4d b7 46 7f f3 49 55 a5 93 6b 2c a2 d6 7d df 66 1e b6 c7 da 7e 01 8b 3b 3a 78 4d 1c 43 13 b8 ba b7 95 d3 b7 b5 a2 a5 52 8d 38 cd c1 b9 a7 25 97 d6 8c 96 4b 36 da 79 66 73 6c bd a9 5a d1 ad 5a 8e 21 6b 79 71 56 ae 33 53 09 b6 a7 6b 6f 18 b5 51 2c e3 4e 5b d5 32 6d a4 fe b7 6e 9e 86 96 9b 2b b5 58 5e d1 d0 da 2c 2b 00 8d 85 ef 23 f4 7d cd 0a 56 96 ca d6 ad 35 55 d4 8b 85 35 78 9c 25 9c 9e 6f 7a 49 f7 c8 f3 98 be c2 6d 7e 1f 77 86 dd db 61 b7 55 6b 54 da b5 8c cb 3b 28 4e 36 d0 e1 c9 37 25 4e e2 5b cb 39 47 fb 51 6f a8 1e b2 1e d3 ac 2f f1 7d 9f a3 63 39 d0 b6 Data Ascii: 'm!][]WU^crWQn%>^v`}S#at.hVMFIUk,}f~;:xMCR8%K6yfslZZ!kyqV3SkoQ,N[2mn+X^,+#}V5U5x%ozIm~waUkT;(N67%N[9GQo/}c9
2024-04-19 21:51:17 UTC	8192	IN	Data Raw: 35 fb b3 e8 97 df 65 9f 3b da 8f bc bf 86 bf 76 07 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 47 67 7e f8 b7 fd 65 fd 2c fa 7e 1f d9 1f 30 d9 df be 2d ff 00 59 7f 4b 3e 9f 87 f6 40 76 68 f6 25 44 54 7b 12 a0 04 55 17 42 52 2a 9d 80 e7 dc c7 b9 c7 b9 a6 ba 9d 8b a9 65 99 c6 ba a9 96 60 51 9d 35 99 a7 0c 4e b2 cc 8f 8c b5 02 45 04 6e a0 88 15 6f 26 f1 ac 04 d1 a6 4d 4e 29 15 a3 58 dd 56 48 0e a5 09 25 ea 74 68 56 59 77 3c fc 2e 72 f5 2d 51 bb f2 07 a2 85 54 fd 4c ca 59 a3 97 42 eb 3f 52 d4 6a e6 80 8a e5 f4 67 22 e9 f7 3a b5 de 69 9c 9b b5 dc 0e 75 49 f5 34 e2 98 af 9a 6c 83 79 81 61 d5 21 9d 57 a9 ae f3 34 97 50 1c 57 99 25 3a ac 83 74 96 9c 40 b7 4e 6c 93 79 91 53 89 be 5d 00 ce f3 0a 46 Data Ascii: 5e;v Gg~e,~0-YK>@vh%DT{UBR*e`Q5NEno&MN)XVH%thVYw<.r-QTLYB?Rjg":iuI4lya!W4PW%:t@NlyS]F
2024-04-19 21:51:17 UTC	3338	IN	Data Raw: b3 4a 6a 25 4d e3 1c 5c bd 40 ea d3 b9 49 77 27 85 d2 d4 e1 2b 96 49 4e e5 e7 dc 0f 41 4e be 64 aa 4a 48 e4 5b d6 6f d4 e8 52 93 68 0c d4 89 16 ef 52 c4 96 68 8b 20 36 a5 12 ca fb 24 14 d1 3f a0 10 56 f5 28 56 2f 55 28 56 f5 02 b4 bb b3 43 76 ba 9a e4 06 a6 3a 1b 64 63 20 08 dd 23 09 1b a4 06 0d 5b 36 68 d1 80 cc 29 1a 80 25 8c 8d b3 22 8b 37 4c 03 34 6c d9 91 30 37 52 24 8b 2b a2 68 01 32 66 73 35 4c 01 96 cd 1b 32 cd 18 18 de 0a 46 ac c0 12 ef 8c cd 11 b2 40 6c 86 41 23 64 06 b9 1a b4 48 6a d0 11 e4 65 19 c8 24 50 48 ce e9 98 a3 75 12 0d 61 12 7a 46 b1 83 d0 9a 9c 00 b1 44 b5 02 b5 35 d0 b3 04 04 a8 64 10 01 90 c8 00 19 0c 80 01 90 c8 00 19 00 00 0c 80 01 90 00 06 43 20 00 64 32 00 00 00 00 c8 00 19 0c 80 00 00 01 90 c8 00 00 00 03 20 00 64 61 a3 26 18 Data Ascii: Jj%M\@Iw'+INANdJH[oRhRh 6$?V(V/U(VCv:dc #[6h)%"7L4l07R$+h2fs5L2F@lA#dHje$PHuazFD5dC d2 da&

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:51:18 UTC	1825	OUT	GET /transform/thumbnail?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Festgirls-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!3wg9-hIsbkKjisgTkXNd6LRDPUacccZPsT38WqC54ml1Bruter-IRZ4fXQ1eVBg9%2Fitems%2F01PD5Q4JXARXIMAEOQLZG3T5IZSE6ZB6TH%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvZXN0Z2lybHMtbXkuc2hhcmVwb2ludC5jb21AYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiIiwiY2FjaGVrZXkiOiIwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNlNDM3NmVjMDI1NmQ1MTJlMjM3MzIwOWNmNDM5OTY5ZGE0ZDk0MzYzNGZlOTZjYTU1NmZmMWE3YTFjMTVhNGJlIiwiZW5kcG9pbnR1cmwiOiJURjgwRTBXRUM0cWNENzhvRWQxb0gwRjNxVXl4RlF6RXdvSjlrT1VybHlNPSIsImVuZHBvaW50dXJsTGVuZ3RoIjoiMTE4IiwiZXhwIjoiMTcxMzU4MjAwMCIsImlwYWRkciI6IjgxLjE4MS41Ny41MiIsImlzbG9vcGJhY2siOiJUcnVlIiwiaXNzIjoiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwIiwiaXN1c2VyIjoidHJ1ZSIsIm5hbWVpZCI6IjAjLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUiLCJuYmYiOiIxNzEzNTYwNDAwIiwibmlpIjoibWljcm9zb2Z0LnNoYXJlcG9pbnQiLCJzaGFyaW5naWQiOiIzTlVzZFR6QS9rT0M0cEJvQmJKRjFnIiwic2l0ZWlkIjoiWm1FelpEQTRaR1l0TW1NeE1pMDBNalpsTFdFek9HRXRZemd4TXpreE56TTFaR1U0Iiwic25pZCI6IjYiLCJzdHAiOiJ0IiwidHQiOiIwIiwidmVyIjoiaGFzaGVkcHJvb2Z0b2tlbiJ9.ZgbJkRJ9o5Ke5sfg2XVFcy9TQ4gtZLqksRzitF_6T4Q&cTag=%22c%3A%7BC0D08DE0-D011-4D5E-B9F5-19913D90FA67%7D%2C1%22&encodeFailures=1&width=1280&height=859&srcWidth=&srcHeight= HTTP/1.1 Host: northeurope1-mediap.svc.ms Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 21:51:19 UTC	914	IN	HTTP/1.1 200 OK Cache-Control: private, max-age=2592000 Content-Length: 43482 Content-Type: image/jpeg Expires: Sun, 19 May 2024 21:51:18 GMT ETag: "{C0D08DE0-D011-4D5E-B9F5-19913D90FA67},2" X-AspNetMvc-Version: 5.2 Access-Control-Expose-Headers: x-cache, x-msedge-ref, x-azure-ref-originshield X-OneDriveMpc-Version: 1.1.9.0 X-StreamOrigin: Cached Server-Timing: Provider;dur=68,SharePoint;dur=40,StreamRead;dur=8,TotalRequest;dur=159,Sandbox;dur=69 Request-Stat: Cached;True,RemoteReads;1 X-CorrelationId: 733d331c-8a57-43f2-9f63-fd4d235a79f6 X-OneDriveMeTA-Version: 1.480.58163.0 X-OneDriveMeTA-Build: Media_prod_31514963_040124.1_03-28-2024 X-OneDriveMeTA-Region: northeurope X-AspNet-Version: 4.0.30319 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 0F89EADEBE1F4941B6D1C6F652D246CD Ref B: ATL331000106011 Ref C: 2024-04-19T21:51:18Z Date: Fri, 19 Apr 2024 21:51:18 GMT Connection: close
2024-04-19 21:51:19 UTC	3256	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 06 04 04 05 04 04 06 05 05 05 06 06 06 07 09 0e 09 09 08 08 09 12 0d 0d 0a 0e 15 12 16 16 15 12 14 14 17 1a 21 1c 17 18 1f 19 14 14 1d 27 1d 1f 22 23 25 25 25 16 1c 29 2c 28 24 2b 21 24 25 24 ff db 00 43 01 06 06 06 09 08 09 11 09 09 11 24 18 14 18 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 ff c0 00 11 08 02 f0 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 01 00 02 03 01 01 01 00 00 00 00 00 00 00 00 00 00 03 04 01 02 05 06 07 08 ff c4 00 49 10 00 02 01 02 03 07 01 04 08 03 05 08 02 01 04 03 00 01 02 03 04 05 11 51 06 12 13 14 21 31 61 41 07 16 a2 d1 15 22 32 35 53 54 71 Data Ascii: JFIF``C!'"#%%%),($+!$%$C$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$"IQ!1aA"25STq
2024-04-19 21:51:19 UTC	8192	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc 66 00 00 00 00 00 00 00 00 00 01 98 00 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 ab 2b d6 ed 22 c3 2b d6 ed 20 38 d7 df 65 9f 3b da 8f bc bf 86 bf 76 7d 12 fb ec b3 e7 7b 51 f7 97 f0 d7 ee c0 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 ec ef df 16 ff 00 ac bf a5 9f 4f c3 fb 23 e6 1b 3b f7 c5 bf eb 2f e9 67 d3 f0 fe c8 0e cd 1e c4 a8 8a 8f 62 54 00 00 00 c6 66 1b c8 8e 53 c8 09 37 96 a6 37 d6 a5 69 d7 4b d4 86 57 69 7a 81 7f 88 b5 31 c4 5a 9c c7 7c 97 a9 a3 bf 8e a0 75 b8 8b 50 aa 2d 4e 47 d2 11 d4 da 37 f1 7e a0 75 b8 8b Data Ascii: f3+"+ 8e;v}{QO#;/gbTfS77iKWiz1Z\|uP-NG7~u
2024-04-19 21:51:19 UTC	4144	IN	Data Raw: a9 3d 0e aa b2 cf d0 cf 25 e0 0e 5c 69 b5 e8 4f 4e 4e 25 c7 67 e0 c7 2a f4 03 14 ae 1a 2e 50 b9 79 f7 2a ab 66 4f 4a 8b cf b0 1d 5b 5a cd 9d 5a 12 6d 1c 8b 4a 6d 1d 6b 78 e4 80 b9 06 6e 69 05 d0 dc 00 00 0d 59 5e b7 69 16 19 5e b7 69 01 c6 be fb 2c f9 de d4 7d e5 fc 35 fb b3 e8 97 df 65 9f 3b da 8f bc bf 86 bf 76 07 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 47 67 7e f8 b7 fd 65 fd 2c fa 7e 1f d9 1f 30 d9 df be 2d ff 00 59 7f 4b 3e 9f 87 f6 40 76 68 f6 25 44 54 7b 12 a0 06 1a 32 18 11 4e 39 95 aa 51 4c b5 26 43 29 a0 2a 4a d9 3f 42 3e 55 68 5b 73 46 37 90 15 95 a2 d0 72 ab 42 ce f2 1b c8 0a bc a2 0a d1 68 5a df 89 85 34 04 0a d5 2f 43 6e 59 65 d8 9b 7d 0d f4 05 67 6c b4 35 e5 11 6f 7e 26 Data Ascii: =%\iONN%g.PyfOJ[ZZmJmkxniY^i^i,}5e;v Gg~e,~0-YK>@vh%DT{2N9QL&C)*J?B>Uh[sF7rBhZ4/CnYe}gl5o~&
2024-04-19 21:51:19 UTC	8192	IN	Data Raw: d9 b1 9b 02 c7 1b c9 87 5f c9 56 52 21 9d 5c 80 bc ee 16 5d c8 67 70 b5 28 4a e5 af 52 19 5c 66 05 b9 d6 59 9a c6 a6 65 2e 36 66 d1 aa 07 42 33 59 11 56 9a c8 82 35 ba 77 35 9d 4c c0 ad 71 3e e7 3a ad 46 99 d1 ab 07 22 9d 4b 66 f3 e8 05 45 5e 49 96 ed ae 1e 7d c8 79 59 67 d9 93 d1 b6 69 81 d6 b5 ae f5 2e 71 7e af 73 9d 6f 4d a4 5b ea a2 06 95 e7 dc a7 29 66 c9 6b 3e fd 4a 92 97 50 27 8b 44 91 68 ab 19 92 46 a0 16 3a 0c 91 14 66 6d bc 04 9d 07 42 27 30 a6 04 eb 20 44 a6 6d bc 06 fd 0c c5 22 2d e0 a6 05 94 90 e8 44 aa 74 0e a0 12 36 91 ab 99 13 a8 6b be 04 d9 a6 63 a1 1c 66 67 78 0c b4 6b d0 d5 c8 d7 78 09 22 91 62 8a 59 95 14 8b 14 67 d4 0e 9d 04 5e a7 d8 e7 db c8 bf 4d f4 02 64 02 00 00 00 6a ca f5 bb 48 b0 ca f5 bb 48 0e 35 f7 d9 67 ce f6 a3 ef 2f e1 af Data Ascii: _VR!\]gp(JR\fYe.6fB3YV5w5Lq>:F"KfE^I}yYgi.q~soM[)fk>JP'DhF:fmB'0 Dm"-Dt6kcfgxkx"bYg^MdjHH5g/
2024-04-19 21:51:19 UTC	8192	IN	Data Raw: 5e 63 8a 92 9a 72 57 51 c9 6e c5 25 d1 e4 f3 cf 3e c7 02 5e cb 76 81 60 cb 04 8e 19 7d 53 0e b2 c5 23 8a 61 74 2e 68 da d5 56 8d 4d b7 46 7f f3 49 55 a5 93 6b 2c a2 d6 7d df 66 1e b6 c7 da 7e 01 8b 3b 3a 78 4d 1c 43 13 b8 ba b7 95 d3 b7 b5 a2 a5 52 8d 38 cd c1 b9 a7 25 97 d6 8c 96 4b 36 da 79 66 73 6c bd a9 5a d1 ad 5a 8e 21 6b 79 71 56 ae 33 53 09 b6 a7 6b 6f 18 b5 51 2c e3 4e 5b d5 32 6d a4 fe b7 6e 9e 86 96 9b 2b b5 58 5e d1 d0 da 2c 2b 00 8d 85 ef 23 f4 7d cd 0a 56 96 ca d6 ad 35 55 d4 8b 85 35 78 9c 25 9c 9e 6f 7a 49 f7 c8 f3 98 be c2 6d 7e 1f 77 86 dd db 61 b7 55 6b 54 da b5 8c cb 3b 28 4e 36 d0 e1 c9 37 25 4e e2 5b cb 39 47 fb 51 6f a8 1e b2 1e d3 ac 2f f1 7d 9f a3 63 39 d0 b6 bf b9 bb b6 b9 85 cd bb e2 52 a9 42 0e 52 83 6a 5f 52 4b 2c fb 34 d1 88 Data Ascii: ^crWQn%>^v`}S#at.hVMFIUk,}f~;:xMCR8%K6yfslZZ!kyqV3SkoQ,N[2mn+X^,+#}V5U5x%ozIm~waUkT;(N67%N[9GQo/}c9RBRj_RK,4
2024-04-19 21:51:19 UTC	8192	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 47 67 7e f8 b7 fd 65 fd 2c fa 7e 1f d9 1f 30 d9 df be 2d ff 00 59 7f 4b 3e 9f 87 f6 40 76 68 f6 25 44 54 7b 12 a0 04 55 17 42 52 2a 9d 80 e7 dc c7 b9 c7 b9 a6 ba 9d 8b a9 65 99 c6 ba a9 96 60 51 9d 35 99 a7 0c 4e b2 cc 8f 8c b5 02 45 04 6e a0 88 15 6f 26 f1 ac 04 d1 a6 4d 4e 29 15 a3 58 dd 56 48 0e a5 09 25 ea 74 68 56 59 77 3c fc 2e 72 f5 2d 51 bb f2 07 a2 85 54 fd 4c ca 59 a3 97 42 eb 3f 52 d4 6a e6 80 8a e5 f4 67 22 e9 f7 3a b5 de 69 9c 9b b5 dc 0e 75 49 f5 34 e2 98 af 9a 6c 83 79 81 61 d5 21 9d 57 a9 ae f3 34 97 50 1c 57 99 25 3a ac 83 74 96 9c 40 b7 4e 6c 93 79 91 53 89 be 5d 00 ce f3 0a 46 a1 01 be f3 32 a4 cd 06 60 4c a6 6c aa 15 d3 36 de 60 4d c4 34 75 3c 91 Data Ascii: Gg~e,~0-YK>@vh%DT{UBR*e`Q5NEno&MN)XVH%thVYw<.r-QTLYB?Rjg":iuI4lya!W4PW%:t@NlyS]F2`Ll6`M4u<
2024-04-19 21:51:19 UTC	3314	IN	Data Raw: e5 e7 dc 0f 41 4e be 64 aa 4a 48 e4 5b d6 6f d4 e8 52 93 68 0c d4 89 16 ef 52 c4 96 68 8b 20 36 a5 12 ca fb 24 14 d1 3f a0 10 56 f5 28 56 2f 55 28 56 f5 02 b4 bb b3 43 76 ba 9a e4 06 a6 3a 1b 64 63 20 08 dd 23 09 1b a4 06 0d 5b 36 68 d1 80 cc 29 1a 80 25 8c 8d b3 22 8b 37 4c 03 34 6c d9 91 30 37 52 24 8b 2b a2 68 01 32 66 73 35 4c 01 96 cd 1b 32 cd 18 18 de 0a 46 ac c0 12 ef 8c cd 11 b2 40 6c 86 41 23 64 06 b9 1a b4 48 6a d0 11 e4 65 19 c8 24 50 48 ce e9 98 a3 75 12 0d 61 12 7a 46 b1 83 d0 9a 9c 00 b1 44 b5 02 b5 35 d0 b3 04 04 a8 64 10 01 90 c8 00 19 0c 80 01 90 c8 00 19 00 00 0c 80 01 90 00 06 43 20 00 64 32 00 00 00 00 c8 00 19 0c 80 00 00 01 90 c8 00 00 00 03 20 00 64 61 a3 26 18 10 54 5d 19 cf af ea 74 2a f6 28 57 f5 03 9f 57 d4 ab 50 b7 57 ae 65 49 Data Ascii: ANdJH[oRhRh 6$?V(V/U(VCv:dc #[6h)%"7L4l07R$+h2fs5L2F@lA#dHje$PHuazFD5dC d2 da&T]t*(WWPWeI

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:51:19 UTC	2086	OUT	GET /_layouts/15/odspserviceworkerproxy.aspx?swManifestName=odbmspdfwebworker&debug=false&bypass=false HTTP/1.1 Host: estgirls-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: worker Referer: https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epdf&parent=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments&ga=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=; MicrosoftApplicationsTelemetryDeviceId=ccc88f20-cdb4-4f2c-8688-a92937621503
2024-04-19 21:51:19 UTC	1905	IN	HTTP/1.1 200 OK Cache-Control: max-age=600 Content-Length: 529 Content-Type: text/javascript; charset=utf-8 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzM1MzAwMDAwMDAsMCwxMzM1ODEyMzQ1Mzg0ODM0MDIsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNDJhODIwYTEtYTAxMi04MDAwLTg3OTgtZDM1NTQxMmQxNGQ5LDQyYTgyMGExLWEwMTItODAwMC04Nzk4LWQzNTU0MTJkMTRkOSwzTlVzZFR6QS9rT0M0cEJvQmJKRjFnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGdnTDZlWE9nNnFOT2s0dlVxbVJnYU9aWE9LazF3c1VYdms5WXJSckJDaW0rREZaa2Z5enIxUmY1Z0dTSlcvYWxSdURjUUF4ZDFPZENBMzc3R01TMUd5N3g3amZaQllseVVHV2F4WlM4NlhWYStFZk1rb2NTU2p4a3dEK3Z0UmU4QlhaQWZ2WnJiTlVZVFJBakcvM09GZUhoWi9BbVhISjQzcGVsYWhtT3JMZDl3YllneFJRSU5vV1pXbHlaOFFZdk9vb0RlYXZ0WDlvT1RYeU1rU2NWRWNRdWk5RnhzYlUrSXRuRnhRcmFwNmEvWVhYQVhBalREdUx3TEIwUmRpcjQvd2ZONU1tK0NHMHBDTFA5UFlzclA5bmFpeDg0S3NSc0pHOFBEdWdqTVJSMk5MaURjaHVoWHJsV2JjWEFiMjlJbHJFbzZxT29VVmxhQm9LZUNnbmRNZz09PC9TUD4=; path=/; SameSite=None; secure; HttpOnly Service-Worker-Allowed: / Strict-Transport-Security: max-age=31536000 X-AspNet-Version: 4.0.30319 SPRequestDuration: 19 SPIisLatency: 0 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 666F01C0C4934A4DB815E6D79B0BD7B4 Ref B: ATL331000101033 Ref C: 2024-04-19T21:51:19Z Date: Fri, 19 Apr 2024 21:51:19 GMT Connection: close
2024-04-19 21:51:19 UTC	529	IN	Data Raw: 0d 0a 76 61 72 20 5f 73 74 61 72 74 54 69 6d 65 3d 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 2c 5f 73 74 61 72 74 54 69 6d 65 54 69 63 6b 73 3d 44 61 74 65 2e 6e 6f 77 28 29 3b 0a 76 61 72 20 5f 73 68 6f 75 6c 64 42 79 70 61 73 73 3d 66 61 6c 73 65 3b 0a 76 61 72 20 5f 63 64 6e 42 61 73 65 55 72 6c 3d 27 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 66 69 6c 65 73 2f 6f 64 73 70 2d 77 65 62 2d 70 72 6f 64 5f 32 30 32 34 2d 30 34 2d 30 35 2e 30 31 31 2f 27 3b 0a 76 61 72 20 5f 73 77 42 75 69 6c 64 4e 75 6d 62 65 72 3d 27 6f 64 73 70 2d 77 65 62 2d 70 72 6f 64 5f 32 30 32 34 2d 30 34 2d 30 35 2e 30 31 31 27 3b 0a 76 61 72 20 5f 77 77 42 75 69 6c 64 4e 75 6d 62 65 72 3d 27 6f 64 73 70 2d 77 65 62 2d 70 72 6f Data Ascii: var _startTime=performance.now(),_startTimeTicks=Date.now();var _shouldBypass=false;var _cdnBaseUrl='https://res-1.cdn.office.net/files/odsp-web-prod_2024-04-05.011/';var _swBuildNumber='odsp-web-prod_2024-04-05.011';var _wwBuildNumber='odsp-web-pro